OCPP certified appears on a lot of datasheets and in a lot of tenders. It is a meaningful claim, but a narrower one than many buyers assume. This guide explains how the Open Charge Alliance (OCA) certification program works, what is tested, how to read a certificate, and what certification does not guarantee.
Who runs it and who tests
The OCA defines the certification procedure, test plans and test tools. Testing is done by independent test laboratories that the OCA has authorized. The vendor contracts with a lab, the lab runs the tests and reports results to the OCA, and the OCA issues the certificate and lists it in its online certification directory. Certification is open to OCA members and non-members; members pay reduced fees.
The procedure covers OCPP 1.6 and OCPP 2.0.1. Older versions are not certifiable. The OCA has also published certification profiles and test cases as part of the OCPP 2.1 specification documents; check the OCA site for the status of 2.1 certification.
What can be certified
- Charging stations, tested as complete products.
- CSMS implementations.
- Charging station software stacks: OCPP software that can be tested outside a physical charger. A charger built on a certified stack is not automatically certified; it must pass the tests itself.
What is tested
Certification has two parts. Conformance tests run the device under test against the OCPP Compliance Testing Tool (OCTT), which checks that the implementation follows the specification for the profiles the vendor claims, including optional features the vendor says it supports. Performance measurements record how the device behaves in a lab environment against parameters the vendor declares in its PICS (Protocol Implementation Conformance Statement).
Testing involves real interaction: the lab plugs and unplugs cables, presents tokens and reboots the device, alongside automated test cases. For a CSMS, the vendor must provide a UI the tester can use to trigger every required message without hand-crafting frames. Chargers must speak OCPP directly to the test tool, not via a proprietary protocol to a vendor cloud that then speaks OCPP.
Certification profiles
OCPP 1.6
| Profile | CSMS | Charging station | Covers |
|---|---|---|---|
| Core | Mandatory | Mandatory | Boot, authorization, configuration, transactions, remote control, diagnostics; security logging, events, secure firmware update and certificate management; Security Profile 2 (TLS with Basic auth) |
| Smart Charging | Mandatory | Optional | All charging profile types, including stacking |
| Advanced Security | Optional | Optional | Security Profile 3: TLS with client-side certificates |
Note that 1.6 certification includes the 1.6 security extension from the OCA security whitepaper, and the secure firmware messages replace the original UpdateFirmware and FirmwareStatusNotification. See OCPP 1.6 security profiles.
OCPP 2.0.1
| Profile | Status | Covers |
|---|---|---|
| Core | Mandatory | Boot, authorization, configuration, transactions, remote control, Security Profiles 1 and 2. Optional features within Core include advanced device management, reservation, advanced UI (tariff, cost and display messages) and local authorization list management |
| Advanced Security | Optional | Security Profile 3 (TLS with client certificates) |
| Smart Charging | Optional | Charging profiles including stacking |
| ISO 15118 Support | Optional | ISO 15118 smart charging and Plug & Charge authorization |
The OCA has simplified the 2.0.1 profiles over time, folding features that were once separate profiles into Core as optional features. For OCPP 1.6, the current procedure also requires security certification (at least Security Profile 2) for both CSMSs and charging stations, so certified products do not need to support unsecured communication.
How to read a certificate
- OCPP version: 1.6 or 2.0.1. A 1.6 certificate says nothing about 2.0.1.
- Profiles and optional features: check that the ones you need are listed. A charger certified for Core only has not been certified for smart charging.
- Firmware or software version: a certificate applies to a specific firmware version (for chargers, the version reported in
BootNotification) or OCPP software version (for a CSMS). A new release is not covered until it is re-certified. Automated re-certification exists to make that cheaper for previously certified products. - Product and product family: a certificate covers the tested representative product and any family members listed, which must share firmware and the OCPP-relevant hardware feature set (for example AC vs DC, number of EVSEs and connectors, connector types).
- White-label certificates: a rebadged product that is identical inside can carry a white-label certificate referencing the original.
Vendor Declarations of Conformance are not certificates
Vendors can buy OCTT and run the same test cases themselves. A clean automated run can produce a signed Vendor Declaration of Conformance (VDoC). It is useful evidence, and it is how additional product family members are added to a certificate, but it is not certification. The OCA's own procedure points out that a VDoC has had no independent check that the listed product is the one tested, that no manual corrections were made during testing, or that the charger actually works. VDoCs are not listed on the OCA website.
What certification does not tell you
- That a specific charger works with a specific CSMS. Certification tests each against the reference tool, not against each other. Two certified products can still disagree on optional behaviour, timing or interpretation. Interoperability testing with your own stack is still necessary; see testing with a charge point simulator.
- That the firmware in the field is the certified version, unless you check.
- Hardware reliability, metering accuracy, safety or grid compliance. Those are covered by other certifications and regulations.
- Behaviour outside the claimed profiles, or vendor-specific
DataTransferextensions. - Performance at scale for a CSMS. Lab performance measurements are not a load test of your fleet.
How to use certification when buying
- Ask for the certificate number and verify it in the OCA's online directory.
- Check the version, profiles and optional features against your requirements: smart charging and Advanced Security are the usual gaps.
- Check the certified firmware version against what will ship, and ask about the vendor's re-certification practice.
- Run your own interoperability test against your CSMS before committing to volume.
- Write the required certification into contracts, including for future firmware.
Regulation increasingly assumes OCPP: the US NEVI rule requires OCPP 2.0.1 conformance for funded chargers. See NEVI and AFIR requirements.
Key takeaways
- OCA certification is conformance testing plus performance measurement, run by independent labs with OCTT, for OCPP 1.6 and 2.0.1.
- A certificate is specific to a version, profiles, firmware or software version, and product family. Read it.
- Certification reduces interoperability risk but does not replace testing your charger and CSMS together.
HashTech's CSMS platforms are OCPP-certified, and we do hardware onboarding and conformance testing for operators; see our EV charging work.
