MP268 'Certificate rotation and expired Certificates'

Once the 2024 manufacturing pack is made available by the Data Communications Company (DCC), there will be Devices Installed and Commissioned that contain information from an Organisation Certificate that has a Validity Period of more than ten years.

The Smart Energy Code (SEC) already specifies a post-commissioning obligation to replace the Certificate information in the Device’s Supplier and Network Operator Trust Anchor Cells. However, there is no explicit requirement in the SEC specifying the post-commissioning replacement of the Organisation Certificate information, for which the DCC is responsible.

The Proposed Solution involves developing clear guidelines within the SEC mandating post-commissioning replacement of Organisation Certificates by the DCC. These guidelines will provide explicit instructions and timelines for replacing any Organisation Certificate which has a Validity Period longer than ten years or is revoked or expired. This is to ensure, ongoing network security and compliance. Additionally, monitoring mechanisms will be established to ensure compliance with SEC guidelines and stakeholder collaboration will be key in communicating and enforcing the new guidelines effectively.