UpdateFirmware

Tells the station to download and install firmware. Now with a signature, which 1.6 lacked entirely.

Version: OCPP 2.0.1
Direction: CSMS → Charge Point
Functional block: Firmware Management

UpdateFirmware also exists in OCPP 1.6, with a different payload. See the OCPP 1.6 version.

The important change from 1.6 is signature and signingCertificate. OCPP 1.6 had no way to verify that firmware came from the manufacturer; 2.0.1 makes signed firmware part of the protocol.

A requestId also lets you correlate status reports with the update that caused them, which 1.6 could not do.

Request

Field	Type	Required	Description
`requestId`	integer	Required	Correlation id, echoed in FirmwareStatusNotification.
`firmware`	FirmwareType	Required	`location`, `retrieveDateTime`, and optionally `installDateTime`, `signingCertificate` and `signature`.
`retries`	integer	Optional	Download retry count.
`retryInterval`	integer	Optional	Seconds between retries.

json

[2, "19223201", "UpdateFirmware", {
  "requestId": 801,
  "retries": 3,
  "firmware": {
    "location": "https://firmware.example.com/ac22-duo/3.2.0.bin",
    "retrieveDateTime": "2026-09-10T02:00:00Z",
    "installDateTime": "2026-09-10T03:00:00Z",
    "signingCertificate": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
    "signature": "MEUCIQD..."
  }
}]

Response

Field	Type	Required	Description
`status`	UpdateFirmwareStatusEnumType	Required	Whether the update was accepted.
`statusInfo`	StatusInfoType	Optional	Reason code.

json

[3, "19223201", {
  "status": "Accepted"
}]

Values

UpdateFirmwareStatusEnumType

Value	Meaning
`Accepted`	The update will be attempted.
`Rejected`	Refused.
`AcceptedCanceled`	Accepted, and an ongoing update was cancelled to make way for it.
`InvalidCertificate`	The signing certificate was not valid.
`RevokedCertificate`	The signing certificate has been revoked.

Implementation notes

Unlike 1.6, this response is informative. 1.6's UpdateFirmware returned an empty payload, so nothing could be validated up front. Here an invalid or revoked certificate is reported immediately.

`installDateTime` separates download from install, so a fleet can pre-stage firmware overnight and cut over at a chosen moment.

The station still fetches the file itself — the URL must be reachable from the station's network, not from your backend's.