As per the specification, “OPC UA Part 4 – Services Specification”, provided by the OPC Foundation, the clientCertificate parameter (within the CreateSession Service Request) can, indeed, be empty if the SecurityPolicyURI is NONE. See extract below:
Figure 1 Extract from Table 11, Page 27 of OPC UA Part4 - Services specification
Due to the lack of security within the MATLAB OPC Toolbox, the SecurityPolicyURI is NONE and therefore the current codebase is correct in passing an empty(NULL) clientCertificate parameter during the CreateSession service request.
The issue therefore lies with the CoDeSys server.
The server must take the SecurityPolicyURI into consideration when evaluating the validity of the clientCertificate parameter passed during the CreateSession service request.
MathWorks has fixed the bug causing MATLAB to crash due to this issue.