Add OCPP TLS certificate configuration and SNI support #1011
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds TLS certificate configuration and SNI (Server Name Indication) support for OCPP WebSocket connections to enable compliant WSS (WebSocket Secure) support. The changes introduce certificate management functionality with configurable security policies for OCPP connections.
Key Changes
- Added TLS configuration structure and methods to manage certificates and security policies
- Introduced certificate ID configuration parameter for selecting specific certificates
- Added flag-based configuration for rejecting unauthorized certificates
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/ocpp.h | Added TLS configuration structure, certificate management methods, and state tracking fields |
| src/ocpp.cpp | Implemented TLS configuration logic, certificate resolution, and security policy application |
| src/app_config.h | Added certificate ID configuration variable and security flag definitions |
| src/app_config.cpp | Added configuration options for certificate ID and certificate validation settings |
src/ocpp.cpp
Outdated
| } | ||
|
|
||
| TlsConfig desired = resolveTlsConfig(); | ||
| bool changed = !tlsConfigApplied || desired.rejectUnauthorized != appliedRejectUnauthorized || desired.caCert != appliedCaCert; |
There was a problem hiding this comment.
Pointer comparison for desired.caCert != appliedCaCert compares memory addresses rather than string content. This will incorrectly detect changes when the same certificate content is stored at different memory locations. Use strcmp() or similar string comparison instead.
src/ocpp.cpp
Outdated
| #include <MicroOcpp/Model/Diagnostics/DiagnosticsService.h> | ||
| #include <MicroOcpp/Model/FirmwareManagement/FirmwareService.h> | ||
| #include <MongooseCore.h> | ||
|
|
There was a problem hiding this comment.
[nitpick] Include <cstdlib> should be placed with other system includes at the top, before the blank line that separates system includes from local includes.
|
Thank you for your contribution, I will take a look |
|
@0xStuart Have you made appropriate UI updates to alloe the certificate to be set? Also please check the CoPilot comments |
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
|
@jeremypoulter |
|
|
2 participants
Required for complaint WSS support. I haven't the hardware to test this right now.