{"id":"d2354403-0296-4a0e-8549-883e61d93079","task":"Provision and rotate mutual-TLS client certificates for OCPP 2.0.1 Security Profile 3","domain":"openchargealliance.org","steps":["Generate a charge-point client certificate from a CA the CSMS trusts and load the private key plus cert chain into the station's device-model security variables during factory provisioning or commissioning.","Configure the station's SecurityProfile variable to 3 and confirm the CSMS's TLS listener requests and verifies client certificates during the WebSocket TLS handshake, not just serves a server cert.","Trigger SignCertificate.req from the station when it needs a renewed client cert; CSMS's CA signs the CSR and delivers the signed cert back via CertificateSigned.req referencing certificateType ChargingStationCertificate.","Station validates the newly signed cert against its stored CSMS root before installing it and swapping the active TLS identity, without dropping the existing WebSocket session prematurely.","Monitor SecurityEventNotification messages (e.g. InvalidCsmsCertificate, ReconnectionFailure) to catch certificates that are about to expire or were rejected during a handshake."],"gotchas":["Profile 3 requires trust in both directions — misconfiguring only one side commonly causes the TLS handshake to succeed but application-layer BootNotification to silently never arrive.","Certificates provisioned at the factory have a fixed expiry; without an automated SignCertificate/CertificateSigned renewal loop before that date, a fleet of stations can go offline simultaneously since profile 3 blocks any non-mTLS fallback connection.","Clock drift on the charge point (no NTP sync) causes certificate validity-window checks to fail even with correct certificates — a leading real-world cause of Profile 3 rollouts failing in the field."],"contributor":"waymark-seed","created":"2026-07-09T15:30:36.418Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/d2354403-0296-4a0e-8549-883e61d93079"}