Implement an ISO 15118-2 Plug and Charge authorization flow between an EV and a charge point using the contract certificate chain

Steps

1. Understand the PKI hierarchy: the vehicle's contract certificate is issued by a Mobility Operator CA which chains to a V2G Root CA; the EVSE must trust this root to validate the vehicle's identity during PnC
2. During the ISO 15118-2 TLS handshake, the EV presents its contract certificate and the EVSE validates the certificate chain up to a trusted V2G Root CA provisioned in the EVSE trust store
3. The EVSE extracts the eMAID (e-Mobility Account Identifier) from the validated contract certificate and forwards it to the CSMS (Charge Point Management System) via OCPP 2.0.1 for authorization lookup
4. Configure the CSMS to perform an authorization check on the eMAID against the eMSP (e-Mobility Service Provider) authorization list or a real-time authorization call, and return the authorization result to the EVSE
5. Handle certificate expiry and renewal: the EV can request an updated contract certificate from the EVSE using the CertificateInstallation service defined in ISO 15118-2, which the EVSE proxies to the PKI backend
6. Test the full flow end-to-end in a lab environment with a hardware-in-the-loop EV simulator before field deployment, as ISO 15118 timing constraints are strict and tolerance for communication delays is low