Icloud binding - General SSLEngine problem

#5

Same here… :frowning:

#6

and here!

#7

Looks like we have 3 thread to the same issue.
-> Sysinfo-Binding in OH2

#8

When you browse to fmipmobile.icloud.com you will find: “Http/1.1 Service Unavailable”. So maybe it is not an Openhab issue but an Apple issue?

#9

And here Openhab 2.3 STABLE since 30 Jan 2018. iCloud Binding failed 16 July 2018.

iCloud binding PKIX path building failed
#10

I think the easiest and quickest fix would be to disable certificate checking in the binding or add apple’s root certificate to the certificate store of your java environment.

If someone could elaborate on that it would be great :slight_smile: If really no one can I will try to give it a go tonight.

1 Like
#11

Thanks @martinvw

#12

added apple cert to java cert store already.
as stated further before:

SSLPoke of icloud.com is just fine:

pi@openhab:~ $ java SSLPoke icloud.com 443
Successfully connected

If something is wrong with the certificates in java environment that SSLPoke to icloud.com should fail in the same way as for:

“SSLpoking” fmipmobile.icloud.com:


pi@openhab:~ $ java SSLPoke fmipmobile.icloud.com 443
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
	at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
	at sun.security.validator.Validator.validate(Validator.java:262)
	at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
	at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
	at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
	at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:757)
	at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
	at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:138)
	at SSLPoke.main(SSLPoke.java:31)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
	at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
	at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
	... 15 more
pi@openhab:~ $
#13

I added the cert to my keystore too in the moment I checked the url with a browser and thought it might be a fault on apple´s side.

IF the keystore for openhabian is right at “var/lib/openhab2/etc/keystore” it should be imported.

But the exception stays.


echo -n | openssl s_client -connect fmipmobile.icloud.com:443 -prexit 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/icloud2.crt


sudo keytool -importcert -file /tmp/icloud2.crt -alias icloudfmi -keystore /var/lib/openhab2/etc/keystore -storepass openhab

for the ones who want to try and fail aswell but could be a start for @martinvw

#14

tcpdump:

tcpdump
tcpdump.png1670×790 187 KB

rename the file to *.pcap
cert_failure.pdf (6.4 KB)

#15

Same issue here, no change at my end just started around two days ago.

#16

should inserted in java cacert store, but still does not do the trick:

sudo $JAVA_HOME/bin/keytool -import -keystore $JAVA_HOME/jre/lib/security/cacerts -alias icloud2-Root-CA -file /tmp/icloud2.crt
#17

Hi all,

no details, as I am writing using the phone - but I was able to get it working again by importing both certificates … will post a how to from my computer tomorrow …

regards,
Patrik

#18

Indeed, that is similar to what I read on other places somehow the whole chain is needed is most cases.

I started using the way described by @apfelflo89, it looks good but the troubles that are multiple hosts behind the single ip, so a servername param has to be passed then its more easy, I first got the *.icloud.com certificate of the openssl command which was not the one we actually got when running.

echo -n | openssl s_client -servername fmipmobile.icloud.com -host fmipmobile.icloud.com -port 443 -prexit -showcerts 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/icloud2.crt
cd /tmp

csplit -f cert /tmp/icloud2.crt '/^-----BEGIN CERTIFICATE-----/' {*}

// back to java dir, in my case /usr/lib/java-8
bin/keytool -importcert -file /tmp/cert01 -alias icloudfmi1 -trustcacerts -keystore ./jre/lib/security/cacerts -storepass changeit
bin/keytool -importcert -file /tmp/cert02 -alias icloudfmi2 -trustcacerts -keystore ./jre/lib/security/cacerts -storepass changeit

My account is now online, and after forcing a refresh by updating my accounts my devices came online as well. Thanks for the fragments of tips and tricks and good luck solving it locally.

8 Likes
#19

Thanks for the summary martinvw, worked great for me!

#20

Thanks for the tutorial @martinvw

#21

I´m back online too, thanks for looking in to it!

Did you find information about how long the certificate will be valid?

#22

Great work! Any ideas on how to achieve this on a windows installation of openHAB?

#23

How is the right DIR for openhabian?
How is the solution for openhabian users?

THX

Stefan

#24

The dir is:
/usr/lib/jvm/zulu-embedded-8-armhf
The rest is the same. I only had to reboot.