Where you can actually enrol a device.
The hardest practical problem in early V2X development is not the radio. It is getting a real certificate from a real authority so you can test the thing you actually shipped. The options are thinner than you would expect.
Thinner than you would expect.
| Option | What it gives you |
|---|---|
| AutoCrypt SCMS Interoperability Test platform | A publicly advertised test service at autocrypt.io/demo/scms-test/. The most accessible starting point for an SCMS-model integration. |
| EU CCMS / CPOC | cpoc.jrc.ec.europa.eu publishes TLM certificates, the ECTL in full and delta form, the C-ITS Certificate and Security Policy, and the CPOC Protocol. The site itself notes it is being piloted and may change frequently. The L0/L1/L2 trust-level concept is real in EU C-ITS practice but the level definitions could not be verified from the CPOC site — read Certificate Policy Release 3.0 directly rather than relying on secondary descriptions. |
| Keyfactor EJBCA | Stand up your own Enrolment Authority locally. EA role only — no ECTL or TLM integration, cannot be a Root CA or AA. Still the fastest way to test an enrolment flow end to end without a commercial contract. |
| INTEGRITY Security Services | Commercial SCMS/CMS with production deployments. Test access is commercial. |
| ESCRYPT / ETAS test PKI | No publicly available test instance could be confirmed. |
| USDOT test SCMS | Status in 2026 unverified. The original CAMP/USDOT proof-of-concept has been largely superseded by commercial providers under the OmniAir 1609.2.1 regime. Do not point developers at it without checking. |
For a hardware team, in this order.
- Compile the ASN.1 from ETSI forge.
- Implement enrolment and authorisation against a locally hosted EJBCA enrolment authority until the message nesting and the HMAC key-tag computation are right. The exact nesting order →
- Move to AutoCrypt's test platform to exercise a real SCMS round trip.
- Only then engage a commercial provider for the deployment PKI.
Doing it in the other order costs months.
The radio can be bought. A trusted certificate cannot.
An evaluation kit gets a team to transmitting a message in days. Getting a message that a second vendor's device will accept takes months, and almost all of that time goes into the credential path: the enrolment request nesting, the encryption to the authority's key, the HMAC key-tag computation, the certificate profile the authority actually issues against, and the trust material the receiving device has to already hold.
None of that can be exercised against a self-signed certificate you generated yourself. A locally hosted enrolment authority gets the message structure right; only a real authority exposes the profile and policy mismatches that break interoperability. That is why the sequence below moves from local to real rather than starting with a commercial contract.
Budget for it accordingly. On a programme with a type-approval deadline, the PKI integration is the long-lead item and the one most often scheduled last. What the flow actually contains →
Three things that only exist in a real deployment.
- Trust-list distribution at scale. A test instance hands you the trust material directly. A deployment distributes it over roadside broadcast and cellular to devices that may be offline for a week, and sizing that path is a separate engineering problem. Revocation and distribution →
- Revocation behaviour. Test authorities rarely revoke anything. Whether your device correctly rejects a certificate whose linkage seeds have been published, and what it does when the CRL exceeds its storage budget, has to be tested deliberately.
- Hardware attestation against a real enrolment policy. An authority that accepts a software key in test will not accept one in production. The attestation path from the secure element through to the enrolment decision is the part that most often turns out to have been stubbed. The attestation requirement →
In India none of this infrastructure exists yet: no national trust anchor has been designated, and there is no accredited V2X test laboratory. A team building against the October 2028 date is currently developing against European or North American test material and will have to re-qualify. Where the Indian framework stands →