function verifyServer(server: OPCUAServer) {

        debugLog("---------------------------------------------------------------");
        const certificateChain1 = server.getCertificateChain();
        debugLog("server.getCertificateChain() =",
          makeSHA1Thumbprint(certificateChain1).toString("hex") + " l=" + certificateChain1.length);
        const privateKey1 = convertPEMtoDER(server.getPrivateKey());
        debugLog("server.getPrivateKey()       =",
          makeSHA1Thumbprint(privateKey1).toString("hex"));

        const match = certificateMatchesPrivateKey(certificateChain1, privateKey1);
        debugLog("math                         =", match);

        for (const endpoint of server.endpoints) {
            debugLog("endpoint ", endpoint.toString());

            for (const e of endpoint.endpointDescriptions()) {
                const certificateChain3 = e.serverCertificate;
                debugLog("endpoint certificate =",
                  makeSHA1Thumbprint(certificateChain3).toString("hex") + " l=" + certificateChain3.length);
                // xx console.log(e.toString());
            }

        }
        debugLog("---------------------------------------------------------------");

    }

    async function simulateCertificateAndPrivateKeyChange(server: OPCUAServer) {
        const _server = server as any as OPCUAServerPartial;

        // create a new key pair
        const { certificate, privateKey } = await produceCertificateAndPrivateKey();

        _server.$$privateKeyPEM = toPem(privateKey, "RSA PRIVATE KEY");
        _server.$$certificateChain = certificate;
        _server.$$certificate = undefined;
        await server.suspendEndPoints();
        await server.shutdownChannels();
        await server.resumeEndPoints();

    }

    it("SCT-1 should modify a server to support push certificate management", async () => {

        const server = new OPCUAServer({
            port: 20000,
            serverCertificateManager: certificateManager,
            userCertificateManager: certificateManager
        });

        await server.initialize();

        await installPushCertificateManagementOnServer(server);

        const privateKey1PEM = await promisify(fs.readFile)(server.serverCertificateManager.privateKey, "utf8");
        const privateKey1 = convertPEMtoDER(privateKey1PEM);
        const privateKey2 = convertPEMtoDER(server.getPrivateKey());
        privateKey1.toString("base64").should.eql(privateKey2.toString("base64"));

        // now start the server
        await server.start();

        // now stop the server
        await server.shutdown();
    });

async function onCertificateAboutToChange(server: OPCUAServer) {
    debugLog(chalk.yellow(" onCertificateAboutToChange => Suspending End points"));
    await server.suspendEndPoints();
    debugLog(chalk.yellow(" onCertificateAboutToChange => End points suspended"));
}

    async function constructServerWithPushCertificate(): Promise<OPCUAServer> {

        // given that the server user manager is able to identify a  system administrator
        const mockUserManager = {

            isValidUser: (userName: string, password: string) => {

                if (userName === "admin" && password === "secret") {
                    return true;
                }
                return false;
            },

            // see OPCUA 1.04 part 3 4.8.2 Well know role
            // Anonymous          The Role has very limited access for use when a Session has anonymous credentials.
            // AuthenticatedUser  The Role has limited access for use when a Session has valid non-anonymous credentials
            //                    but has not been explicitly granted access to a Role.
            // Observer           The Role is allowed to browse, read live data, read historical data/events or subscribe to
            //                    data/events.
            // Operator           The Role is allowed to browse, read live data, read historical data/events or subscribe to
            //                    data/events.
            //                    In addition, the Session is allowed to write some live data and call some Methods.
            // Engineer           The Role is allowed to browse, read/write configuration data, read historical data/events,
            //                    call Methods or subscribe to data/events.
            // Supervisor         The Role is allowed to browse, read live data, read historical data/events, call Methods
            //                    or subscribe to data/events.
            // ConfigureAdmin     The Role is allowed to change the non-security related configuration settings.
            // SecurityAdmin      The Role is allowed to change security related settings.

            getUserRole(username: string): string {
                if (username === "anonymous") {
                    return "Anonymous";
                }
                if (username === "admin") {
                    return "AuthenticatedUser;SecurityAdmin";
                }
                return "None";
            }

        };

        const server = new OPCUAServer({

            port: 2010,

            nodeset_filename: nodesets.standard,
            userManager: mockUserManager,

            serverCertificateManager: certificateManager,
            userCertificateManager: certificateManager
        });
        await server.initialize();

        verifyServer(server);

        await installPushCertificateManagementOnServer(server);
        debugLog("private key location =  ", server.serverCertificateManager.privateKey);

        verifyServer(server);

        // Given that the server is configured to trust client certificate
        const clientCertificatePEM = await promisify(fs.readFile)(clientCertificateFile, "utf8");
        const clientCertificateDER = convertPEMtoDER(clientCertificatePEM);
        await server.serverCertificateManager.trustCertificate(clientCertificateDER);

        // also trusted newest certificate

        return server;
    }

    setTimeout(async () => {
        try {
            debugLog(chalk.yellow(" onCertificateChange => shutting down channels"));
            await server.shutdownChannels();
            debugLog(chalk.yellow(" onCertificateChange => channels shut down"));

            debugLog(chalk.yellow(" onCertificateChange => resuming end points"));
            await server.resumeEndPoints();
            debugLog(chalk.yellow(" onCertificateChange => end points resumed"));

            debugLog(chalk.yellow("channels have been closed -> client should reconnect "));

        } catch (err) {
            // tslint:disable:no-console
            errorLog("Error in CertificateChanged handler ", err.message);
            debugLog("err = ", err);
        }
    }, 2000);