Skip to main content

3.1 Signing of a Certificate Signing Request (CSR) and obtaining an EVSE Leaf Certificate and its corresponding Sub-Certificate Chain

Plug&Charge
Updated

The CPMS must be able to install ISO 15118 certificates (such as the EVSE Leaf Certificate and V2G-/ or MO-Roots) within charging points that are connected to the CPMS, respectively Charging-Network.

This process describes the signing of a CPO CSR with the Hubject CPO Sub 2 CA, which is performed (automatically) by the CPMS of the CPO and the delivery to the Charging Point. 

 

The process is done in three steps:

  1. Charging point creates Certificate Signing Request (CSR), sends the CSR to the CPMS via OCPP 1.6/2.0 with Plug&Charge. CPMS forward the CSR to Hubject PKI Services via Enrollment over Secure Transport (EST)(simpleenroll). CPMS gets signed Certificate back and stores it.
  2. CPMS requests the Certificate Chain of the just enrolled EVSE Leaf Certificate via EST (CAcerts) and stores it together with the EVSE Leaf Certificate.
  3. CPMS installs the EVSE Leaf Certificate, including the Chain of the EVSE Leaf Certificate, within the charging point.

mceclip0.png

Since the PKI-Interfaces of the Open Plug&Charge Protocol (OPCP) are following the RFC 7030 specifications, the SimpleEntroll and caCerts interface deliver back a container to the requester (CPMS). However, the EVSE will expect a string containing PEM files. This means the CPMS must perform two independent requests and extract PEMs out of the containers and rearrange the single PEMs to the mentioned structure bellow:

 

EVSE/SECC Leaf Certificate

CPO SUB2 CA

CPO SUB1 CA

 

Step by Step explanation:

  1. Perform caCerts call and obtain the container

  2. Extract Sub1 CA out of the container and store it as PEM

  3. Extract Sub2 CA out of the container and store it as PEM “on top” or “above” of the Sub1 CA

  4. IgnoreRootCAanddiscardthecontainer

  5. Perform simpleEnroll using the CSR received by the EVSE

  6. Extract the leaf PEM out of the container

  7. Store it as PEM “on top” or “above” the Sub2-/ and Sub1-CA stack.

  8. Discard the container

  9. Safe the string and make sure to double escape the line brakes inside the string.

You should now have a stack of three PEM certificates, beginning with the leaf followed by Sub2 CA and Sub1 CA, wrapped into a OCPP DataTransfer message.

Related articles