What is a contract certificate?
The car presents a contract certificate and a contract ID. The charger has a certificate of its own, which it showed the car a moment earlier.
Trust runs in two directions: the car checks the charger against the roots it carries, and the charger and its backend check the contract against the roots on their trust list.
The questionWhat exactly is in the car, and why should the charger believe it?
| Held by | Used for | |
|---|---|---|
| Charger certificatefor the TLS connection | charger | the car checks the charger |
| V2G rootstrust anchors in the car | car | anchor of the car's check |
| Contract certificatewith the contract ID (eMAID) | car | the charger and backend check the contract |
| Trust listroots the operator accepts | charger and backend | anchor of the contract check |
The car verifies the charger's certificate chain before it sends its contract. In the OCA application note, the car then sends its contract certificate and eMAID, and the charger or its backend validates it; the charger obtains its own certificate and its root certificates through the backend. The two chains need not end at the same root.
A contract that can prove itself
A binds a , the eMAID, to a key pair whose private half the car keeps. When the car presents it, the charger or its backend can check two things: that the certificate was issued within a trusted chain, and that it is still valid.
- Online, the backend checks the certificate's status, for example with an OCSP request.
- Offline, the charger can validate the certificate itself if it has the root and the operator has enabled offline validation, and then use its local list for the eMAID.
Trust in both directions
The car does not simply trust any charger. Before it presents its contract, the charger proves its identity in the TLS connection, and the car verifies the charger's certificate chain against the roots it carries. The contract is checked the other way round: the charger and its backend validate the contract certificate's chain against the roots they accept and ask for its status. The two checks can end at different roots. Where the roots come from, and how a lets several of them work together, is the subject of stop 04.
Check your understanding
3 questions. Answer all of them to complete this stop. Each answer explains itself.
What does the contract certificate prove?
It binds the contract ID to the car; the charger's own certificate proves the charger.
How can a backend check whether a contract certificate is still valid?
The OCA application note describes OCSP requests to check the certificate status.
Why does the charger show its own certificate first?
Trust runs both ways: the car checks the charger before it presents its contract.
- Contract certificate A certificate in the car that binds the driver's contract ID to a key pair whose private half the car keeps, used for Plug & Charge. Glossary
- eMAID The contract ID of an e-mobility contract, carried in the contract certificate for Plug & Charge. Glossary
- Trust list A list of root authorities that cars and chargers accept, so certificate chains from different authorities work together. Stop 04 Glossary
- V2G Vehicle to grid: the car feeds energy into the public grid; because one car's effect is small, many cars are usually pooled by an aggregator. Bidirectional charging, stop 02 Glossary
- ISO: ISO 15118-2:2014, Vehicle-to-Grid Communication Interface, Part 2: Network and application protocol requirements. https://www.iso.org/standard/55366.html. Checked 13 Oct 2026.
- Open Charge Alliance: Using ISO 15118 Plug & Charge with OCPP 1.6, application note v1.0, 2020. https://openchargealliance.org/wp-content/uploads/2025/05/ocpp_1_6_ISO_15118_v10-3.pdf. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- Open Charge Alliance: Using ISO 15118 Plug & Charge with OCPP 1.6, application note v1.0, 2020. https://openchargealliance.org/wp-content/uploads/2025/05/ocpp_1_6_ISO_15118_v10-3.pdf. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- Open Charge Alliance: Using ISO 15118 Plug & Charge with OCPP 1.6, application note v1.0, 2020. https://openchargealliance.org/wp-content/uploads/2025/05/ocpp_1_6_ISO_15118_v10-3.pdf. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- Open Charge Alliance: Using ISO 15118 Plug & Charge with OCPP 1.6, application note v1.0, 2020. https://openchargealliance.org/wp-content/uploads/2025/05/ocpp_1_6_ISO_15118_v10-3.pdf. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.
- ISO: ISO 15118-2:2014, Vehicle-to-Grid Communication Interface, Part 2: Network and application protocol requirements. https://www.iso.org/standard/55366.html. Checked 13 Oct 2026.
- Open Charge Alliance: Using ISO 15118 Plug & Charge with OCPP 1.6, application note v1.0, 2020. https://openchargealliance.org/wp-content/uploads/2025/05/ocpp_1_6_ISO_15118_v10-3.pdf. Checked 09 Oct 2026. Licence: CC BY-ND 4.0.