InstallCertificate

Installs a root certificate into the station's trust store.

Version: OCPP 2.0.1
Direction: CSMS → Charge Point
Functional block: Security

This is what makes the stale-trust-store problem solvable remotely. A station that cannot validate your CSMS certificate because its baked-in CA bundle predates your root can be given the root over OCPP.

It installs roots, not identity certificates — those come through CertificateSigned.

Request

Field	Type	Required	Description
`certificateType`	InstallCertificateUseEnumType	Required	Which trust store to install into.
`certificate`	string	Required	PEM-encoded X.509 root certificate.

json

[2, "19223201", "InstallCertificate", {
  "certificateType": "CSMSRootCertificate",
  "certificate": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"
}]

Response

Field	Type	Required	Description
`status`	InstallCertificateStatusEnumType	Required	Result.
`statusInfo`	StatusInfoType	Optional	Reason code.

json

[3, "19223201", {
  "status": "Accepted"
}]

Values

InstallCertificateUseEnumType

Value	Meaning
`V2GRootCertificate`	Root for ISO 15118 plug-and-charge.
`MORootCertificate`	Mobility operator root.
`CSMSRootCertificate`	Root used to validate the CSMS's TLS certificate.
`ManufacturerRootCertificate`	Root used to validate firmware signatures.

InstallCertificateStatusEnumType

Value	Meaning
`Accepted`	Installed.
`Rejected`	Refused.
`Failed`	The station could not store it.

Implementation notes

Install the new root before rotating the CSMS certificate, not after. A station that cannot validate the new certificate cannot reconnect to be fixed.

Trust stores have limited capacity. Check CertSigningRepeatTimes and the certificate limits in the device model before pushing to a large fleet.