SSL error when trying to add device #13
Comments
|
I finally got a new version up, though this is "very" alpha, please give it a go and see if you still get this issue. If you get a different one, please close this and open a new issue. |
xannor
added
the
potential fix
|
No follow up after a few days, assuming fixed, create a new issue if you still have problems. |
|
Hi @xannor ! I am sorry I was not available in the last 2 weeks. Thanks for the upgrade ! |
|
Unfortunately that error is outside of my code. I believe it is due to something ReoLink is doing wrong with their self signed certs on some SSL setups. I have seen reports of this happening with the NVR, but this is the first with an individual device. Unless you have a dire, specific, need for SSL encryption on your local network, I would recommend make in sure port 80 (HTTP) is enabled in the network configuration, also while in the settings, make sure ONVIF, and RTMP are enabled as well so motion events and streams are available as well. |
|
I think I found the cause/answer to the SSL issue. I have a device that can reproduce it and I found out the cause of the error. Python 3.10 changes its TLS requirements in 3.10 and it looks like the key types used by the camera's (and possibly the NVR's) are using a very old RSA format that python is no longer accepting. The issue is filed here: https://bugs.python.org/issue43998 and I found it via this Stack Overflow question: https://stackoverflow.com/questions/71006708/getting-sslv3-alert-handshake-failure-when-trying-to-connect-to-imap however the solution may not be practical on current Home Assistant installs. I will have to investigate this, so I re-opened this issue. for the time being I strongly recommend not using SSL if possible (i.e. not sharing the camera directly on the internet) or update: |
xannor
added
firmware issue
xannor
changed the title
|
hi, today I got a Reolink RLC-410W - I also cant add the camera.
For sure I imported the cert & key in the camera and verified in the browser. I also imported the cert in my docker image for HA as /etc/ssl/certs/camera1.pem with its symlinks to the hashes (c_rehash): But also after all this - I get: Are u sure, that a new cert fixed the issue? It looks to me, that the Webserver of the Reolink maybe uses a weak cipher - not only the cert? |
|
Hmm.. with So, maybe a python issue? |
|
hmm.. okay it needs fixed for python3.10 as xannor already pointed out. I found also this:
context = ssl.create_default_context()
context.set_ciphers("DEFAULT")
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
self.ssl = contexthttps://community.home-assistant.io/t/2022-7-a-stunning-performance/437364/227?u=tcr82 |
|
okay, I found where to fix it: --- /tmp/connection.py
+++ /usr/local/lib/python3.10/site-packages/async_reolink/rest/connection.py
@@ -14,6 +14,7 @@
overload,
)
from urllib.parse import urlparse
+import ssl
import aiohttp
from async_reolink.api.commands import (
@@ -42,10 +43,16 @@
def _default_create_session(base_url: str, timeout: int):
+
+ context = ssl.create_default_context()
+ context.set_ciphers("DEFAULT")
+ context.check_hostname = False
+ context.verify_mode = ssl.CERT_NONE
+
return aiohttp.ClientSession(
base_url=base_url,
timeout=aiohttp.ClientTimeout(total=timeout),
- connector=aiohttp.TCPConnector(ssl=False),
+ connector=aiohttp.TCPConnector(ssl=context),
)
also I modified this, but I think, it is not needed: --- /tmp/push.py
+++ /config/custom_components/reolink_rest/push.py
@@ -16,6 +16,7 @@
from xml.etree import ElementTree as et
+import ssl
from aiohttp import ClientSession, TCPConnector, client_exceptions
from aiohttp.web import Request
@@ -277,7 +278,12 @@
async def _send(self, url: str, headers, data):
- async with ClientSession(connector=TCPConnector(verify_ssl=False)) as client:
+ context = ssl.create_default_context()
+ context.set_ciphers("DEFAULT")
+ context.check_hostname = False
+ context.verify_mode = ssl.CERT_NONE
+
+ async with ClientSession(connector=TCPConnector(ssl=context)) as client:
_LOGGER.debug("%s->%r", url, data)
headers.setdefault("content-type", "application/soap+xml;charset=UTF-8")
|
|
the question is, if it is really ALWAYS a good idea, to ignore ssl checks...?! Maybe it would be nice to have a option to ignore or check against /etc/ssl/certs/ like shown on those examples there: https://python.hotexamples.com/examples/ssl/-/create_default_context/python-create_default_context-function-examples.html if cafile:
ctx = ssl.create_default_context(cafile=cafile)
else:
ctx = ssl.create_default_context()
ctx.set_ciphers("DEFAULT")
if not verify:
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE |
|
No, its not. I have a modifed version I am working with that supports setting the more extreme ignores, but realistically, disabling these defeats the purpose of SSL and unless you really need encryption to talk the the camera (i.e. you dont trust your network at all, or you have to expose it directly to the internet) SSL is just extra overhead degrading the cameras performance with little to no benefit. see #23 for my thoughts on SSL and for an example of allowing the SSL |
excuse me for being offtopic, but how is it possible to use and upload own certificates onto the cameras? i'm very much interested in that (method and tools) |
On my Reolink Cam, I go to There are many ways to generate a ssl cert. For me I like to use Xca - but maybe u also like those: OpenSSL, MakeCert, PowerShell - for sure they are more possible ways ;-) But there is a lot background information you should know about - file formats (unencrypted DER/PEM/PK12 - encrypted / container p7b/pfx), key type and strengths, signing algorithm, key usage, trust structures and mush more... there a many things to study :) |
|
just to clarify things, are you still talking about an RLC-410W cam? |
|
Yes my cam is a Reolink RLC-410W - I use the Webinterface - not any App. |
|
ok, than it has to do something with FW, because on v3.0.0.389_21062202 there's no option for that thanx anyway |
I installed the two integrations from HACS (Reolink Discovery and Reolink IP Device), and it discover correctly two cameras. For one (DUO) it seems to work fine, but for the other (RLC-510A), when I click on "Configure", it ask for Host and Port. If I enter the IP of the camera, port 443 and I check https, then I have "Unknown error occurred".
Here is the error I can find:
If I try then to add it manually, I have another error, that seems related to https (SSLv3 handshake failed):
When I try to add the camera manually, I have no error but it is looping on the same screen (as other issue mention).
In any case thanks for you work, it's very valuable ! I would be happy if I can help you to solve this issue :)
The text was updated successfully, but these errors were encountered: