Class to implement the subfunction TransmitCertificate (29 04) of UDS service Authentication as interface to application. This class implements a so called generic interface, where the application has means to handle one ore more certificateEvaluationId transferred certificates.
Enables the application to receive and verify diagnostic certificates in the UDS Authentication service.
AI-GENERATEDunreviewedModel: gemini-3.8-flash-medium · Effort: medium · Temperature: not controllable · Prompt: 82e724c2cab7ProvenanceOpen questions (1)
translated from the German guidegemini-3.8-flash-low · 2026-10-13 · German original
Enables the application to receive and verify diagnostic certificates in the UDS Authentication service.
The class ara::diag::TransmitCertificate implements the application interface for the UDS sub-function TransmitCertificate (0x29 0x04) of the service Authentication[SWS_DM_01961]. After release via Offer(), the application receives transmitted certificate data in the asynchronous method Process() and initiates application-specific verification [SWS_DM_01968]. Upon successful verification, Diagnostic Management triggers a positive UDS response with the return parameter 0x13 (CertificateVerified), whereas errors are answered as a negative response with a corresponding NRC. The instance is permanently bound to a port interface and must neither be copied nor moved.
Context
The class ara::diag::TransmitCertificate[SWS_DM_01961] in the header ara/diag/transmit_certificate.h (AUTOSAR_AP_SWS_Diagnostics §8.26 “Header: ara/diag/transmit_certificate.h”) represents the interface of the Adaptive Application for realizing the UDS sub-function TransmitCertificate (0x29 0x04) of the service Authentication. As a generic interface, it enables the application to receive and process one or more transmitted certificates based on a 16-bit identifier (certificateEvaluationId).
Three main components are involved in the interaction:
The external diagnostic tester, which sends the UDS request for certificate transmission to the vehicle [SWS_DM_01968].
The Diagnostic Server (Diagnostic Management, DM) of the Adaptive Platform, which filters incoming diagnostic requests, forwards them, and generates the final UDS responses [SWS_DM_01251], [SWS_DM_01969].
The Adaptive Application, which provides an instance derived from ara::diag::TransmitCertificate, performs the certificate verification, and returns the result asynchronously to the server [SWS_DM_01968].
Instances of ara::diag::TransmitCertificate are created via the constructor by specifying an ara::core::InstanceSpecifier as well as the concurrency mode ConcurrencyType[SWS_DM_01962]. In the manifest, the InstanceSpecifier must reference an PortPrototype that is typed by an DiagnosticTransmitCertificateInterface[SWS_DM_01962]. If this mapping fails or if the instance identifier is used multiple times in the current process, runtime violations such as InstanceSpecifierMappingIntegrityViolation, PortInterfaceMappingViolation, ProcessMappingViolation, or InstanceSpecifierAlreadyInUseViolation occur [SWS_DM_01962].
The class is subject to strict ownership and instantiation rules: An authentication handler is designed as a unique, non-copyable, and non-movable instance. Accordingly, the copy constructor [SWS_DM_01964], copy assignment operator [SWS_DM_01966], move constructor [SWS_DM_01963], and move assignment operator [SWS_DM_01965] are explicitly deleted (=delete).
The constructor itself is specified as thread-safe and exception-safe [SWS_DM_01962]. Destruction is performed via the default virtual destructor [SWS_DM_01967]. Whether the actual execution method Process must be implemented in a thread-safe manner depends on the selected concurrencyType (kConcurrent or kNotConcurrent) [SWS_DM_01962], [SWS_DM_01968].
Usage Path
The regular flow comprises handler registration, processing of incoming certificates, and subsequent deregistration:
Offer service (Offer): The application calls Offer() to signal to Diagnostic Management that requests for the configured interface may be forwarded to this handler [SWS_DM_01969].
Receive request (Process): If a UDS request of the sub-function TransmitCertificate arrives at the Diagnostic Server, it forwards the data to the pure virtual method Process() of the application [SWS_DM_01968]. The method receives the 16-bit identifier certificateEvaluationId, the raw certificate data as ara::core::Span<ara::core::Byte const>, metadata (metaInfo), and an cancellationHandler[SWS_DM_01968].
Evaluation and action: Since AUTOSAR does not prescribe fixed semantics for the certificates, verification and the derivation of necessary actions are entirely the responsibility of the application [SWS_DM_01968]. Interpretation: The application is typically expected to verify the transmitted certificate cryptographically or use it to update an internal key storage. Question Q-34844f9257d074c6 (open)
Error states can occur in different phases of the lifecycle:
Already active offer: If Offer() is called even though the service is already actively offered for this instance, the call fails and returns the error code DiagOfferErrc::kAlreadyOffered with rollback semantics in the ara::core::Result<void>[SWS_DM_01969]. Offer() and StopOffer() are not thread-safe and must not be called concurrently [SWS_DM_01969], [SWS_DM_01970].
Cancellation of ongoing conversations: During asynchronous processing, the application can query the status via cancellationHandler.IsCanceled() to determine whether the diagnostic conversation was canceled [SWS_DM_01968]. In addition, a callback function can be registered via cancellationHandler.SetNotifier(...) that is notified immediately upon cancellation [SWS_DM_01968].
This guide is based on the AUTOSAR Adaptive Platform R25-11 specification (module diag) and was curated with the help of AI.
This method is used to process certificates send by a diagnostic tester, via the UDS subfunction TransmitCertificate inside the application. There is no specific semantics for the certificate and it is left to the application to process the received certificate and derive the needed actions.
This Offer will enable the DM to forward request messages to this handler.
AI-GENERATEDunreviewedModel: gemini-3.8-flash-medium · Effort: medium · Temperature: not controllable · Prompt: db62dd9c27e2ProvenanceOpen questions (1)
translated from the German guidegemini-3.8-flash-low · 2026-10-13 · German original
Via the method Offer, an Adaptive Application activates the forwarding of diagnostic requests by the Diagnostic Management (DM) to the responsible handler of class ara::diag::TransmitCertificate[SWS_DM_01969]. The call is synchronous and parameterless; the interface is defined as exception-safe (noexcept) [SWS_DM_01969]. ara::core::Result<void> serves as the return type, communicating the success of the registration or an error state to the caller [SWS_DM_01969].
If the function has already been called previously for the relevant handler instance, a renewed call fails and returns the specific error DiagOfferErrc::kAlreadyOffered with rollback semantics [SWS_DM_01969], which corresponds to the standardized error value in DiagErrc[SWS_DM_00514]. Because the method is explicitly specified as not thread-safe [SWS_DM_01969], concurrent accesses to the same instance must be avoided (Interpretation: Protection against concurrent calls is the responsibility of the application software). Question Q-b44b11a0a2dcb2b4 (open)
The functional pattern of Offer follows the unified provision concept of diagnostic handlers, as also applied to ara::diag::Authentication::Offer[SWS_DM_01130], ara::diag::CommunicationControl::Offer[SWS_DM_00809], or ara::diag::GenericRoutine::Offer[SWS_DM_00557]. AUTOSAR clarifies that despite naming aligned with ara::com, this is an independent diagnostic implementation (AUTOSAR_AP_SWS_Diagnostics §7.3.4.1.2 “Monitors”). Prior to provision by Offer, the DM does not forward any requests to the handler, analogously to DoIP services which are considered not ready prior to the call [SWS_DM_01525].
This usage note was generated automatically and is based on the specifications of release R25-11.
This method is used to process certificates send by a diagnostic tester, via the UDS subfunction TransmitCertificate inside the application. There is no specific semantics for the certificate and it is left to the application to process the received certificate and derive the needed actions.
AI-GENERATEDunreviewedModel: gemini-3.8-flash-medium · Effort: medium · Temperature: not controllable · Prompt: d261181b4bb6Provenance
translated from the German guidegemini-3.8-flash-low · 2026-10-13 · German original
The method Process of interface class ara::diag::TransmitCertificate is used for the application-internal processing of certificates transmitted by a diagnostic tester within the scope of UDS service 0x29 (Authentication) via the subfunction TransmitCertificate (0x04) [SWS_DM_01968], AUTOSAR_AP_SWS_Diagnostics §7.3.2.8.11.5 “Service 0x29 – transmitCertificate (0x04)”. Since AUTOSAR does not define specific semantics for the certificate, the substantive verification and the derivation of required actions are entirely the responsibility of the application [SWS_DM_01968].
The method is called asynchronously and accepts the following parameters [SWS_DM_01968]:
certificateEvaluationId: 16-bit evaluation ID from the UDS request message for identifying the certificate evaluation [SWS_DM_01968], [SWS_DM_01247].
certificateData: The certificate data transmitted by the tester as ara::core::Span<ara::core::Byte const>[SWS_DM_01968].
metaInfo: Meta-information on the diagnostic request [SWS_DM_01968].
cancellationHandler: Enables querying the cancellation status via cancellationHandler.IsCanceled() as well as registering a notification via cancellationHandler.SetNotifier() in case of a premature cancellation of the diagnostic conversation [SWS_DM_01968].
The return is asynchronous as ara::core::Future<void>[SWS_DM_01968]. If processing fails, an applicable Negative Response Code (NRC) according to ISO 14229-1 must be provided via DiagUdsNrcErrc[SWS_DM_01968]. The function is declared as noexcept and is exception-safe (exception safe) [SWS_DM_01968].
Thread safety is conditional (conditional): it is governed by the ConcurrencyType passed to the constructor of ara::diag::TransmitCertificate[SWS_DM_01968]. Prior to forwarding, the Diagnostic Manager validates the request based on the certificateEvaluationId[SWS_DM_01247].
This usage note was generated automatically based on the AUTOSAR R25-11 specification.
conditional whether the function has to be implemented thread safe or non-thread safe is determined by the ConcurrencyType given in the constructor
Parameter (in)
Parameter
Beschreibung
certificateEvaluationId
Represents the 16bit certificate evaluation ID as part of the UDS request message
certificateData
Certificate to be verified, transmitted by the tester
metaInfo
MetaInfo of the request.
cancellationHandler
This parameter is used to • Query the current cancellation status by calling cancellationHandler.IsCanceled. Returns true in case, the current conversation has been cancelled and false otherwise. • Register a notifier function by calling cancellationHandler.SetNotifier. The registered notifier is called if the current conversation is cancelled.
This StopOffer will disable the forwarding of request messages from DM.
AI-GENERATEDunreviewedModel: gemini-3.8-flash-medium · Effort: medium · Temperature: not controllable · Prompt: 7da07a83c1d7ProvenanceOpen questions (1)
translated from the German guidegemini-3.8-flash-low · 2026-10-13 · German original
The method StopOffer of class ara::diag::TransmitCertificate ([SWS_DM_01970]) terminates the provision of the certificate transmission service for Diagnostic Management (DM). Calling it deactivates the forwarding of incoming diagnostic request messages from the DM to this handler ([SWS_DM_01970]).
Usage and Semantics
The call is parameterless via the signature void StopOffer() noexcept; from header ara/diag/transmit_certificate.h ([SWS_DM_01970]). The function does not return a value and is specified as noexcept as well as exception safe ([SWS_DM_01970]), so that it is guaranteed not to throw any exceptions.
Concurrency and Limitations
The method is explicitly specified as not thread-safe ([SWS_DM_01970]). Callers must therefore ensure that concurrent calls on the same instance of ara::diag::TransmitCertificate are synchronized by external mechanisms. Interpretation: Prior to destroying a service instance or during temporary deactivation, StopOffer is likely called to prevent the arrival of new requests during the state transition. Question Q-9ab97301565c5bf9 (open)
Interaction
The concept corresponds to the standardized DM pattern for disabling message forwarding, as also defined in related interfaces such as [SWS_DM_00767] (SecurityAccess), [SWS_DM_00810] (CommunicationControl), or [SWS_DM_01017] (EcuResetRequest). Although this vendor-specific diagnostic implementation shares its naming with the communication framework, it is to be distinguished from ara::com (AUTOSAR_AP_SWS_Diagnostics §7.3.4.1.2 “Monitors”). The element serves to fulfill the upstream requirement RS_Diag_04251, which also underlies the authentication interface (AUTOSAR_AP_SWS_Diagnostics §8.3.1.1.3.2 “StopOffer”; [SWS_DM_01131]).
This text was created by an AI system based on the specification documents.
AI-GENERATEDunreviewedModel: gemini-3.8-flash-medium · Effort: medium · Temperature: not controllable · Prompt: b553bcd9da3eProvenanceOpen questions (1)
translated from the German guidegemini-3.8-flash-low · 2026-10-13 · German original
The constructor initializes an instance of class ara::diag::TransmitCertificate for processing certificates within the scope of UDS service 0x29 (subfunction TransmitCertificate) [SWS_DM_01962].
use
The invocation is synchronous and is specified as noexcept as well as exception safe[SWS_DM_01962]. Upon invocation, two parameters are passed:
specifier: An ara::core::InstanceSpecifier that must reference an PortPrototype typed to an DiagnosticTransmitCertificateInterface in the manifest via an DiagnosticAuthenticationPortMapping[SWS_DM_01962].
concurrencyType: Determines via kConcurrent or kNotConcurrent whether the interface allows concurrent invocations of the virtual method Process or must be processed sequentially [SWS_DM_01962], [SWS_DM_01968].
Error Handling and Boundary Conditions
Object creation is thread-safe [SWS_DM_01962]. Since an authentication instance must be unique, copy and move constructors as well as assignment operators are explicitly deleted [SWS_DM_01963], [SWS_DM_01964], [SWS_DM_01965], [SWS_DM_01966]. In case of misconfigurations in the manifest or duplicate use of an identifier, violations are reported (such as InstanceSpecifierMappingIntegrityViolation, PortInterfaceMappingViolation, ProcessMappingViolation, or InstanceSpecifierAlreadyInUseViolation) [SWS_DM_01962]. Because the constructor does not throw exceptions, these reports are likely signaled via the runtime reporting of the ara framework. Question Q-140f1e794355ad96 (open)
Interaction
After construction, the instance must be offered using Offer() so that the Diagnostic Management Daemon forwards requests [SWS_DM_01969]. Upon successful processing via Process(), the server responds positively with the parameter CertificateVerified (0x13) [SWS_DM_01251], whereas errors lead to negative UDS responses [SWS_DM_01249]. With StopOffer(), forwarding is terminated [SWS_DM_01970].
This text was generated by an AI and serves as guidance. Only the official AUTOSAR specifications are binding.
InstanceSpeci- InstanceSpecifier either cannot be resolved in the model in the fierMappingIn- context of your executable, or it refers to a model element other tegrityViolation than a PortPrototype. PortInterfaceMap- A PortPrototype that is referenced by a pingViolation DiagnosticAuthenticationPortMapping needs to be typed by a DiagnosticTransmitCertificateInterface. ProcessMappingVio- Matching InstanceRef exists, but no matching (modelled) Process lation found that matches the (runtime) process. InstanceSpecifier- Violation message that is sent in case a constructor in the ara AlreadyInUseViola- framework was called with an InstanceSpecifier already in use in tion this process.
Parameter (in)
Parameter
Beschreibung
specifier
InstanceSpecifier to a PortPrototype of a DiagnosticTransmitCertificateInterface service instance in the manifest.
concurrencyType
Specifies if the interface is implemented as thread safe ( kConcurrent) or non-thread safe (kNotConcurrent).
Request a governed re-review of this record. The record is not changed immediately.
gemini-3.8-flash-low· 2026-10-13 · German original