OCPP 1.6-J defines four Security Profiles (SP0–SP3) determining how the Charge Point connects to the Central System.
Only one profile can be active per connection. Mismatched profiles are rejected.
Supported Profiles
Profile | Description | Auth Method | Transport |
SP0 | No security | None |
|
SP1 | Basic Auth (no TLS) |
|
|
SP2 | TLS + Basic Auth |
|
|
SP3 | TLS + Client Certificate (mTLS) | Certificate (binaryCert) |
|
Configuration
Key | Description | Example |
| Selects 0–3 |
|
| Required for SP1/2 (≥16 bytes) |
|
| OCPP endpoint |
|
| PEM-encoded certificate chain for SP3 | see below |
Example certificate format
-----BEGIN CERTIFICATE----- <leaf cert> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <intermediate/chain> -----END CERTIFICATE-----
SP3 can be tested with a real device connected to the backend.
Testing Scope
SP | Method | Expected Result |
SP1 / SP2 |
| Successful BootNotification / Heartbeat |
Wrong key | 401 / rejected |
|
SP3 | mTLS with real device | Successful TLS handshake & BootNotification |
0 Security Profile, no AuthorizationKey
1 Security Profile, AuthorizationKey selected
2 Security Profile, AuthorizationKey selected
3 Security Profile, Certificate added to binaryCert in Simulator Config
