Secure every charger.From day one.
A recent PHP flaw put millions of websites at risk. The Mobiflow platform doesn’t use PHP and was not affected. Still, it’s a good reminder: serious flaws are being found faster than ever, and old software and unprotected connections are the easiest targets. Here’s how you set up every charging device securely.
Why it matters
Every charging device, whatever the brand, stays connected to its platform through OCPP. That connection carries charging sessions, configuration and firmware updates. Without encryption, that data is at risk. With wss:// and a unique authentication key per charging device, it’s protected. This setup is called OCPP Security Profile 2.
Unencrypted connection. Data on the link is at risk.
Encrypted connection, and a key that belongs to this one charging device.
On site: 5 checks
Update the firmware first
Old firmware often means old security, so update before you set up the connection.
Use the secure URL
Set wss://proxy.optimile.eu/services/ocppj with OCPP-JSON 1.6. Never use ws:// or an IP address.
Give every charging device its own key
In the QA platform, open Security, choose Generate random key, then click Set key on device. A key has 30 to 40 characters. Never reuse a key and never keep the factory default.
Register on site
Do it while you’re at the charging device, so you can fix problems right away. No signal, underground for example? Store the charge point ID and its key in a password manager and send them to the back office the same day.
Check before you leave
In the Security tab, Encryption should show TLS and Authentication a green check. Then run the soft reset test and confirm the device.
Firewall on site? Open ports 80 and 443 for OCPP.
All steps in detail
The QA platform manual takes you through every screen, from the serial number to the final confirmation.