How should OPC UA PubSub key rotation be tested without confusing it with a network outage?

Record the configured SecurityGroup, key identifiers and implementation status codes without logging secret key material. Confirm that the intended participants can obtain the correct keys through the configured service. Publisher and subscriber must use compatible security settings and key context.

Check whether messages still arrive at the transport boundary while validation fails. Keep transport, authentication and decoding diagnostics separate so a security failure is not reported merely as no new data. Correlate logs using a suitable common time reference.

Exercise rotation with a subscriber temporarily disconnected and with the key service unavailable in a test environment. Define an observable stale-data state and the supported recovery behavior. Do not restore apparent operation by silently disabling signature validation or encryption.