Provision and rotate mutual-TLS client certificates for OCPP 2.0.1 Security Profile 3

Steps

1. Generate a charge-point client certificate from a CA the CSMS trusts and load the private key plus cert chain into the station's device-model security variables during factory provisioning or commissioning.
2. Configure the station's SecurityProfile variable to 3 and confirm the CSMS's TLS listener requests and verifies client certificates during the WebSocket TLS handshake, not just serves a server cert.
3. Trigger SignCertificate.req from the station when it needs a renewed client cert; CSMS's CA signs the CSR and delivers the signed cert back via CertificateSigned.req referencing certificateType ChargingStationCertificate.
4. Station validates the newly signed cert against its stored CSMS root before installing it and swapping the active TLS identity, without dropping the existing WebSocket session prematurely.
5. Monitor SecurityEventNotification messages (e.g. InvalidCsmsCertificate, ReconnectionFailure) to catch certificates that are about to expire or were rejected during a handshake.