CertificateSigned

Delivers a signed certificate back to the station after a SignCertificate request.

Version: OCPP 2.0.1
Direction: CSMS → Charge Point
Functional block: Security

The other half of certificate rotation. The CSMS sends the signed certificate chain; the station installs it against the private key it kept.

Request

Field	Type	Required	Description
`certificateChain`	string	Required	PEM-encoded signed certificate, followed by any intermediates.
`certificateType`	CertificateSigningUseEnumType	Optional	Which certificate this is.

json

[2, "19223201", "CertificateSigned", {
  "certificateType": "ChargingStationCertificate",
  "certificateChain": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"
}]

Response

Field	Type	Required	Description
`status`	CertificateSignedStatusEnumType	Required	Whether the station accepted the certificate.
`statusInfo`	StatusInfoType	Optional	Reason code.

json

[3, "19223201", {
  "status": "Accepted"
}]

Values

CertificateSignedStatusEnumType

Value	Meaning
`Accepted`	Installed.
`Rejected`	The station refused it — chain, key mismatch, or expiry.

Implementation notes

Send the full chain, not just the leaf. Embedded TLS stacks do not fetch missing intermediates, which is the same failure that breaks wss:// connections.

A station replacing its own connection certificate typically reconnects afterwards. Expect a brief disconnection.