Skip to content

Commit ee32a58

Browse files
c-jimenezc-jimenez
authored
Merge pull request #23 from c-jimenez/dev/websocket_cert_management
[websocket] Add option to use PEM encoded data instead of PEM file pa…
2 parents 0c71370 + d1ac9f4 commit ee32a58

File tree

13 files changed

+144
-43
lines changed

13 files changed

+144
-43
lines changed

‎examples/common/config/CentralSystemConfig.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,6 @@ class CentralSystemConfig : public ocpp::config::ICentralSystemConfig
7676
std::string tlsServerCertificatePrivateKeyPassphrase() const override { return getString("TlsServerCertificatePrivateKeyPassphrase"); }
7777
/** @brief Certification Authority signing chain for the server certificate */
7878
std::string tlsServerCertificateCa() const override { return getString("TlsServerCertificateCa"); }
79-
/** @brief Certification Authority signing chain for the clients certificates */
80-
std::string tlsClientCertificateCa() const override { return getString("TlsClientCertificateCa"); }
8179
/** @brief Enable client authentication using certificate */
8280
bool tlsClientCertificateAuthent() const override { return getBool("TlsClientCertificateAuthent"); }
8381

‎examples/common/config/ChargePointConfig.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,14 @@ class ChargePointConfig : public ocpp::config::IChargePointConfig
6363
std::string tlsv13CipherList() const override { return getString("Tlsv13CipherList"); }
6464
/** @brief ECDH curve to use for TLS connections */
6565
std::string tlsEcdhCurve() const override { return getString("TlsEcdhCurve"); }
66+
/** @brief Certification Authority signing chain for the server certificate */
67+
std::string tlsServerCertificateCa() const override { return getString("TlsServerCertificateCa"); }
68+
/** @brief Client certificate */
69+
std::string tlsClientCertificate() const override { return getString("TlsClientCertificate"); }
70+
/** @brief Client certificate's private key */
71+
std::string tlsClientCertificatePrivateKey() const override { return getString("TlsClientCertificatePrivateKey"); }
72+
/** @brief Client certificate's private key passphrase */
73+
std::string tlsClientCertificatePrivateKeyPassphrase() const override { return getString("TlsClientCertificatePrivateKeyPassphrase"); }
6674
/** @brief Allow TLS connections using self-signed certificates
6775
* (Warning : enabling this feature is not recommended in production) */
6876
bool tlsAllowSelfSignedCertificates() const override { return getBool("TlsAllowSelfSignedCertificates"); }

‎examples/quick_start_centralsystem/config/quick_start_centralsystem.ini‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
[CentralSystem]
22
DatabasePath=./quick_start_centralsystem.db
33
JsonSchemasPath=../../schemas/ocpp16/
4-
ListenUrl=ws://127.0.0.1:8180/steve/websocket/CentralSystemService/
4+
ListenUrl=wss://127.0.0.1:8080/openocpp/
55
CallRequestTimeout=2000
66
WebSocketPingInterval=30
77
BootNotificationRetryInterval=30
@@ -14,6 +14,5 @@ TlsServerCertificate=../../examples/certificates/open-ocpp_central-system.crt
1414
TlsServerCertificatePrivateKey=../../examples/certificates/open-ocpp_central-system.key
1515
TlsServerCertificatePrivateKeyPassphrase=
1616
TlsServerCertificateCa=../../examples/certificates/open-ocpp_ca.crt
17-
TlsClientCertificateCa=../../examples/certificates/open-ocpp_ca.crt
18-
TlsClientCertificateAuthent=false
17+
TlsClientCertificateAuthent=true
1918
LogMaxEntriesCount=2000

‎examples/quick_start_chargepoint/config/quick_start_chargepoint.ini‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
[ChargePoint]
22
DatabasePath=./quick_start_chargepoint.db
33
JsonSchemasPath=../../schemas/ocpp16/
4-
ConnexionUrl=ws://127.0.0.1:8180/steve/websocket/CentralSystemService/
4+
ConnexionUrl=wss://127.0.0.1:8080/openocpp/
55
Tlsv12CipherList=ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-WITH-AES-256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:TLS-PSK-WITH-AES-256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-WITH-AES-128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:TLS-PSK-WITH-AES-128-GCM-SHA256
66
Tlsv13CipherList=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
77
TlsEcdhCurve=prime256v1
8-
TlsAllowSelfSignedCertificates=true
9-
TlsAllowExpiredCertificates=true
10-
TlsAcceptNonTrustedCertificates=true
8+
TlsServerCertificateCa=../../examples/certificates/open-ocpp_ca.crt
9+
TlsClientCertificate=../../examples/certificates/open-ocpp_charge-point.crt
10+
TlsClientCertificatePrivateKey=../../examples/certificates/open-ocpp_charge-point.key
11+
TlsClientCertificatePrivateKeyPassphrase=
12+
TlsAllowSelfSignedCertificates=false
13+
TlsAllowExpiredCertificates=false
14+
TlsAcceptNonTrustedCertificates=false
1115
TlsSkipServerNameCheck=true
1216
ChargePointIdentifier=ChargePointTest
1317
ConnectionTimeout=2000

‎examples/remote_chargepoint/config/remote_chargepoint.ini‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
[ChargePoint]
22
DatabasePath=./remote_chargepoint.db
33
JsonSchemasPath=../../schemas/ocpp16/
4-
ConnexionUrl=ws://127.0.0.1:8180/steve/websocket/CentralSystemService/
4+
ConnexionUrl=wss://127.0.0.1:8080/openocpp/
55
Tlsv12CipherList=ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-WITH-AES-256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:TLS-PSK-WITH-AES-256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-WITH-AES-128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:TLS-PSK-WITH-AES-128-GCM-SHA256
66
Tlsv13CipherList=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
77
TlsEcdhCurve=prime256v1
8-
TlsAllowSelfSignedCertificates=true
9-
TlsAllowExpiredCertificates=true
10-
TlsAcceptNonTrustedCertificates=true
8+
TlsServerCertificateCa=../../examples/certificates/open-ocpp_ca.crt
9+
TlsClientCertificate=../../examples/certificates/open-ocpp_charge-point.crt
10+
TlsClientCertificatePrivateKey=../../examples/certificates/open-ocpp_charge-point.key
11+
TlsClientCertificatePrivateKeyPassphrase=
12+
TlsAllowSelfSignedCertificates=false
13+
TlsAllowExpiredCertificates=false
14+
TlsAcceptNonTrustedCertificates=false
1115
TlsSkipServerNameCheck=true
1216
ChargePointIdentifier=ChargePointTest
1317
ConnectionTimeout=2000

‎src/centralsystem/CentralSystem.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,8 +167,8 @@ bool CentralSystem::start()
167167
credentials.server_certificate_private_key = m_stack_config.tlsServerCertificatePrivateKey();
168168
credentials.server_certificate_private_key_passphrase = m_stack_config.tlsServerCertificatePrivateKeyPassphrase();
169169
credentials.server_certificate_ca = m_stack_config.tlsServerCertificateCa();
170-
credentials.client_certificate_ca = m_stack_config.tlsClientCertificateCa();
171170
credentials.client_certificate_authent = m_stack_config.tlsClientCertificateAuthent();
171+
credentials.encoded_pem_certificates = false;
172172

173173
// Start listening
174174
ret = m_rpc_server->start(m_stack_config.listenUrl(), credentials, m_stack_config.webSocketPingInterval());

‎src/centralsystem/interface/ICentralSystemConfig.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,6 @@ class ICentralSystemConfig
6969
virtual std::string tlsServerCertificatePrivateKeyPassphrase() const = 0;
7070
/** @brief Certification Authority signing chain for the server certificate */
7171
virtual std::string tlsServerCertificateCa() const = 0;
72-
/** @brief Certification Authority signing chain for the clients certificates */
73-
virtual std::string tlsClientCertificateCa() const = 0;
7472
/** @brief Enable client authentication using certificate */
7573
virtual bool tlsClientCertificateAuthent() const = 0;
7674

‎src/chargepoint/ChargePoint.cpp‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -803,13 +803,18 @@ bool ChargePoint::doConnect()
803803
credentials.user = m_stack_config.chargePointIdentifier();
804804
credentials.password = authorization_key;
805805
}
806-
credentials.tls12_cipher_list = m_stack_config.tlsv12CipherList();
807-
credentials.tls13_cipher_list = m_stack_config.tlsv13CipherList();
808-
credentials.ecdh_curve = m_stack_config.tlsEcdhCurve();
809-
credentials.allow_selfsigned_certificates = m_stack_config.tlsAllowSelfSignedCertificates();
810-
credentials.allow_expired_certificates = m_stack_config.tlsAllowExpiredCertificates();
811-
credentials.accept_untrusted_certificates = m_stack_config.tlsAcceptNonTrustedCertificates();
812-
credentials.skip_server_name_check = m_stack_config.tlsSkipServerNameCheck();
806+
credentials.tls12_cipher_list = m_stack_config.tlsv12CipherList();
807+
credentials.tls13_cipher_list = m_stack_config.tlsv13CipherList();
808+
credentials.ecdh_curve = m_stack_config.tlsEcdhCurve();
809+
credentials.server_certificate_ca = m_stack_config.tlsServerCertificateCa();
810+
credentials.client_certificate = m_stack_config.tlsClientCertificate();
811+
credentials.client_certificate_private_key = m_stack_config.tlsClientCertificatePrivateKey();
812+
credentials.client_certificate_private_key_passphrase = m_stack_config.tlsClientCertificatePrivateKeyPassphrase();
813+
credentials.allow_selfsigned_certificates = m_stack_config.tlsAllowSelfSignedCertificates();
814+
credentials.allow_expired_certificates = m_stack_config.tlsAllowExpiredCertificates();
815+
credentials.accept_untrusted_certificates = m_stack_config.tlsAcceptNonTrustedCertificates();
816+
credentials.skip_server_name_check = m_stack_config.tlsSkipServerNameCheck();
817+
credentials.encoded_pem_certificates = false;
813818

814819
// Start connection process
815820
return m_rpc_client->start(connection_url,

‎src/chargepoint/interface/IChargePointConfig.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ class IChargePointConfig
5959
virtual std::string tlsv13CipherList() const = 0;
6060
/** @brief ECDH curve to use for TLS connections */
6161
virtual std::string tlsEcdhCurve() const = 0;
62+
/** @brief Certification Authority signing chain for the server certificate */
63+
virtual std::string tlsServerCertificateCa() const = 0;
64+
/** @brief Client certificate */
65+
virtual std::string tlsClientCertificate() const = 0;
66+
/** @brief Client certificate's private key */
67+
virtual std::string tlsClientCertificatePrivateKey() const = 0;
68+
/** @brief Client certificate's private key passphrase */
69+
virtual std::string tlsClientCertificatePrivateKeyPassphrase() const = 0;
6270
/** @brief Allow TLS connections using self-signed certificates
6371
* (Warning : enabling this feature is not recommended in production) */
6472
virtual bool tlsAllowSelfSignedCertificates() const = 0;

‎src/websockets/IWebsocketClient.h‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,17 @@ class IWebsocketClient
129129
/** @brief ECDH curve, leave empty for default
130130
* (OpenSSL format, default = system dependent) */
131131
std::string ecdh_curve;
132+
/** @brief Indicate if the below certificates parameters are path to PEM encoded certificate files (false)
133+
* or if they contain directly PEM encoded certificates (true) */
134+
bool encoded_pem_certificates;
135+
/** @brief Certification Authority signing chain for the server certificate */
136+
std::string server_certificate_ca;
137+
/** @brief Client certificate */
138+
std::string client_certificate;
139+
/** @brief Client certificate's private key */
140+
std::string client_certificate_private_key;
141+
/** @brief Client certificate's private key passphrase */
142+
std::string client_certificate_private_key_passphrase;
132143
/** @brief Allow TLS connections using self-signed certificates
133144
* (Warning : enabling this feature is not recommended in production) */
134145
bool allow_selfsigned_certificates;

0 commit comments

Comments
 (0)