- Home
- Resources
- Security profiles explained
Guide · Security profiles
OCPP security profiles, explained.
What each profile protects, how to choose one for each charger, and how ChargeIT applies and records them.
Security in charging starts at the protocol, long before anyone logs in. Here is how the charger connection is protected.
Why the charger connection matters
Every charger keeps a connection open to its central system. Whoever can connect as a charger can report sessions and receive commands, and whoever can read the traffic can see what passes over it. The security profile decides how the charger proves who it is, and whether the connection is encrypted.
The profiles
OCPP defines three security profiles. They are part of OCPP 2.0.1, and were added to OCPP 1.6J through the Open Charge Alliance’s security extension.
| Profile | How the charger proves who it is | Connection encrypted |
|---|---|---|
| 1 · Basic authentication | A password | No |
| 2 · TLS + password | A password; the central system proves itself with a TLS certificate | Yes |
| 3 · Mutual TLS | A client certificate; both sides prove themselves with certificates | Yes |
ChargeIT also shows level 0 for legacy chargers that connect with no authentication at all. It is flagged with a warning wherever it appears.
Which profile to use
- Profile 3 wherever the charger supports certificates.
- Profile 2 for chargers that support TLS but not client certificates.
- Profile 1 only on networks you control, because the password travels unencrypted.
- Level 0 only for legacy chargers that cannot do better yet.
The highest profile a charger can use depends on its firmware. Check it before you choose.
Profiles on ChargeIT
- Each charger runs at the profile it supports, set charger by charger.
- A charger can be held to its profile, or exempted one by one, and every change is logged.
- Charger passwords are stored hashed.
- Authorization key rotations are recorded in the charger’s audit log.
Beyond the charger
The profile secures the connection. ChargeIT also secures who sees what: every customer in its own branch of the tree, permissions page by page and action by action, every change made on a customer’s behalf recorded as such, and authorisations that fail closed.
Secure every charger.
Tell us which chargers you run and we’ll show you how each one is set up.
Book a demo