OCPP is the protocol a charger and its management system use to talk. It carries session starts, status updates, settings and firmware commands. Its security profiles define how the two sides protect that connection.
There are three profiles, and the differences are simple once you ask two questions. How does the charger prove who it is? Can anyone on the network read the traffic?
The three profiles
- Profile 1A password over an unencrypted connection. Anyone on the path can read it.
- Profile 2TLS with a server certificate, plus a password for each charger.
- Profile 3Mutual TLS. The charger and the back-end each prove themselves with a certificate.
| Profile | How the charger proves itself | Connection | Our view |
|---|---|---|---|
| 1 | A password | Not encrypted | Don’t use it in production |
| 2 | A password, sent inside TLS. The server shows a certificate | Encrypted | The minimum |
| 3 | Its own client certificate. Both sides show certificates | Encrypted | The target for new deployments |
Profile 1 sends the password over an open connection, so anyone who can see the traffic could read it. Profile 2 fixes that with TLS, but a stolen password can still be reused by someone else. Profile 3 uses a certificate, which is harder to copy when the key is stored in protected hardware.
What about OCPP 1.6?
OCPP 1.6 is still common in the field, and the security profiles came with OCPP 2.0. The Open Charge Alliance publishes a security whitepaper that explains how to use those improvements on top of OCPP 1.6-J. Its fourth edition is dated 5 February 2026.
So an OCPP 1.6 charger isn’t automatically on an unprotected link. You need to check how each one is configured.
What regulators are proposing
In its 2026 position paper, Germany’s BSI proposes OCPP 2.0 or later with at least Profile 2 for new or repaired chargers. As an interim step, it says OCPP 1.6 with Profile 2 could be required instead. It also says profiles should move to TLS 1.3 to allow for post-quantum migration.
That’s a proposal and not yet a rule, but it gives buyers a baseline they can quote.
What a profile doesn’t cover
- A profile protects the connection. It doesn’t decide which commands are allowed.
- TLS protects each hop. A compromised back-end can still send a harmful command over a secure link.
- A credential only helps if the back-end ties it to that charger’s ID and rejects a mismatch.
- A secure profile can be undone if the back-end still accepts weaker connections.
How to check your network
- Get a count of chargers by OCPP version and security profile.
- Confirm each charger has its own credential, with no shared passwords.
- Ask whether the back-end refuses connections below your chosen minimum.
- List the chargers that can’t reach Profile 2, and plan their replacement or isolation.
- Keep the report. It’s evidence for your risk assessment.
For the supplier side of this, see our ten security questions.
