Radio Equipment Directive 3.3

Firmware versions

This page applies to firmware version 5.34.1 and newer.

The Charge Controller's compliance with the Radio Equipment Directive (RED) 3.3 comes with changes to the security setup and how passwords are handled.
This page aims to provide a quick overview of the key changes and how this affects Manufacturers and what to do to avoid accidental, permanent lockouts.

RED 3.3 introduces stricter cybersecurity requirements for charging stations.

As a consequence, the charge controller actively enforces safer defaults. This affects manufacturer access, operator access, the Config UI, certificates, and SSH access.

Topic	What changes	What you need to do
# Manufacturer password	The Manufacturer password must be set and set to something other than orange_zone. If no valid Manufacturer password is set, the Controller randomizes the password after one hour of continuous operation. This leads to permanent Manufacturer lockout.	Set a Manufacturer password early during production. Use an interim production-only password if needed, then replace it with a final device-specific password before shipping.
# Operator, installer, and user passwords	These roles must set an individual password on first use if no individual password has been configured. The Controller defaults to EnforcePwdChange_custom = On since v5.34.1 to support this. With this setting active, the Controller prompts users logging in as the Operator, User, or Installer to set a password.	In production, use default passwords for non-Manufacturer roles such as OperatorPwd_custom_default to provide an initial default instead of setting the password directly. This forces users to set up a password on the first login. no additional configuration is needed since v5.34.1.
# Legacy Config UI	The legacy Config UI is disabled for operator, installer, and user roles. It cannot be re-enabled for these roles.	Update customer and service documentation so users are directed to the modern Web UI 2.0.
# Manufacturer legacy Config UI	Manufacturer access to the legacy interface may still exist, depending on configuration.	Recommended: disable the manufacturer legacy Config UI as well by setting WebUIStyle_web_default to Web UI 2.0 only.
# HTTPS for web access	Secure web access is recommended.	Recommended: enable HTTPS by default using EnableHTTPS_encryption_default.
# Certificates	Weak certificates are rejected or moved to quarantine. Certificate key strength is checked during boot and installation.	Usually no action is needed as certificate issuers know about the security requirements and set the certificates up accordingly.
# SSH access	SSH access over all interfaces except USB is disabled after one hour of operation. This cannot be changed as it's required by RED 3.3.	Adjust production and service processes accordingly. Complete SSH-based provisioning early, or use supported local/USB configuration methods where needed.

1 Recommendations

• Use a strong, unique Manufacturer password for every device for maximum security
• If you're working with EnforcePwdChange_custom within your comissioning workflow, we suggest setting the value to On to match the default behavior
• If you don't work with EnforcePwdChange_custom within your comissioning workflow, you don't have to add it for it to take effect

2 Frequently asked questions

• The controller will randomize the Manufacturer password and force a reboot. Manufacturer access is permanently lost and there is no way to recover it as is intended by the RED 3.3 security requirements.

• No, shared passwords are not compliant with RED 3.3. You must use unique, strong passwords for each device to ensure security.

• No, the one hour timer resets on reboot and does not add up over multiple sessions.

• See the Provisioning documentation for details on this.