Hiero SDK for .NET Release 2.3.0

Hiero 2.3.0

A feature release focused on making consensus-node TLS work out of the box,
along with a chain-ID discovery fix and accompanying documentation updates.
This release is purely additive over 2.2.0 — no breaking changes.

Highlights

• Consensus-node TLS now works by default. The SDK automatically validates
  consensus-node certificates by pinning to the SHA-384 certificate hash
  published in the network address book.
• Automatic TLS endpoint discovery now carries certificate hashes, producing
  ready-to-use pinned TLS endpoints directly from Mirror REST.
• Chain-ID discovery corrected for networks whose recent activity consists
  primarily of HAPI-native transactions.

New APIs

• ConsensusNodeEndpoint now supports certificate pinning.

  • Added CertificateHash for storing an optional SHA-384 certificate hash.
  • Added a new (EntityId, Uri, ReadOnlyMemory<byte>) constructor overload.
  • Certificate hashes participate in equality by content, allowing pinned,
    unpinned, and differently-pinned endpoints targeting the same URI to remain
    distinct and receive separate gRPC channels.

• ConsensusNodeTransport (Plaintext, Tls, All)

  • Added as an optional transport parameter to
    MirrorRestClient.GetActiveConsensusNodesAsync.
  • Defaults to Plaintext for backward compatibility.
  • Tls and All automatically attach each node's published certificate hash
    to discovered TLS endpoints, excluding address-book entries that lack a
    usable certificate hash.

TLS Improvements

• Hedera consensus nodes present self-signed placeholder certificates whose
  issuer and subject are identical and whose SAN is 127.0.0.1, preventing
  conventional certificate-chain and hostname validation.
• The default gRPC channel factory now validates TLS connections by pinning
  against the address book's published node_cert_hash, computed as
  SHA-384(ExportCertificatePem() + "\n") to match the network format.
• Endpoints without a published certificate hash automatically fall back to
  standard TLS validation, allowing proxy-fronted DNS endpoints to continue
  working unchanged.

Bug Fixes

• MirrorRestClient.GetChainIdAsync now locates the most recent
  EthereumTransaction and reads the chain ID from its contract result,
  instead of scanning only the most recent contract results. This restores
  correct behavior on networks whose recent activity is predominantly
  HAPI-native. The method continues to throw if the network has never processed
  an EthereumTransaction, rather than fabricating a value.

Documentation

• Added cookbook and llms-full.txt documentation covering consensus-node TLS
  certificate-hash pinning.
• Updated samples and documentation for the removal of the Hex utility type,
  using Convert.FromHexString and Convert.ToHexStringLower throughout.

Full changelog: v2.2.0...v2.3.0