Security Section — Migration Guide

High-Level Overview

The three security profiles (1, 2, 3) remain the same in structure. The following requirements are new or clarified in 2.1.

New Functional Requirements

Profile 2 Clarification

Field Size Increases

New Field: customData

All OCPP 2.1 messages now include an optional customData field for vendor-specific extensions. The CSMS should accept and pass through customData without rejecting messages that contain it.

{
  "customData": {
    "vendorId": "com.example.vendor"
  }
}

The use case is retained for backwards compatibility only. CSMS implementations should:

1. Continue supporting A01 for Charging Stations that have not been updated.
2. Prefer B09 for new deployments or updated stations.

Schema Changes

The SetVariablesRequest/SetVariablesResponse schema changes apply:

• attributeValue maxLength: 1000 → 2500
• additionalInfo maxLength: 512 → 1024

New Fields in SignCertificateRequest

Two new optional fields added in 2.1:

{
  "csr": "<PEM-encoded CSR>",
  "certificateType": "ChargingStationCertificate"
}

{
  "csr": "<PEM-encoded CSR>",
  "certificateType": "ChargingStationCertificate",
  "hashRootCertificate": {
    "hashAlgorithm": "SHA256",
    "issuerNameHash": "...",
    "issuerKeyHash": "...",
    "serialNumber": "..."
  },
  "requestId": 12345
}

New Field in CertificateSignedRequest

{
  "certificateChain": "<PEM certificate chain>",
  "certificateType": "ChargingStationCertificate"
}

{
  "certificateChain": "<PEM certificate chain>",
  "certificateType": "ChargingStationCertificate",
  "requestId": 12345
}

New Certificate Type: V2G20Certificate

New Trigger Message Value

Explicit CSMS Signing Restriction

Retry Behavior (New in 2.1)

2.1 formally documents the CS retry behavior that the CSMS must be aware of:

Certificate Validity Time Note

Changed Requirement IDs

Same New Fields as A02

The SignCertificateRequest and CertificateSignedRequest changes from A02 apply identically to A03:

• hashRootCertificate (new in SignCertificateRequest)
• requestId (new in both messages)
• V2G20Certificate enum value (new)

New: requestId Correlation

New: Discarded Certificate Event

Changed Requirement IDs

All Events Reclassified as Critical

In 2.0.1, security events were split into critical and non-critical. In 2.1, ALL security events are classified as Critical.

Event Name Change

The CSMS should handle both names during a transition period (stations running 2.0.1 and 2.1 may coexist).

New Security Event Type

Guaranteed Delivery Semantics (New)

Response Schema Change

The SecurityEventNotificationResponse now includes an optional customData field. The response remains effectively empty (no required fields beyond the optional customData).

{}

{
  "customData": {
    "vendorId": "com.example.vendor"
  }
}

Flow Comparison

Key Differences

New Messages in A05

New SetVariablesRequest Target

{
  "setVariableData": [{
    "component": {
      "name": "SecurityCtrlr"
    },
    "variable": {
      "name": "SecurityProfile"
    },
    "attributeValue": "3"
  }]
}

{
  "setVariableData": [{
    "component": {
      "name": "OCPPCommCtrlr"
    },
    "variable": {
      "name": "NetworkConfigurationPriority"
    },
    "attributeValue": "2,1"
  }]
}

The attributeValue is a comma-separated list of configuration slot numbers. The slot containing the NetworkConnectionProfile with the higher security profile should be listed first.

New ResetRequest in A05

{
  "type": "OnIdle"
}

The ResetEnumType includes a new value in 2.1:

Updated Downgrade Rules

The rules are functionally the same, but 2.1 formalizes them with dedicated FRs (A05.FR.08–A05.FR.10) instead of relying on a single A00.FR.005.

New Post-Upgrade Requirements

Validation the CS Performs (CSMS Should Be Aware)

New Messages

OCPP 2.1 adds formal certificate management messages that were not part of the 2.0.1 security flows:

InstallCertificateRequest Changes

New Certificate Type: OEMRootCertificate

Added to multiple enumerations in 2.1:

CertificateHashDataType — Hash Algorithm Extension

CertificateSigningUseEnumType

MessageTriggerEnumType (security-relevant values)

HashAlgorithmEnumType

ResetEnumType (used in A05)

Must Do Breaking / Behavioral

Should Do Recommended