EXPLORE KNOWLEDGE BASE
-
CERI Knowledge Base
-
About the CERI knowledge base
-
Introduction to Australia’s electricity markets
-
Australian consumer insights
-
CER technical and interoperability standards
-
Connecting a customer to an electricity network
-
Connecting a generator to a distribution network
-
Utility interconnection (CSIP-AUS)
-
Dynamic network export and generation control schemes
-
Network load control schemes
-
Network tariffs and network support services
-
Participating in the National Electricity Market
-
Participating in a frequency control market
-
Participating in the RERT
-
Participating in the Wholesale Electricity Market (Western Australia)
-
Participating in the I-NTEM (NT)
-
Cyber security and data privacy arrangements
-
Consumer protection frameworks
-
Cyber security requirements for CSIP-AUS
Last Updated on 24 July 2026
SUGGEST AN EDIT
LIKE THIS PAGE?
Secure communications and cryptographic requirements
TS 5573 mandates the use of PKI for secure communications between the CSIP-AUS Client and the Utility Server. The profile utilises HTTPS as its transport mechanism providing confidentiality and integrity for both telemetry data and control commands. Unencrypted or unauthenticated channels are not permitted.
While TS 5573 currently requires implementation of TLS version 1.2 (as inherited from CSIP) and product developers should also be prepared to support TLS 1.3 as needed for future compliance and to take advantage of its security improvements (e.g. faster handshakes and hardened cipher suites).
Both clients and servers must present valid X.509 certificates and perform mutual TLS authentication. This is intended to prevent any man-in-the-middle (MITM) attacks by ensuring the client is connected to a legitimate Utility Server and vice versa.
CSIP‑AUS adopts a certificate profile requiring at minimum 2048-bit RSA keys or equivalently strong elliptic curve keys, and signature/hash algorithms at least as strong as SHA-256. This aligns with Australian Government security guidelines (e.g. the Information Security Manual) for cryptographic strength. Weaker algorithms are not accepted.
While post-quantum algorithms are not yet mandated, system designers should be aware of this direction in Australian Government cyber security policy.
Public Key Infrastructure
As of November 2025, each utility in Australia must manage their own PKI solutions (issuing and managing certificates to client solutions). Certificates are not currently interoperable across server operators, and client providers must repeat the process for each utility. Utilities currently issue client certificates directly through their own certificate authorities. While the details vary across utilities, the process is typically as follows:
- Providers typically must request a certificate via email, which may involve submitting a Certificate Signing Request to access a test environment.
- Providers complete integration testing with the Utility Server in the test environment.
- Providers receive a production certificate or certificate bundle upon approval by the testing authority.
Recognising the challenges, complexity and cost to both servers and clients with deploying and operating individual PKIs, a national effort led by ENA is establishing a central PKI for CSIP-AUS under a new entity called NEPKI.
Under NEPKI, a Root CA (or a small set of root CAs under a federated model) will issue or sign certificates for clients. All participants within this PKI ecosystem would be able to trust this root, enabling any CSIP-AUS Client with a relevant set of credentials to authenticate with any Utility Server (and vice versa) in Australia.
Once authenticated, authorisation and rights for resources are managed by the Utility Server at the application level. In practice, this means the utility should map the incoming client certificate to an entity (i.e. an authorised CSIP-AUS Client) and implement and enforce an access policy, only providing read/write access to resources for which the CSIP-AUS Client is authorised.
Related articles
- Overview of CSIP-AUS
- Cybersecurity and data privacy arrangements
- National Energy PKI (NEPKI) and CSIP-AUS
- Product architecture considerations