# iCloud SSL issue again

**URL:** <https://community.openhab.org/t/icloud-ssl-issue-again/79182>\
**Category:** myopenHAB\
**Created:** [August 3, 2019, 1:24am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182 "2019-08-03T01:24:47Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![idkpmiller](https://community.openhab.org/user_avatar/community.openhab.org/idkpmiller/32/56280_2.png) [@idkpmiller](https://community.openhab.org/u/idkpmiller)\
**Post date:** [August 3, 2019, 1:24am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/1 "2019-08-03T01:24:47Z")

</div>

Hi all, been a while since this SSL Engine issue for iCloud I tried the solution from the 2018 thread and followed up with a openhab restart but still having issues.

LOG

```csv
2019-08-03 13:17:49.351 [WARN] [l.handler.ICloudAccountBridgeHandler] - Unable to refresh device data
java.io.IOException: java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
	at org.eclipse.smarthome.io.net.http.HttpUtil.executeUrlAndGetReponse(HttpUtil.java:259) ~[?:?]
	at org.eclipse.smarthome.io.net.http.HttpUtil.executeUrl(HttpUtil.java:156) ~[?:?]
	at org.eclipse.smarthome.io.net.http.HttpUtil.executeUrl(HttpUtil.java:131) ~[?:?]
	at org.eclipse.smarthome.io.net.http.HttpRequestBuilder.getContentAsString(HttpRequestBuilder.java:135) ~[?:?]
	at org.openhab.binding.icloud.internal.ICloudConnection.callApi(ICloudConnection.java:84) ~[?:?]
	at org.openhab.binding.icloud.internal.ICloudConnection.requestDeviceStatusJSON(ICloudConnection.java:65) ~[?:?]
	at org.openhab.binding.icloud.internal.handler.ICloudAccountBridgeHandler.lambda$0(ICloudAccountBridgeHandler.java:84) ~[?:?]
	at org.eclipse.smarthome.core.cache.ExpiringCache.refreshValue(ExpiringCache.java:97) ~[?:?]
	at org.eclipse.smarthome.core.cache.ExpiringCache.getValue(ExpiringCache.java:68) ~[?:?]
	at org.openhab.binding.icloud.internal.handler.ICloudAccountBridgeHandler.refreshData(ICloudAccountBridgeHandler.java:141) ~[?:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:?]
	at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:?]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:?]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:?]
	at java.lang.Thread.run(Thread.java:748) [?:?]
Caused by: java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
	at org.eclipse.jetty.client.util.FutureResponseListener.getResult(FutureResponseListener.java:118) ~[?:?]
	at org.eclipse.jetty.client.util.FutureResponseListener.get(FutureResponseListener.java:101) ~[?:?]
	at org.eclipse.jetty.client.HttpRequest.send(HttpRequest.java:684) ~[?:?]
	at org.eclipse.smarthome.io.net.http.HttpUtil.executeUrlAndGetReponse(HttpUtil.java:250) ~[?:?]
	... 16 more
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
	at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1521) ~[?:?]
	at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:528) ~[?:?]
	at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:802) ~[?:?]
	at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:766) ~[?:?]
	at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:681) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.process(HttpReceiverOverHTTP.java:128) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.receive(HttpReceiverOverHTTP.java:73) ~[?:?]
	at org.eclipse.jetty.client.http.HttpChannelOverHTTP.receive(HttpChannelOverHTTP.java:133) ~[?:?]
	at org.eclipse.jetty.client.http.HttpConnectionOverHTTP.onFillable(HttpConnectionOverHTTP.java:155) ~[?:?]
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:291) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:151) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) ~[?:?]
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:762) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:680) ~[?:?]
	... 1 more
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
	at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[?:?]
	at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1709) ~[?:?]
	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:318) ~[?:?]
	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310) ~[?:?]
	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639) ~[?:?]
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) ~[?:?]
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:?]
	at java.security.AccessController.doPrivileged(Native Method) ~[?:?]
	at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:775) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.process(HttpReceiverOverHTTP.java:128) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.receive(HttpReceiverOverHTTP.java:73) ~[?:?]
	at org.eclipse.jetty.client.http.HttpChannelOverHTTP.receive(HttpChannelOverHTTP.java:133) ~[?:?]
	at org.eclipse.jetty.client.http.HttpConnectionOverHTTP.onFillable(HttpConnectionOverHTTP.java:155) ~[?:?]
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:291) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:151) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) ~[?:?]
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:762) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:680) ~[?:?]
	... 1 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397) ~[?:?]
	at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) ~[?:?]
	at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?]
	at org.eclipse.smarthome.io.net.http.internal.ExtensibleTrustManager.checkServerTrusted(ExtensibleTrustManager.java:120) ~[?:?]
	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1626) ~[?:?]
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) ~[?:?]
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:?]
	at java.security.AccessController.doPrivileged(Native Method) ~[?:?]
	at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:775) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.process(HttpReceiverOverHTTP.java:128) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.receive(HttpReceiverOverHTTP.java:73) ~[?:?]
	at org.eclipse.jetty.client.http.HttpChannelOverHTTP.receive(HttpChannelOverHTTP.java:133) ~[?:?]
	at org.eclipse.jetty.client.http.HttpConnectionOverHTTP.onFillable(HttpConnectionOverHTTP.java:155) ~[?:?]
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:291) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:151) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) ~[?:?]
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:762) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:680) ~[?:?]
	... 1 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) ~[?:?]
	at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) ~[?:?]
	at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ~[?:?]
	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392) ~[?:?]
	at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) ~[?:?]
	at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?]
	at org.eclipse.smarthome.io.net.http.internal.ExtensibleTrustManager.checkServerTrusted(ExtensibleTrustManager.java:120) ~[?:?]
	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1626) ~[?:?]
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) ~[?:?]
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:?]
	at java.security.AccessController.doPrivileged(Native Method) ~[?:?]
	at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:775) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.process(HttpReceiverOverHTTP.java:128) ~[?:?]
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.receive(HttpReceiverOverHTTP.java:73) ~[?:?]
	at org.eclipse.jetty.client.http.HttpChannelOverHTTP.receive(HttpChannelOverHTTP.java:133) ~[?:?]
	at org.eclipse.jetty.client.http.HttpConnectionOverHTTP.onFillable(HttpConnectionOverHTTP.java:155) ~[?:?]
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:291) ~[?:?]
	at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:151) ~[?:?]
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102) ~[?:?]
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) ~[?:?]
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) ~[?:?]
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:762) ~[?:?]
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:680) ~[?:?]
	... 1 more

```

I thought this had been fixed in a binding update, so guess its a slightly different issue.

Regards

Paul

---

<div class="post-metadata">

**Author:** ![Chri46](https://community.openhab.org/letter_avatar_proxy/v4/letter/c/f08c70/32.png) [@Chri46](https://community.openhab.org/u/Chri46)\
**Post date:** [August 3, 2019, 8:21am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/2 "2019-08-03T08:21:18Z")

</div>

Same here  
Updating certificates, which worked before did not solve the issue:  
[https://community.openhab.org/t/icloud-binding-general-sslengine-problem/48314/27](https://community.openhab.org/t/icloud-binding-general-sslengine-problem/48314/27)

---

<div class="post-metadata">

**Author:** ![MechD](https://community.openhab.org/user_avatar/community.openhab.org/mechd/32/34839_2.png) [@MechD](https://community.openhab.org/u/MechD)\
**Post date:** [August 3, 2019, 4:01pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/3 "2019-08-03T16:01:44Z")

</div>

Same issue icloud worked up until last night. Tried to restart openHAB but no luck:(

---

<div class="post-metadata">

**Author:** ![John\_Siemon](https://community.openhab.org/user_avatar/community.openhab.org/john_siemon/32/36687_2.png) [@John\_Siemon](https://community.openhab.org/u/John_Siemon)\
**Post date:** [August 3, 2019, 4:09pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/4 "2019-08-03T16:09:18Z")

</div>

+1 here

---

<div class="post-metadata">

**Author:** ![Maurits28](https://community.openhab.org/user_avatar/community.openhab.org/maurits28/32/5925_2.png) [@Maurits28](https://community.openhab.org/u/Maurits28)\
**Post date:** [August 3, 2019, 4:17pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/5 "2019-08-03T16:17:03Z")

</div>

+1 here

---

<div class="post-metadata">

**Author:** ![TeKilla](https://community.openhab.org/user_avatar/community.openhab.org/tekilla/32/73908_2.png) [@TeKilla](https://community.openhab.org/u/TeKilla)\
**Post date:** [August 3, 2019, 6:13pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/6 "2019-08-03T18:13:53Z")

</div>

+1 here

---

<div class="post-metadata">

**Author:** ![rkrisi](https://community.openhab.org/user_avatar/community.openhab.org/rkrisi/32/68680_2.png) [@rkrisi](https://community.openhab.org/u/rkrisi)\
**Post date:** [August 3, 2019, 8:35pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/7 "2019-08-03T20:35:13Z")

</div>

Did you tried to reboot your server? I have deleted the keys and added the new ones, I will try to restart the server fully.

---

<div class="post-metadata">

**Author:** ![MechD](https://community.openhab.org/user_avatar/community.openhab.org/mechd/32/34839_2.png) [@MechD](https://community.openhab.org/u/MechD)\
**Post date:** [August 3, 2019, 11:29pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/8 "2019-08-03T23:29:42Z")

</div>

Welcome aboard Martin!

---

<div class="post-metadata">

**Author:** ![dk8pn](https://community.openhab.org/user_avatar/community.openhab.org/dk8pn/32/190605_2.png) [@dk8pn](https://community.openhab.org/u/dk8pn)\
**Post date:** [August 4, 2019, 1:00pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/9 "2019-08-04T13:00:52Z")

</div>

Same here. Any news how to resolve this?

---

<div class="post-metadata">

**Author:** ![dan12345](https://community.openhab.org/letter_avatar_proxy/v4/letter/d/c0e974/32.png) [@dan12345](https://community.openhab.org/u/dan12345)\
**Post date:** [August 4, 2019, 6:08pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/10 "2019-08-04T18:08:09Z")

</div>

And me too…

---

<div class="post-metadata">

**Author:** ![frankie.delure](https://community.openhab.org/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@frankie.delure](https://community.openhab.org/u/frankie.delure)\
**Post date:** [August 5, 2019, 8:30am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/11 "2019-08-05T08:30:54Z")

</div>

+1 here

---

<div class="post-metadata">

**Author:** ![ggriesse](https://community.openhab.org/user_avatar/community.openhab.org/ggriesse/32/18740_2.png) [@ggriesse](https://community.openhab.org/u/ggriesse)\
**Post date:** [August 5, 2019, 9:29am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/12 "2019-08-05T09:29:06Z")

</div>

+1 tried the Cert fix as per older posts .. tried reboot , tried cache clear .. No luck

cloud:account:1e07160a’ changed from INITIALIZING to OFFLINE (COMMUNICATION\_ERROR): java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: General SSLEngine problem

---

<div class="post-metadata">

**Author:** ![dk8pn](https://community.openhab.org/user_avatar/community.openhab.org/dk8pn/32/190605_2.png) [@dk8pn](https://community.openhab.org/u/dk8pn)\
**Post date:** [August 5, 2019, 10:28am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/13 "2019-08-05T10:28:02Z")

</div>

Saw some Apple News that they are going to restrict the API Access using self confirmed certificates. Don’t know if this has something to do with the issue?

---

<div class="post-metadata">

**Author:** ![wsd33904](https://community.openhab.org/letter_avatar_proxy/v4/letter/w/6a8cbe/32.png) [@wsd33904](https://community.openhab.org/u/wsd33904)\
**Post date:** [August 6, 2019, 11:05am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/14 "2019-08-06T11:05:40Z")

</div>

+1 It looks like the reason the previous change broke is because Apple again changed the certificates that they used…

I tried running some debugging steps (namely, using SSLPoke as suggested in [Icloud binding - General SSLEngine problem - #27 by The-Elk](https://community.openhab.org/t/icloud-binding-general-sslengine-problem/48314/27)), and the SSL certificate authenticates successfully in SSLPoke, but for some reason it fails in openHAB. Still trying to find diffs in the logs when `-Djavax.net.debug=ssl` is enabled…

---

<div class="post-metadata">

**Author:** ![frankie.delure](https://community.openhab.org/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@frankie.delure](https://community.openhab.org/u/frankie.delure)\
**Post date:** [August 6, 2019, 11:26am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/15 "2019-08-06T11:26:12Z")

</div>

For anybody who has built up a presence detection like me based on this iCloud Binding: You should consider switching to homebridge.

Pros: Much more reliable in terms of accuracy and speed (push instead of pull by the binding), easier profile / device management, no false alarms anymore  
Cons: Needs additional hardware like Apple TV

---

<div class="post-metadata">

**Author:** ![ramon2k10](https://community.openhab.org/user_avatar/community.openhab.org/ramon2k10/32/41165_2.png) [@ramon2k10](https://community.openhab.org/u/ramon2k10)\
**Post date:** [August 6, 2019, 12:39pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/16 "2019-08-06T12:39:50Z")

</div>

Hi, sounds very interesting. Would you give me some tips of how you do it? Thanks  
!

---

<div class="post-metadata">

**Author:** ![frankie.delure](https://community.openhab.org/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@frankie.delure](https://community.openhab.org/u/frankie.delure)\
**Post date:** [August 6, 2019, 3:38pm UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/17 "2019-08-06T15:38:47Z")

</div>

Please have a look at: [HomeKit holy grail: homebridge-openhab2-complete](https://community.openhab.org/t/homekit-holy-grail-homebridge-openhab2-complete/66167) and then use the iOS Home app to set up workflows for your virtual switches that indicate home presence. I added my whole family which was with the openHAB iCloud binding always a little tricky.

The iCloud binding just pulls the location every 10 minutes. The iOS app probably uses the chip that Apple has designed in order to constantly have an accurate location without having to use the battery draining GPS chip. With the accurate iOS location I do not have the issue anymore that within the 10 minutes period my virtual presence switch is still showing an outdated location (not at home when I am already in).

Forget to mention in the previous post that without the iCloud Binding I am currently not able to calculate the distance from home as the homebridge just offers home / not at home. This is definitely a con-argument although I can live with it as long as the binding is not working.

---

<div class="post-metadata">

**Author:** ![wsd33904](https://community.openhab.org/letter_avatar_proxy/v4/letter/w/6a8cbe/32.png) [@wsd33904](https://community.openhab.org/u/wsd33904)\
**Post date:** [August 7, 2019, 7:17am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/18 "2019-08-07T07:17:40Z")

</div>

I looked more into this after my previous post, and I think I have a decent theory as to what’s happening.

In between the last time the certificate broke and now (more specifically, November 2018), @martinvw authored a change to the iCloud binding (see the [Github commit](https://github.com/Hilbrand/openhab2-addons/commit/0d73297a48f0a52ab0fe9a44c89d97d87f0286d5)) that forces the use of its own certificate for `fmipmobile.icloud.com` checked into the binding’s resource, _regardless_ of what the user has installed on their system. To be more specific, it uses the `TrustManager` provided by the Eclipse SmartHome Java package, and that logic _overrides_ all certificates that may have been found in the system (at least that’s my theory according to [the logic](https://github.com/openhab/openhab-core/blob/48d873a32ba0901a9b58f04c541f0f858fbfcd51/bundles/org.openhab.core.io.net/src/main/java/org/eclipse/smarthome/io/net/http/internal/ExtensibleTrustManagerImpl.java#L121)).

To test my theory, does anyone know if there’s an easy way to reach into the binding JAR and change that resource? I feel like the only way is to actually download the binding’s source code, change the `crt`, recompile the whole `.jar`, uninstall the iCloud binding, and reinstall it based off of this custom `.jar`.

---

<div class="post-metadata">

**Author:** ![martinvw](https://community.openhab.org/user_avatar/community.openhab.org/martinvw/32/71288_2.png) [@martinvw](https://community.openhab.org/u/martinvw)\
**Post date:** [August 7, 2019, 8:25am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/19 "2019-08-07T08:25:11Z")

</div>

That sounds correct, I’m currently on holiday so cannot yet help. I’ll be able to provide a version without the certificates in two days.

---

<div class="post-metadata">

**Author:** ![wsd33904](https://community.openhab.org/letter_avatar_proxy/v4/letter/w/6a8cbe/32.png) [@wsd33904](https://community.openhab.org/u/wsd33904)\
**Post date:** [August 7, 2019, 8:26am UTC](https://community.openhab.org/t/icloud-ssl-issue-again/79182/20 "2019-08-07T08:26:43Z")

</div>

I can confirm that my theory was correct. I was able to get the iCloud binding working by replacing the `fmipmobile.crt` file contained [in the add-on folder](https://github.com/openhab/openhab2-addons/tree/master/bundles/org.openhab.binding.icloud/src/main/resources), recompiling the iCloud binding, and installing that as an add-on. For those interested, here is a step-by-step:

1. Uninstall the iCloud Binding from the PaperUI. None of my Things disappeared after doing this step, so you should be fine as well.
2. Go to [my GitHub fork](https://github.com/mauryquijada/openhab2-addons) and follow the instructions in the README to build the iCloud binding. My fork contains the updated iCloud certificate to use.
3. Grab the built `jar` and put it in the appropriate add-on folder on your openHAB instance (perhaps using `scp`). For most of you all, this will be `/usr/share/openhab2/addons/`.
4. Open Karaf and run the command:

```auto
bundle:install http://central.maven.org/maven2/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar

```

Gson is an iCloud binding dependency that you must install manually because you are installing the binding as an add-on (as opposed to having openHAB install it for you).

1. Also in Karaf, run

```auto
bundle:list

```

to get a list of your bindings. Find the START ID (first column) for the iCloud binding. Then, run

```auto
bundle:start <START ID>

```

If you run `bundle:list` again, you should see that the state of the iCloud binding changed from “Installed” to “Active”.

1. Go back to PaperUI to check whether your iCloud Things are now online!

I submitted a pull request to the openHAB2 add-ons to get this fixed, but I have no idea how long it’d take to get out to users. Also, I strongly suspect that we are going to run into this problem again 12 months from now, since the certificate in my GitHub fork expires on “Sun Aug 23 08:45:49 PDT 2020”, so I really think that the owners of the binding should re-consider checking this certificate into the binding…

[Next page](https://community.openhab.org/t/icloud-ssl-issue-again/79182.md?page=2)