Codetics OCPP

A complete implementation of the Open Charge Point Protocol (OCPP-J 1.6, 2.0.1 and 2.1) in Rust, and a Charging Station Management System (CSMS) service built on it, written by Kevin Vavelin for Codetics.

• Every message of the three versions as plain Rust types, with validation and typed dispatch; no OCPP library, no code generation.
• Its own WebSocket stack (RFC 6455 + RFC 7692 compression), built for tens of thousands of concurrent stations.
• TLS with OCPP Security Profiles 1–3, smart charging, reservations, tariffs and cost calculation, an HTTP API, PostgreSQL storage.

It can be used as is, as a whole service or crate by crate. Contributions are welcome (see CONTRIBUTING.md).

Crates

Each version crate is independent, and so are the version handlers of the service (src/ocpp/v16.rs, v201.rs, v21.rs). They share only version-neutral logic.

External crates: tokio, axum/hyper (HTTP), serde/serde_json, sqlx (PostgreSQL), flate2 (raw DEFLATE), openssl (TLS), argon2 (password hashing), tracing.

Version negotiation

The Sec-WebSocket-Protocol header is the source of truth:

• OCPP-J 1.6 §3.1.2: "The exact OCPP version MUST be specified in the Sec-Websocket-Protocol field."
• 2.0.1 and 2.1 Part 4 §3.1.2: "If the OCPP version is part of the OCPP-J endpoint URL it SHALL NOT determine the OCPP version to use."

The server picks the first version in the client's preference order that is both enabled (OCPP_VERSIONS) and allowed for that station (allowed_versions). If none matches, the handshake completes without Sec-WebSocket-Protocol and the connection is closed (Part 4 §3.2). Stations sold as "OCPP 1.8" negotiate ocpp1.6.

Connections and security

• /<any prefix>/<identity>: the identity is the last path segment, percent-decoded (≤ 48 characters, no :). Unknown stations get HTTP 404: only stations registered through the API can connect.
• Security Profiles (Part 2 §A00, same as the 1.6 security whitepaper), configured per station (security_profile): profile 1 = Basic auth over plain WebSocket, 2 = TLS + Basic auth, 3 = TLS + client certificate. A station connecting with another profile is refused (A00.FR.002). Without a profile, a password is required only if one is set.
• TLS (OpenSSL): TLS 1.2+, the four cipher suites of A00.FR.318 (including TLS_RSA_WITH_AES_*_GCM, which rustls does not implement) plus ECDHE-RSA, an RSA and an ECDSA certificate side by side, no compression or renegotiation. Profile 3 checks the certificate chain against OCPP_TLS_CLIENT_CA, the O RDN against OCPP_CSO_NAME (A00.FR.404) and the CN against the station's identity or serial number (A00.FR.405); refusals are logged as InvalidChargingStationCertificate security events. Certificates are reloaded on SIGHUP.
• Passwords: raw bytes (1.6 binary AuthorizationKey), its 40-character hex form, or a UTF-8 string (2.x); stored as Argon2id hashes, verified with bounded concurrency so reconnect storms cannot exhaust memory.
• One task per connection multiplexes reads, the command queue, call timeouts, keep-alive pings and shutdown. At most one CSMS-initiated CALL is in flight per connection (§4.1.1).
• permessage-deflate (required for a CSMS in 2.0.1/2.1) with pooled compressors: idle connections hold no compression state.
• Before acceptance, transaction-related CALLs get SecurityError; never-booted stations are sent TriggerMessage(BootNotification). A newer connection for the same identity replaces the older one.
• Per-version RPC errors: 1.6 spellings, 2.0.1 MessageTypeNotSupported / RpcFrameworkError with id "-1", 2.1 CALLRESULTERROR and SEND.

Measured on a laptop (client and server in one process): 10,000 stations connected and exchanged a heartbeat in about 6 s. Raise the file-descriptor limit (ulimit -n) for production loads.

Smart charging (1.6 §3.13, 2.x block K)

• Registry of the charging profiles sent to (or reported by) each station, with the CSMS-side rules checked before sending: station max profile on connector/EVSE 0 only, TxProfile only during a transaction with its transactionId filled in (§5.16, K01.FR.03), no external-constraints profile from the CSMS (K01.FR.22), no conflicting stack levels (K01.FR.06/39), phaseToUse rules, 2.1 PriorityCharging and Dynamic profile rules.
• Composite schedule computed by the CSMS (stacking, TxProfile over TxDefault, PriorityCharging, external limits, LocalGeneration, A↔W conversion), or requested from the station.
• External limits (NotifyChargingLimit / ClearedChargingLimit), ReportChargingProfiles synchronisation, TxProfiles cleared when their transaction ends.
• ISO 15118 charging needs (K15–K19): the CSMS answers and sends a TxProfile within the station limits.
• OCPP 2.1 dynamic profiles (K28): UpdateDynamicSchedule pushes and PullDynamicScheduleUpdate answers.

Reservations (1.6 §5.13, 2.x H01–H04)

Reservation ids assigned by the CSMS; ReserveNow / CancelReservation; status followed from the station's answers, StartTransaction / TransactionEvent (used), ReservationStatusUpdate, Faulted/Unavailable connectors (1.6) and an expiry sweeper. Reservations by EVSE, any EVSE, or connector type (2.x), with group tokens.

Tariffs and cost (2.x block I)

OCPP 1.6 has no tariff mechanism; this applies to OCPP 2.0.1 and 2.1 stations, per cost_mode:

• Central: the CSMS calculates. Tariff text in IdTokenInfo.personalMessage (I01), running cost on Updated events (I02) and final cost on Ended (I03, 0.00 for free sessions).
• Local (2.1): SetDefaultTariff, GetTariffs, ClearTariffs, driver tariffs in AuthorizeResponse (I07–I10), ChangeTransactionTariff (I11); the station's costDetails are stored and recalculated by the CSMS for verification (I12).
• Tariffs use the OCPP 2.1 TariffType and are immutable per id (I08.FR.08). The cost engine follows I12: conditions on local time of day, weekday, dates, energy, power, current and durations; a new charging period whenever the applicable prices change; stacked taxes; min/max cost; tariff changes without retroactivity. Local time comes from the system zoneinfo database, daylight saving time included.

EVSE IDs

IDRR format without the COUNTRY*OPERATOR* prefix: <E|P|S><id>. A station gets S + 6 base-36 characters + check character (e.g. S000001D); each EVSE gets E + station body + 2-digit EVSE number + check character. The check character uses the IDRR Annex 1 algorithm, which Annex 1 defines for contract IDs; here it covers the local part.

Running

export DATABASE_URL=postgres://localhost/ocpp
cargo run --release

Migrations run at startup (PostgreSQL with the pg_trgm and unaccent extensions). OpenSSL is linked from the system; build with --features vendored-openssl to compile it from source.

HTTP API (/api/v1)

Command results: 200 with the station response, 400 invalid payload or rule violation, 409 conflict or station not connected, 502 CALLERROR or invalid response, 504 timeout.

Tests

cargo test --workspace                                                    # unit tests and README examples
TEST_DATABASE_URL=postgres://localhost/postgres cargo test --workspace    # + end-to-end tests (temporary databases)
E2E_STATIONS=10000 TEST_DATABASE_URL=… cargo test --release --test e2e many_concurrent -- --nocapture

Not implemented yet

• Cross-node command routing: with several instances, a command for a station connected elsewhere returns 409 with connected_node.
• Certificate management: no CA or OCSP integration (SignCertificate → Rejected, certificate status requests → Failed).
• The OCPP 1.6 security whitepaper messages (SecurityEventNotification, SignedUpdateFirmware, …).

Author, license and credit

Codetics OCPP is written by Kevin Vavelin — codetics.fr.

Licensed under the Apache License, Version 2.0. Copyright 2026 Kevin Vavelin, Codetics.

You may use, modify and redistribute this work, including commercially, provided that every redistribution of it or of a derived work — forks included — keeps the copyright notices and includes the NOTICE file, which credits Kevin Vavelin / Codetics as the origin of the work.

OCPP is a specification of the Open Charge Alliance; this project is independent and not endorsed by it. See NOTICE for third-party attributions.