TLS handshake fail to CSMS

How it presents

Symptom

TLS handshake fail to CSMS — DNS works but TLS fails (cert/clock/SNI), leaving OCPP down. protocol field note: keep evidence scrubbed and prove the ranked cause before module RMA on NET-C02.

Root causes (by observed frequency)

1. #1 Station clock skew breaking cert validity

   Very common

2. #2 Missing/expired charger client cert or CSMS trust change
3. #3 Interception proxy presenting wrong cert
4. #4 TLS version mismatch after CSMS upgrade

Diagnostic procedure

1. 1. Verify station time vs real time

   Expected: Skew within minutes

   Tools: HMI

2. 2. Capture TLS error from modem/charger logs

   Expected: Alert/unknown CA/etc

   Tools: logs

3. 3. Confirm no SSL-inspect proxy on the EVSE VLAN unless designed

   Expected: Direct path

   Tools: IT

4. 4. Reinstall/renew client certs per OEM if required

   Expected: Handshake completes

   Tools: OEM

5. 5. Align TLS versions with CSMS security policy

   Tools: both admins

The fix

TLS handshake fails are clock/cert/proxy — not DC modules.

1. Fix clock/NTP first on TLS failures. Document readings and scrubbed photos for NET-C02 before closing the ticket.
2. Remove unexpected TLS interception on the charger VLAN.
3. Renew charger certificates per OEM procedure. Document readings and scrubbed photos for NET-C02 before closing the ticket.
4. Confirm full handshake then BootNotification/Heartbeat.
5. Only then consider control-board replacement. Document readings and scrubbed photos for NET-C02 before closing the ticket.