You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -32,9 +37,9 @@ This implementation is based on the following libraries :
32
37
33
38
As of this version :
34
39
35
-
* No Charge Point nor Central System behavior related to the OCPP 1.6 security whitepaper edition 2 has been implemented (work in progress)
36
40
* All the messages defined in the OCPP 1.6 edition 2 protocol have been implemented except GetCompositeSchedule for Charge Point role
37
41
* All the configuration keys defined in the OCPP 1.6 edition 2 protocol have been implemented for the Charge Point role
42
+
* Most of Charge Point and Central System behavior related to the OCPP 1.6 security whitepaper edition 2 has been implemented (work in progress, see [OCPP security extensions](#ocpp-security-extensions))
38
43
39
44
The user application will have to implement some callbacks to provide the data needed by **Open OCPP** or to handle OCPP events (boot notification, remote start/stop notifications, meter values...).
40
45
@@ -47,6 +52,7 @@ The persistent data handled by **Open OCPP** is stored into a single file which
47
52
+ Badge cache and local list
48
53
+ Smart charging profile
49
54
+ Logs
55
+
* X.509 Certificates
50
56
51
57
* For Central System role :
52
58
@@ -63,10 +69,12 @@ The standard OCPP configuration persistency has to be handled by the user applic
63
69
| Firmware Management | Support for firmware update management and diagnostic log file download | Actual file download/upload as well as firmware installation must be handled by the user application in the callbacks provided by **Open OCPP**|
64
70
| Local Auth List Management | Features to manage the local authorization list in Charge Points | None |
65
71
| Reservation | Support for reservation of a Charge Point. | None |
66
-
| Smart Charging | Support for basic Smart Charging, for instance using control pilot | GetCompositeSchedule is not supported for now in Chare Point role |
72
+
| Smart Charging | Support for basic Smart Charging, for instance using control pilot | GetCompositeSchedule is not supported for now in Charge Point role |
67
73
| Remote Trigger | Support for remote triggering of Charge Point initiated messages | None |
68
74
69
-
### Supported OCPP configuration keys (Charge Point role)
75
+
### Supported OCPP configuration keys
76
+
77
+
The OCPP configuration keys support applies to Charge Point role only.
70
78
71
79
In the "Owner" column, "S" means that the configuration key behavior is handled by the stack, "U" means that it must handled by the user application.
72
80
@@ -80,7 +88,7 @@ In the "Owner" column, "S" means that the configuration key behavior is handled
80
88
| ConnectionTimeOut | S | None |
81
89
| ConnectorPhaseRotation | S | None |
82
90
| ConnectorPhaseRotationMaxLength | S | None |
83
-
| GetConfigurationMaxKeys | S | Must be set to the sum of OCPP configuration keys count (99) + user application configuration keys count to allow to export all the configuration in 1 message |
91
+
| GetConfigurationMaxKeys | S | Must be set to the sum of OCPP configuration keys count (49) + user application configuration keys count to allow to export all the configuration in 1 message |
84
92
| HeartbeatInterval | S | Heartbeat are only sent if no messages have been exchanged since HeartbeatInterval seconds |
85
93
| LightIntensity | U | None |
86
94
| LocalAuthorizeOffline | S | None |
@@ -115,12 +123,130 @@ In the "Owner" column, "S" means that the configuration key behavior is handled
115
123
| ChargingScheduleMaxPeriods | S | None |
116
124
| ConnectorSwitch3to1PhaseSupported | S | None |
117
125
| MaxChargingProfilesInstalled | S | None |
118
-
| AdditionalRootCertificateCheck | S |OCPP 1.6 security whitepaper edition 2 configuration key : not implemented yet|
126
+
| AdditionalRootCertificateCheck |U/S |Not implemented yet : implemented behavior is the same as if AdditionalRootCertificateCheck = False|
119
127
| AuthorizationKey | S | None |
120
-
| CertificateSignedMaxChainSize | S | OCPP 1.6 security whitepaper edition 2 configuration key : not implemented yet |
121
-
| CertificateStoreMaxLength | S | OCPP 1.6 security whitepaper edition 2 configuration key : not implemented yet |
122
-
| CpoName | S | OCPP 1.6 security whitepaper edition 2 configuration key : not implemented yet |
123
-
| SecurityProfile | S | OCPP 1.6 security whitepaper edition 2 configuration key : not implemented yet |
128
+
| CertificateSignedMaxChainSize | S | None |
129
+
| CertificateStoreMaxLength | U/S | If internal certificate management is enabled, the stack handle this parameter, otherwise it must be the user application |
130
+
| CpoName | S | None |
131
+
| SecurityProfile | S | None |
132
+
133
+
### OCPP security extensions
134
+
135
+
#### Security profiles
136
+
137
+
**Open OCPP** support the following Security Profiles for both Charge Point and Central System roles :
138
+
139
+
* 0 : No security profile
140
+
* 1 : Unsecured Transport with HTTP Basic Authentication
141
+
* 2 : TLS with HTTP Basic Authentication
142
+
* 3 : TLS with Client Side Certificates
143
+
144
+
In Charge Point role, the stack will automatically disconnect and then reconnect using the new parameters to the Central System after one of the following parameters has been modified :
145
+
***AuthorizationKey**
146
+
***Security Profile**
147
+
148
+
#### Security events
149
+
150
+
**Open OCPP** support the whole use cases of security events and logging.
151
+
152
+
In Charge Point role, it can optionnaly handle the storage of the security event log and the generation of the security log export when the Central System asks it. To enable/disable this feature, you have to modify the **SecurityLogMaxEntriesCount** charge point configuration key :
153
+
154
+
* 0 = **Open OCPP** will not store security event and the security log must be generated by the user application
155
+
*\>0 = **Open OCPP** will store at max **SecurityLogMaxEntriesCount** (circular log) and will automatically generate the security log as a CSV file
156
+
157
+
In Charge Point role, the user application can generate custom security events and defines its criticity so that they are forwarded to the Central System.
158
+
159
+
In Charge Point role, the notification of security events can be enabled or disabled with the **SecurityEventNotificationEnabled** configuration key. This can be usefull to disable them when the Central System does not implement the security extensions.
160
+
161
+
#### Extended trigger messages
162
+
163
+
**Open OCPP** support this feature for both Charge Point and Central System roles.
164
+
165
+
#### Certificate management
166
+
167
+
**Open OCPP** support this feature for both Charge Point and Central System roles.
168
+
169
+
The behavior of this feature is controlled by the **InternalCertificateManagementEnabled** configuration key.
170
+
171
+
If **InternalCertificateManagementEnabled** is set to **false**, the actual storage of the certificates and their keys must be done by the user application. **Open OCPP** provides callbacks and helper classes to ease certificate manipulation and installation. The user application also has to configure the path to the installed certificates for the establishment of the secure connections using the following configuration keys :
172
+
173
+
* TlsServerCertificateCa
174
+
* TlsClientCertificate
175
+
* TlsClientCertificatePrivateKey
176
+
* TlsClientCertificatePrivateKeyPassphrase
177
+
178
+
If **InternalCertificateManagementEnabled** is set to **true**, the storage of certificates and their keys is fully handled by **Open OCPP**. The user application just has to provide a passphrase using the **TlsClientCertificatePrivateKeyPassphrase** configuration key to securily encrypt the certicates' private keys using AES-256-CBC algorithm. **Open OCPP** will automatically use the installed corresponding certificates depending on the configured Security Profile and the certificates validity dates.
179
+
180
+
### Internal configuration keys
181
+
182
+
The behavior and the configuration of the **Open OCPP** stack can be modified through configuration keys. Some are specific to an OCPP role and some are common.
183
+
184
+
#### Common keys
185
+
186
+
| Key | Type | Description |
187
+
| :---: | :---: | :--- |
188
+
| DatabasePath | string | Path to the database to store persistent data |
189
+
| JsonSchemasPath | string | Path to the JSON schemas to validate the messages |
| TlsAllowSelfSignedCertificates | bool | Allow TLS connections using self-signed certificates (Warning : enabling this feature is not recommended in production) |
219
+
| TlsAllowExpiredCertificates | bool | Allow TLS connections using expired certificates (Warning : enabling this feature is not recommended in production) |
220
+
| TlsAcceptNonTrustedCertificates | bool | Accept non trusted certificates for TLS connections (Warning : enabling this feature is not recommended in production) |
221
+
| TlsSkipServerNameCheck | bool | Skip server name check in certificates for TLS connections (Warning : enabling this feature is not recommended in production) |
222
+
| InternalCertificateManagementEnabled | bool | If true, certificates are stored inside **Open OCPP** databasen otherwise user application has to handle them|
| SecurityLogMaxEntriesCount | uint | Maximum number of entries in the security log (0 = no security logs in database) |
225
+
| ClientCertificateRequestHashType | string | Hash type for certificate request generation : sha256, sha384 or sha512 |
226
+
| ClientCertificateRequestKeyType | string | Key type for certificate request generation : ec or rsa |
227
+
| ClientCertificateRequestRsaKeyLength | uint | Length in bits of the key for certificate request generation if rsa has been selected for key type : minimum 2048 |
228
+
| ClientCertificateRequestEcCurve | string | Name of the elliptic curve for certificate request generation if ec has been selected for key type : prime256v1, secp256k1, secp384r1, secp521r1, brainpoolP256t1, brainpoolP384t1 or brainpoolP512t1 |
229
+
| ClientCertificateRequestSubjectCountry | string | Country for the subject field of certificate request generation (can be left empty) |
230
+
| ClientCertificateRequestSubjectState | string | State for the subject field of certificate request generation (can be left empty) |
231
+
| ClientCertificateRequestSubjectLocation | string | Location for the subject field of certificate request generation (can be left empty) |
232
+
| ClientCertificateRequestSubjectOrganizationUnit | string | Organization unit for the subject field of certificate request generation (can be left empty) |
233
+
| ClientCertificateRequestSubjectEmail | string | Email for the subject field of certificate request generation (can be left empty) |
234
+
235
+
#### Central System keys
236
+
237
+
| Key | Type | Description |
238
+
| :---: | :---: | :--- |
239
+
| ListenUrl | string | URL to listen to incomming websocket connections |
| BootNotificationRetryInterval | uint | Boot notification retry interval in second (sent in BootNotificationConf when status is Pending or Rejected) |
242
+
| HeartbeatInterval | uint | Heartbeat interval in seconds (sent in BootNotificationConf when status is Accepted) |
243
+
| HttpBasicAuthent | bool | If set to true, the Charge Points must autenticate themselves using HTTP Basic Authentication method |
244
+
| TlsEcdhCurve | string | ECDH curve to use for TLS connections with EC keys |
245
+
| TlsServerCertificate | string | Path to the Central System's certificate |
246
+
| TlsServerCertificatePrivateKey | string | Path to the Central System's certificate's private key |
Copy file name to clipboardExpand all lines: examples/README.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,7 @@ The following examples are available :
6
6
*[Quick start Central System example](./quick_start_centralsystem/README.md)
7
7
*[Quick start Charge Point example](./quick_start_chargepoint/README.md)
8
8
*[Remote Charge Point example](./remote_chargepoint/README.md)
9
+
*[Security Charge Point example](./security_chargepoint/README.md)
9
10
10
11
How to run the examples:
11
12
* Customize the *config.ini* file of the selected example with the URL of the Central System and the other connection parameters has well has the OCPP configuration keys
0 commit comments