Proxy MITM breaks certificate pin

How it presents

Symptom

Proxy MITM breaks certificate pin — corporate proxy intercepts HTTPS and the charger rejects the substituted certificate. protocol field note: keep evidence scrubbed and prove the ranked cause before module RMA on NET-C04.

Root causes (by observed frequency)

1. #1 SSL inspection enabled on EVSE VLAN

   Chargers rarely trust corp roots

2. #2 Explicit proxy config left over from lab image
3. #3 CSMS certificate pin mismatch after proxy hop
4. #4 Transparent proxy newly inserted by IT

Diagnostic procedure

1. 1. Compare TLS peer certificate fingerprint to CSMS expected

   Expected: Mismatch shows MITM

   Tools: IT/OEM tools

2. 2. Ask IT whether SSL inspect is on for this subnet

   Expected: Yes/no

   Tools: IT

3. 3. Bypass/exclude CSMS hosts from inspection

   Expected: Direct cert

   Tools: IT

4. 4. Remove erroneous explicit proxy settings on charger

   Expected: No proxy

   Tools: HMI

5. 5. Retest handshake and Heartbeat

   Tools: CSMS

The fix

MITM proxies break charger TLS pins — bypass inspection for CSMS hosts.

1. Exclude charger CSMS traffic from SSL inspection. Document readings and scrubbed photos for NET-C04 before closing the ticket.
2. Clear lab proxy leftovers from production images. Document readings and scrubbed photos for NET-C04 before closing the ticket.
3. Do not install random corp roots on chargers unless OEM supports it.
4. Confirm true CSMS certificate presents end-to-end. Document readings and scrubbed photos for NET-C04 before closing the ticket.
5. Update network runbooks so future proxy projects skip EVSE VLANs.