iCloud SSL issue again

For anybody who has built up a presence detection like me based on this iCloud Binding: You should consider switching to homebridge.

Pros: Much more reliable in terms of accuracy and speed (push instead of pull by the binding), easier profile / device management, no false alarms anymore
Cons: Needs additional hardware like Apple TV

Hi, sounds very interesting. Would you give me some tips of how you do it? Thanks

Please have a look at: HomeKit holy grail: homebridge-openhab2-complete and then use the iOS Home app to set up workflows for your virtual switches that indicate home presence. I added my whole family which was with the openHAB iCloud binding always a little tricky.

The iCloud binding just pulls the location every 10 minutes. The iOS app probably uses the chip that Apple has designed in order to constantly have an accurate location without having to use the battery draining GPS chip. With the accurate iOS location I do not have the issue anymore that within the 10 minutes period my virtual presence switch is still showing an outdated location (not at home when I am already in).

Forget to mention in the previous post that without the iCloud Binding I am currently not able to calculate the distance from home as the homebridge just offers home / not at home. This is definitely a con-argument although I can live with it as long as the binding is not working.

1 Like

I looked more into this after my previous post, and I think I have a decent theory as to what’s happening.

In between the last time the certificate broke and now (more specifically, November 2018), @martinvw authored a change to the iCloud binding (see the Github commit) that forces the use of its own certificate for fmipmobile.icloud.com checked into the binding’s resource, regardless of what the user has installed on their system. To be more specific, it uses the TrustManager provided by the Eclipse SmartHome Java package, and that logic overrides all certificates that may have been found in the system (at least that’s my theory according to the logic).

To test my theory, does anyone know if there’s an easy way to reach into the binding JAR and change that resource? I feel like the only way is to actually download the binding’s source code, change the crt, recompile the whole .jar, uninstall the iCloud binding, and reinstall it based off of this custom .jar.

That sounds correct, I’m currently on holiday so cannot yet help. I’ll be able to provide a version without the certificates in two days.

1 Like

I can confirm that my theory was correct. I was able to get the iCloud binding working by replacing the fmipmobile.crt file contained in the add-on folder, recompiling the iCloud binding, and installing that as an add-on. For those interested, here is a step-by-step:

  1. Uninstall the iCloud Binding from the PaperUI. None of my Things disappeared after doing this step, so you should be fine as well.
  2. Go to my GitHub fork and follow the instructions in the README to build the iCloud binding. My fork contains the updated iCloud certificate to use.
  3. Grab the built jar and put it in the appropriate add-on folder on your openHAB instance (perhaps using scp). For most of you all, this will be /usr/share/openhab2/addons/.
  4. Open Karaf and run the command:
bundle:install http://central.maven.org/maven2/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar

Gson is an iCloud binding dependency that you must install manually because you are installing the binding as an add-on (as opposed to having openHAB install it for you).

  1. Also in Karaf, run

to get a list of your bindings. Find the START ID (first column) for the iCloud binding. Then, run

bundle:start <START ID>

If you run bundle:list again, you should see that the state of the iCloud binding changed from “Installed” to “Active”.

  1. Go back to PaperUI to check whether your iCloud Things are now online!

I submitted a pull request to the openHAB2 add-ons to get this fixed, but I have no idea how long it’d take to get out to users. Also, I strongly suspect that we are going to run into this problem again 12 months from now, since the certificate in my GitHub fork expires on “Sun Aug 23 08:45:49 PDT 2020”, so I really think that the owners of the binding should re-consider checking this certificate into the binding…


Please do so - I would like to avoid the hustle of building my own .jar

Nice catch and KUDOS - had the same suspicion, but not enough coding skills to fix it myself

Ok guys,

i think i have a quick dirty solution that works for my installation (windows)

Now the Things will go online (for another year) :wink:



Congratulations friend, I followed your procedure worked perfectly on linux, just did a different step, edited the .jar file directly with the editor vim linux, now it’s all online, thank you for your cooperation.

I get the following ERROR LOG:

2019-08-08 09:45:41.645 [ERROR] [org.apache.felix.fileinstall        ] - Failed to install artifact: /usr/share/openhab2/addons/org.openhab.binding.icloud-2.5.0-SNAPSHOT.jar
org.osgi.framework.BundleException: The bundle file:/usr/share/openhab2/addons/org.openhab.binding.icloud-2.5.0-SNAPSHOT.jar does not have a META-INF/MANIFEST.MF! Make sure, META-INF and MANIFEST.MF are the first 2 entries in your JAR!
	at org.apache.felix.fileinstall.internal.DirectoryWatcher.installOrUpdateBundle(DirectoryWatcher.java:1005) [10:org.apache.felix.fileinstall:3.6.4]
	at org.apache.felix.fileinstall.internal.DirectoryWatcher.install(DirectoryWatcher.java:963) [10:org.apache.felix.fileinstall:3.6.4]
	at org.apache.felix.fileinstall.internal.DirectoryWatcher.install(DirectoryWatcher.java:884) [10:org.apache.felix.fileinstall:3.6.4]
	at org.apache.felix.fileinstall.internal.DirectoryWatcher.doProcess(DirectoryWatcher.java:489) [10:org.apache.felix.fileinstall:3.6.4]
	at org.apache.felix.fileinstall.internal.DirectoryWatcher.process(DirectoryWatcher.java:365) [10:org.apache.felix.fileinstall:3.6.4]
	at org.apache.felix.fileinstall.internal.DirectoryWatcher.run(DirectoryWatcher.java:316) [10:org.apache.felix.fileinstall:3.6.4]

Do you have any ideas?


I solved it by editing the JAR file with 7Zip and replace the certificate lines in the JAR file direct.

Thanks RalphSester,

i was able to get the bindung up and running. There seems to be no error in logs. The discovery delivered all my iCloud devices. I can create items for all my devices channels but there is no data recieved. Battery state etc. show all NaN.

Any idea what went wrong?



after starting openhab cli console and running a bundle:restart <id of iCloudBundle> all information showed up.

Don’t know why.


1 Like

Perfect worked like a charm … i also just edited the Jar with VIM

Hi Q
can i find the installed jar on my machine
or it is mandtory to download ?

same thing here neede to restart the bundle

Also need bundle:restart but now back alive :slight_smile:


I see that a PR to fix this had already been merged so snapshot users should already be fine, I think non snapshot users should be able to update the iCloud binding to the snapshot version, can someone who is not on mobile (on the backseat of a car) provide some steps for this :blush:

How does one update to this snapshot? Just remove the current binding and then drop the snapshot into the addons folder?

correct. Maybe you need to restart the bundle afterewards (openhab console -> bundle:restart