-
-
Notifications
You must be signed in to change notification settings - Fork 31.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Local API cannot connect certificate verify failed ('Could not contact DNS servers') in HA >2024.12.0 in Overkiz #132318
Comments
Hey there @iMicknl, @vlebourl, @tetienne, @nyroDev, @Tronix117, @alexfp14, mind taking a look at this issue as it has been labeled with an integration ( Code owner commandsCode owners of
(message by CodeOwnersMention) overkiz documentation |
Getting the same error after updating to core-2024.12.0. Was connected to Somfy TaHoma Switch using the local API. |
Somfy just upgraded their app to consolidate the Somfy and TaHoma North America apps. Seems API changes might have been made. The HA integration failed after upgrade. EDIT - For people that did the Somfy migration, this broke cloud integration and authentication (to get the Local API token) on Somfy end it seems. See Issue |
A roll back to 2024.11.2 works, so don't think it is a Somfy API issue. |
With 2024.12.0 I get the following debug log on a HA restart.
I've not tried with the browser - the fact reverting to 2024.11.2 works, suggests the gateway is fine. Reconfiguring is not easy, as the integration is stuck in the initialisation state, so the configure, disable and delete buttons are not available. (They only appear when the integration fails to start - this integration does not seem to fail - rather hits an endless loop of retries). |
My Somfy hub/gateway is blocked from accessing the internet, it cannot have updated its API. |
I don't live in the US and have the same issue only in 2024.12 (ok after rollback to 2024.11.3). |
Same issue here. Tried to generate a new API. there is a connection failure in the SOMFY link in my account. Maybe the problem is bij SOMFY |
Same issue here. |
OK, here's a debug log from my development environment, using 2024.12.0... Local API. verify SSL ticked...
DNS on the machine is working fine (e.g,. I can get to github to send this message) Local API, SSL unticked...
I.e., the same. Cloud API Works fine. |
Using Local_API, if I replace
if I turn SSL verify off, and use the IP address its back up and running. So this issue is the new code cannot DNS resolve |
So the workaound to get something working with 2024.12 the steps are...
Hopefully someone can figure out the name resolution issue, and we an revert to using SSL. |
PS. I have a dev environment up and running now, so if you want me to test any fixes... |
I think something change with ssl verification with python 3.13. The root cause seems to be close with another issue : |
I think that is a different issue, as that is failing at the SSL verification stage. |
I just installed the update and of course I have the same issue. Hope that a solution is quickly found. |
Same here after updating to 2024.12.0 => rolled back to 2024.11.3 and every thing works fine! |
Thanks all! It seems related to a Python 3.13 or HA OS update, but I will further investigate. Small issue here is that it is hard to debug this, since the Dev Mode on my TaHoma Switch is not functional at the moment.... @ColinRobbins if you use an IP address, the SSL verify should not work, this is as intended. |
@iMicknl My development environment is using Python 3.12, running in a Venv. So it is not P3.13 or HA OS that are causing the issue. |
I have update to the HA OS 14.0, and still on core 2024.11.3, and everything is still working here. just to let you know. |
Just chiming in here to also say that this is definitely not caused by HAOS14. The culprit has to be some change in HA 2024.12. I'm still on HAOS13.2, updating to HA 2024.12.0 broke the Overkiz integration. Rolling back to HA 2024.11.3 fixed the issue. |
I don't know this integation, or how it works, but I've done some code tracing. During the config, the method The first with the parameter:
this works. Then it is called again with...
which is where it fails. Strange that is not affecting other integrations though. |
Maybe also relevant: aio-libs/aiohttp#10110 |
Looping in @bdraco - it seems some recent aiohttp changes has caused local name resolution to fail. |
Let's investigate first; there have been changes in the SSLContext (iMicknl/python-overkiz-api#1448) and aiohttp has been upgraded to the latest version. @ColinRobbins in your example, it is able to make a connection to the Cloud API, but fails on connecting to the local API. |
For debugging, if someone is able to test the underlying integration with this code sample: https://github.com/iMicknl/python-overkiz-api?tab=readme-ov-file#local-api. Would be great to see what error you receive. |
@virtualj I will respond in more detail tomorrow, but can you check the gateway version? This is actually an old problem which should have been fixed: Somfy-Developer/Somfy-TaHoma-Developer-Mode#5. Are you sure your certificate does not provide any additional CN's? And the mDNS address gateway-xxxx-xxxx-xxxx.local is valid, according to the Somfy documentation. If you cannot access this, this is due to your network / mDNS configuration or an issue of your gateway. |
That is what we need to find out. The problems have been introduced since the last update and we haven't been able yet to pinpoint the issue. What doesn't help is that I can't test it myself, since my local gateway functionality is broken again... |
I started seeing this issue some time around 24 hours ago. It definitely still worked 36 hours ago (an automation ran). |
This comment was marked as duplicate.
This comment was marked as duplicate.
After upgrading to 2024.12 last night the integration stopped working. No combination of local or online API and SSL enabled/disabled fixed the problem. I downgraded via a Proxmox backup to 2024.11 and it works again now. I will wait for a fix before upgrading to .12 |
Well, this is wierd. I have it working in my development environment again, with SLL, but cannot really explain why. There are three possible explanations (edited).
That kicked it into action, with SSL. Why did I do that? I tried to fix mDNS in my dev environment, and could not (not convinced its broken - just not working the way HA wants it to). So I hacked /etc/hosts so I could move on. I am reluctant to try in my (stable) HAOS production environment turning SSL back on. So very confused as to why it now works OK in my dev environment, but this could give someone a clue... |
ASIDE - incase it helps anyone. My understanding of the DNS "issue". Under "normal" operation, Linux will try "Most" apps use HA uses What this does not explain for me is why this suddenly makes SSL work. Test python code incase anyone else wants to explore the issue. |
This comment was marked as duplicate.
This comment was marked as duplicate.
@heiko69 have you looked back in this thread and tried the suggestions above? Recap.
to your
to |
@virtualj are you able to try the /etc/hosts suggestion above? I have a suspicion that the new DNS code in HA has expectations of a certain DNS configuration has per HAOS) and on some Linux configurations the expectations are not met, and mDSN then fails. (So this maybe an issue some people are seeing - different from the SSL issue). Looking at your cert naming suggestions, I wondering if the is new DNS code is somehow causing the naming issues (not sure how), and by using /etc/hosts it sidesteps the issue. Not sure we’ve yet got a lead on the cert validity issue, but maybe, just maybe, it’s a side effect of the cert naming point you raise. I have it all working on my dev system, without messing around with certs - but have no idea why! |
This comment was marked as duplicate.
This comment was marked as duplicate.
This comment was marked as duplicate.
This comment was marked as duplicate.
I can confirm, that there seem to be multiple issues with the connection.
Conclusion: |
This comment was marked as duplicate.
This comment was marked as duplicate.
TLDR: as mentioned 2 times earlier, please only reply if you have new information. |
Today I finally had access to a local Overkiz gateway and could debug the culprit. Since python/cpython#107361, which enables stricter RFC 5280 compliance checks within OpenSSL's X.509 path validation implementation. The provided certificates by the Overkiz gateways are not compliant to these checks and thus the certificate cannot be verified.
I have disable the strict checks and in an upcoming update the SSL verification will be working again (#133835). The other known issue (#108595) is not solved by this fix. Users connecting to the Local API might still see "Network is unreachable" / ClientConnectorError. We can discuss this in more detail in #108595. |
I tested this solution but it doesn’t work.
Do you know when this will be updated? In 2025.01 I can’t see this fix at the moment. |
@BauStein-So are you sure you run the beta? What is the error you receive? |
First I would like to thank you for your resolution of the problem. |
It is fixed in 2025.1 and I did test this myself. If anyone from this issue thread would be willing to test the beta this period (https://www.home-assistant.io/common-tasks/os/#running-a-beta-version), that would be appreciated. |
Just installed 2025.1.0b2. Was not working from 2024.12.0 to 12.5 Using TaHoma classic v2 w. localAPI enabled in w. Europe / Germany Thank you, good work :-) |
Ok in 2025.1. Thanks for your fix. |
I've upgraded with official 2025.1 update this morning but authentication with local API is always down 🤔😓 |
Does cloud authentication work? Can you create a new issue here, preferably with debug mode on and your logs. And as many information as possible. https://github.com/Somfy-Developer/Somfy-TaHoma-Developer-Mode. You could try the steps here as well, to understand if the authentication is working.. |
I confirm that with 2025.1.0. Local-API works fine again. thank you very much |
Also now working again for me with 2025.1.0 |
The problem
After the update to 2024.12.0 overkiz is displaying the following error:
... Failed to connect.
What version of Home Assistant Core has the issue?
core-2024.12.0
What was the last working version of Home Assistant Core?
core-2024.11.3
What type of installation are you running?
Home Assistant OS
Integration causing the issue
Overkiz
Link to integration documentation on our website
https://www.home-assistant.io/integrations/overkiz/
Diagnostics information
home-assistant_overkiz_2024-12-05T00-22-58.121Z.log
Example YAML snippet
No response
Anything in the logs that might be useful for us?
No response
Additional information
No response
The text was updated successfully, but these errors were encountered: