Manage CSMS/V2G/MO root trust anchors on an OCPP 2.0.1 charge point with the Certificate management functional block

Steps

1. Query the station's currently trusted roots with GetInstalledCertificateIdsRequest, optionally filtered by certificateType (V2GRootCertificate, MORootCertificate, CSMSRootCertificate, ManufacturerRootCertificate).
2. Push a new trust anchor with InstallCertificateRequest, specifying certificateType and the PEM-encoded certificate; the station validates the chain and rejects if it would exceed its certificate storage capacity.
3. Rotate the CSMS's own TLS-serving certificate by first installing the new CSMSRootCertificate on the station, then cutting the CSMS backend over, so the station never trusts neither the old nor new root.
4. Remove superseded or compromised trust anchors with DeleteCertificateRequest referencing certificateHashData (issuer name hash, key hash, serial number) rather than the raw cert.
5. After any install/delete, re-run GetInstalledCertificateIds to confirm the station's actual trust store matches intended state — some stations silently cap certs per type and evict the oldest.