diff --git a/config/v16/profile_schemas/Internal.json b/config/v16/profile_schemas/Internal.json index ec6687a900..343154aed1 100644 --- a/config/v16/profile_schemas/Internal.json +++ b/config/v16/profile_schemas/Internal.json @@ -196,6 +196,12 @@ "readOnly": true, "default": true }, + "VerifyCsmsAllowWildcards": { + "$comment": "Allow wildcards when verifying the CSMS commonName", + "type": "boolean", + "readOnly": true, + "default": false + }, "OcspRequestInterval": { "$comment": "Interval in seconds used to request OCSP revocation status information on the CSO Sub-CA certificates", "type": "integer", diff --git a/include/ocpp/common/websocket/websocket_base.hpp b/include/ocpp/common/websocket/websocket_base.hpp index 2881dc996d..9d336d9960 100644 --- a/include/ocpp/common/websocket/websocket_base.hpp +++ b/include/ocpp/common/websocket/websocket_base.hpp @@ -36,6 +36,7 @@ struct WebsocketConnectionOptions { std::optional hostName; bool verify_csms_common_name; bool use_tpm_tls; + bool verify_csms_allow_wildcards; }; enum class ConnectionFailedReason { diff --git a/include/ocpp/v16/charge_point_configuration.hpp b/include/ocpp/v16/charge_point_configuration.hpp index 837499ab52..9f6957ff06 100644 --- a/include/ocpp/v16/charge_point_configuration.hpp +++ b/include/ocpp/v16/charge_point_configuration.hpp @@ -84,6 +84,7 @@ class ChargePointConfiguration { KeyValue getUseSslDefaultVerifyPathsKeyValue(); bool getVerifyCsmsCommonName(); KeyValue getVerifyCsmsCommonNameKeyValue(); + bool getVerifyCsmsAllowWildcards(); bool getUseTPM(); std::string getSupportedMeasurands(); KeyValue getSupportedMeasurandsKeyValue(); diff --git a/lib/ocpp/common/websocket/websocket_tls.cpp b/lib/ocpp/common/websocket/websocket_tls.cpp index 3f3067a2e9..3fb673bbdb 100644 --- a/lib/ocpp/common/websocket/websocket_tls.cpp +++ b/lib/ocpp/common/websocket/websocket_tls.cpp @@ -310,7 +310,11 @@ tls_context WebsocketTLS::on_tls_init(std::string hostname, websocketpp::connect // Verify hostname X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new(); - X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); + if(this->connection_options.verify_csms_allow_wildcards) { + X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); + } else { + X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_WILDCARDS); + } // Set the host and parameter check X509_VERIFY_PARAM_set1_host(param, hostname.c_str(), hostname.length()); diff --git a/lib/ocpp/v16/charge_point_configuration.cpp b/lib/ocpp/v16/charge_point_configuration.cpp index 0dff27c989..cb0aa0fe21 100644 --- a/lib/ocpp/v16/charge_point_configuration.cpp +++ b/lib/ocpp/v16/charge_point_configuration.cpp @@ -352,6 +352,11 @@ bool ChargePointConfiguration::getUseTPM() { return this->config["Internal"]["UseTPM"]; } +bool ChargePointConfiguration::getVerifyCsmsAllowWildcards() { + return this->config["Internal"]["VerifyCsmsAllowWildcards"]; +} + + std::string ChargePointConfiguration::getSupportedMeasurands() { return this->config["Internal"]["SupportedMeasurands"]; } diff --git a/lib/ocpp/v16/charge_point_impl.cpp b/lib/ocpp/v16/charge_point_impl.cpp index a93131a5f0..bcbf36c802 100644 --- a/lib/ocpp/v16/charge_point_impl.cpp +++ b/lib/ocpp/v16/charge_point_impl.cpp @@ -241,7 +241,9 @@ WebsocketConnectionOptions ChargePointImpl::get_ws_connection_options() { this->configuration->getAdditionalRootCertificateCheck(), this->configuration->getHostName(), this->configuration->getVerifyCsmsCommonName(), - this->configuration->getUseTPM()}; + this->configuration->getUseTPM(), + this->configuration->getVerifyCsmsAllowWildcards() + }; return connection_options; } diff --git a/lib/ocpp/v201/charge_point.cpp b/lib/ocpp/v201/charge_point.cpp index 503660a332..93d8837fcc 100644 --- a/lib/ocpp/v201/charge_point.cpp +++ b/lib/ocpp/v201/charge_point.cpp @@ -860,7 +860,9 @@ WebsocketConnectionOptions ChargePoint::get_ws_connection_options(const int32_t this->device_model->get_optional_value(ControllerComponentVariables::AdditionalRootCertificateCheck) .value_or(false), std::nullopt, // hostName - true // verify_csms_common_name + true, // verify_csms_common_name + false, // use tpm + false // verify_csms_allow_wildcards }; return connection_options;