How is the connection secured?
A security audit of the network. The auditor's first question: how does the backend know it is talking to the real charger?
And how does the charger know the backend is genuine?
The questionHow do charger and backend prove who they are?
| Charger proves itself | Backend proves itself | Encrypted | |
|---|---|---|---|
| Profile 1unsecured transport, basic authentication | password | ||
| Profile 2TLS with basic authentication | password | certificate | |
| Profile 3TLS with client certificates | certificate | certificate |
From the OCPP 1.6 security white paper; OCPP 2.0.1 and 2.1 define the same three profiles.
Why profile 1 is not for the field
Profile 1 sends a password over an unencrypted connection, and the backend does not prove its identity at all. The Open Charge Alliance highly recommends a profile with TLS for field operation. Profile 3 goes furthest: both sides prove their identity with certificates.
No way back to weaker security
- Charger and backend use one at a time, configured before communication starts.
- A charger may lower its profile only if the operator has explicitly allowed it, then only from 3 to 2, and never to profile 1 through OCPP itself.
- Security events, such as a failed login or a firmware that does not verify, are logged and reported.
Check your understanding
3 questions. Answer all of them to complete this stop. Each answer explains itself.
What does security profile 3 add over profile 2?
Profile 2 already encrypts and authenticates the backend. Profile 3 replaces the charger's password with a client certificate.
Why should profile 1 not be used in the field?
Without TLS, anyone on the path can read the password, and a fake backend could not be detected.
May a charger lower its security profile from 3 to 1?
The security white paper allows a downgrade only from 3 to 2, never to profile 1 through OCPP.
- OCPP Open Charge Point Protocol: the open protocol between a charger and its operator's backend. EV charging fundamentals, stop 03 Glossary
- Security profile One of three OCPP levels of protection, from a password over an unencrypted connection to TLS with certificates on both sides. Glossary
- Open Charge Alliance: OCPP 1.6 Security Whitepaper, edition 4, February 2026. https://openchargealliance.org/ocpp-info-whitepapers/ocpp-1-6-security-whitepaper-4th-edition/. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- Open Charge Alliance: OCPP 2.1 edition 2 (December 2025), Part 2 Specification, use case A05 and the AllowSecurityProfileDowngrade variable; free download. https://openchargealliance.org/download-ocpp/. Checked 13 Oct 2026.
- Open Charge Alliance: OCPP 1.6 Security Whitepaper, edition 4, February 2026. https://openchargealliance.org/ocpp-info-whitepapers/ocpp-1-6-security-whitepaper-4th-edition/. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- Open Charge Alliance: OCPP 1.6 Security Whitepaper, edition 4, February 2026. https://openchargealliance.org/ocpp-info-whitepapers/ocpp-1-6-security-whitepaper-4th-edition/. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- Open Charge Alliance: OCPP 1.6 Security Whitepaper, edition 4, February 2026. https://openchargealliance.org/ocpp-info-whitepapers/ocpp-1-6-security-whitepaper-4th-edition/. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- Open Charge Alliance: What is new in OCPP 2.0.1? Whitepaper, version 1.0, March 2023. https://openchargealliance.org/wp-content/uploads/2024/01/new_in_ocpp_201-v10.pdf. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.