Connectors & Protocols
OCPP Security Profiles Explained: Basic Auth, TLS and Certificates
OCPP security profiles set how a charger authenticates to the back end: basic auth, TLS and client certificates. What to ask suppliers and operators.
- Prepared by
- VULTAE Engineering Team
- Published
- Reading time
- 1 min
- Sources
- 1 references
Key takeaways
- 1OCPP security profiles describe how a charger and a back end identify each other and protect the connection. They range from a password over an unencrypted link to encrypted TLS with certificates on both sides.
- 2Choose the strongest profile that your chargers and back end both support. Unencrypted connections should be avoided on public networks.
- 3Security also needs firmware signing, update control and key management. Ask the supplier how they handle these.
Contents
Short answer: an OCPP security profile sets how a charger and its back end authenticate each other and whether the link is encrypted. Use TLS and, where possible, client certificates. Ask suppliers which profile they implement and how they manage keys and firmware.
The profiles in short
| Profile | Authentication | Encryption |
|---|---|---|
| 1 | Basic (user name and password) | None |
| 2 | Basic plus server certificate | TLS |
| 3 | Client and server certificates | TLS |
Check the OCPP security documentation for the exact definitions.
What to ask a supplier
- Which profiles does the charger support?
- How are certificates installed and renewed?
- Is firmware signed, and how are updates verified?
- How are credentials stored on the charger?
- What is the security update policy?
What to ask the back-end provider
| Question | Why |
|---|---|
| Which profiles do you support? | Compatibility |
| How do you manage certificates? | Operations |
| How do you log access? | Audit |
| What happens if a certificate expires? | Availability |
Related controls
- Network: private APN or VPN for 4G.
- Access: limit who can change charger settings.
- Updates: controlled firmware rollout — see OTA updates.
- Standards and law: see cybersecurity requirements.
Version differences matter: see OCPP 1.6J vs 2.0.1 and the OCPP 2.0.1 device model.
Questions buyers ask
- What are the OCPP security profiles?
- Profile 1 uses HTTP basic authentication without TLS; profile 2 adds TLS with server certificate and basic authentication; profile 3 uses TLS with client and server certificates. Numbers and details follow the OCPP security specification.
- Which profile should I use?
- The strongest supported by both charger and back end; profile 3 where possible, profile 2 as a minimum on open networks.
- Is OCPP 1.6 secure?
- Security depends on the profile and implementation. Ask whether the charger supports the OCPP security extensions and TLS.
References
- [1]Open Charge Point Protocol (OCPP). Open Charge Alliance.
