I spend half a day to connect my Eltako ESB64NP-IPM into OpenHab. It wasn’t that straight forward, so maybe someone can benefit from the final solution.
Initial BLE provisioning
Since in my setup openHAB is running in an unprivileged LXC container under Proxmox and does not currently support BLE commissioning in this setup anyway, the Matter device first needs to be commissioned manually using the CHIP Tool (from an environment that has access to Bluetooth and the target network).
An attempt to use NXP’s CHIP Tool Android app failed because the option to “share” the device afterward, in order to add it to openHAB, consistently resulted in an error.
Therefore, we use the CHIP Tool from the Connected Home over IP repository:
git clone --recurse-submodules https://github.com/project-chip/connectedhomeip.git
The repository contains a devcontainer.json that can be used with VS Code and the Dev Containers extension. The devcontainer already mounts the USB devices required for Bluetooth, but it does not appear to mount the D-Bus socket. The D-Bus socket is required for bluetoothctl to work from inside the container. There seem to be also a snap package but I don’t use snap.
I therefore added the following mount to .devcontainer/devcontainer.json:
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 5b57f9aa0d4..0b14bea6f2f 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -18,6 +18,11 @@
"source": "/dev/bus/usb",
"target": "/dev/bus/usb",
"type": "bind"
+ },
+ {
+ "source": "/run/dbus/system_bus_socket",
+ "target": "/run/dbus/system_bus_socket",
+ "type": "bind"
}
],
"initializeCommand": "bash .devcontainer/build.sh",
After cloning the repository and adjusting devcontainer.json, open the folder in VS Code and reopen it in the devcontainer. Build the container using Ctrl+Shift+B.
The build may take some time. Once it has completed, the CHIP Tool should be available under out/default.
Add the Kudelski Matter PAA
To commission Eltako devices, the Kudelski Matter PAA 01 certificate is required. At the time of writing, it is not yet included in the repository.
The PAAs can be retrieved from the CSA Distributed Compliance Ledger (DCL):
curl -s 'https://on.dcl.csa-iot.org/dcl/pki/certificates' -o paa.json
The Kudelski PAA is listed in the returned JSON as follows:
{
"subject": "MCExHzAdBgNVBAMTFkt1ZGVsc2tpIE1hdHRlciBQQUEgMDE=",
"subjectKeyId": "A6:07:C3:60:7B:71:50:E3:62:2A:B0:BA:88:9E:6C:BC:3F:C5:52:F9",
"certs": [
{
"pemCert": "-----BEGIN CERTIFICATE-----\nMIIBqDCCAU6gAwIBAgIQF0rI1t9Ic45LCbMNF4Ig3zAKBggqhkjOPQQDAjAhMR8w\nHQYDVQQDExZLdWRlbHNraSBNYXR0ZXIgUEFBIDAxMCAXDTIzMDEyNTEzMTkyMVoY\nDzk5OTkxMjMxMjM1OTU5WjAhMR8wHQYDVQQDExZLdWRlbHNraSBNYXR0ZXIgUEFB\nIDAxMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwU6lHfS8xzeab2fOJgPCq6o8\n7E/oi4EoNS8ntrPSwVzeuZd/szyjSuuhQez8ivkcUBMwYF+7iAjEvYKMIKEVB6Nm\nMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE\nFKYHw2B7cVDjYiqwuoiebLw/xVL5MB8GA1UdIwQYMBaAFKYHw2B7cVDjYiqwuoie\nbLw/xVL5MAoGCCqGSM49BAMCA0gAMEUCID5hu0qxMVEDtZ46tVZ9cSY1SwuAP4VB\nFvxrqRS8y34sAiEA+fpUqi2nQF5Xk4lJwOPg04W32kBrYMiagfESVLZLqPM=\n-----END CERTIFICATE-----",
"serialNumber": "30960547376434896254114295382079054047",
"issuer": "",
"authorityKeyId": "",
"rootSubject": "",
"rootSubjectKeyId": "",
"isRoot": true,
"owner": "cosmos10y99lgptfnylv28qecpjk7gsexvvcz9s6w4vgu",
"subject": "MCExHzAdBgNVBAMTFkt1ZGVsc2tpIE1hdHRlciBQQUEgMDE=",
"subjectKeyId": "A6:07:C3:60:7B:71:50:E3:62:2A:B0:BA:88:9E:6C:BC:3F:C5:52:F9",
"approvals": [
{
"address": "cosmos10y99lgptfnylv28qecpjk7gsexvvcz9s6w4vgu",
"time": "1674761091",
"info": "CSA proposal for Kudelski Root CA",
"schemaVersion": 0
},
{
"address": "cosmos1wjcn2yv96xllzr24pjpgdqcnq2s9qpg0z9uk8m",
"time": "1674761613",
"info": "Latch",
"schemaVersion": 0
},
{
"address": "cosmos1r4536sk78smtaeu6xnky2pdgm3z4kdjncv9mk6",
"time": "1674762161",
"info": "Approval from Samsung",
"schemaVersion": 0
}
],
"subjectAsText": "CN=Kudelski Matter PAA 01",
"rejects": [],
"vid": 5406,
"certificateType": "DeviceAttestationPKI",
"schemaVersion": 0
}
],
"schemaVersion": 0
},
Extract the pemCert value and save it as:
nano credentials/production/paa-root-certs/Kudelski-Matter-PAA-01-Cert.pem
The file should contain only the PEM certificate:
-----BEGIN CERTIFICATE-----
MIIBqDCCAU6gAwIBAgIQF0rI1t9Ic45LCbMNF4Ig3zAKBggqhkjOPQQDAjAhMR8w
HQYDVQQDExZLdWRlbHNraSBNYXR0ZXIgUEFBIDAxMCAXDTIzMDEyNTEzMTkyMVoY
Dzk5OTkxMjMxMjM1OTU5WjAhMR8wHQYDVQQDExZLdWRlbHNraSBNYXR0ZXIgUEFB
IDAxMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwU6lHfS8xzeab2fOJgPCq6o8
7E/oi4EoNS8ntrPSwVzeuZd/szyjSuuhQez8ivkcUBMwYF+7iAjEvYKMIKEVB6Nm
MGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
FKYHw2B7cVDjYiqwuoiebLw/xVL5MB8GA1UdIwQYMBaAFKYHw2B7cVDjYiqwuoie
bLw/xVL5MAoGCCqGSM49BAMCA0gAMEUCID5hu0qxMVEDtZ46tVZ9cSY1SwuAP4VB
FvxrqRS8y34sAiEA+fpUqi2nQF5Xk4lJwOPg04W32kBrYMiagfESVLZLqPM=
-----END CERTIFICATE-----
Extract the setup PIN and discriminator
For commissioning, the setup PIN (passcode) and discriminator contained in the Matter device’s QR code are required.
After scanning the QR code and extracting its contents, you should get a string similar to:
MT:XXXXXXXXXXXXXXXXXXX
Use the following command to decode the setup payload:
./chip-tool payload parse-setup-payload 'MT:XXXXXXXXXXXXXXXXXXX'
This should produce output similar to:
[SPL] Version: 0
[SPL] VendorID: 4932
[SPL] ProductID: 1104
[SPL] Custom flow: 0 (STANDARD)
[SPL] Discovery Bitmask: 0x06 (BLE, On IP network)
[SPL] Long discriminator: 1874 (0x752)
[SPL] Passcode: 1234567
The value shown as Passcode is the setup PIN. The value shown as Long discriminator is the discriminator.
Commission the device using Bluetooth
First, make sure that Bluetooth is available from inside the devcontainer:
bluetoothctl list
The command should return something similar to:
Controller F2:D3:12:47:8B:A8 linux-machine [default]
The device can now be commissioned over Bluetooth, assuming the Eltako device is still in its factory-default state.
Replace WLANSSID, WLANPASSWORD, 1234567, and 1874 with the values appropriate for your device:
out/default/chip-tool pairing ble-wifi 1 "WLANSSID" "WLANPASSWORD" 1234567 1874 --ble-controller 0 --paa-trust-store-path credentials/production/paa-root-certs
After commissioning has completed, I waited approximately 30 seconds and then power-cycled the Eltako device. It is unclear whether the power cycle is actually necessary, but after doing so the device appeared in the Wi-Fi network. With a second actor it already appeared in the local Wi-Fi without the reboot, so it’s probably not needed.
Add the device to openHAB
At this point, the Eltako device is commissioned to the CHIP Tool’s Matter fabric.
Since openHAB is not yet part of the device’s Matter fabric, the openHAB Matter Controller cannot be used to generate a new pairing code at this point. Instead, the CHIP Tool must be used to open a new commissioning window on the already-commissioned device.
This allows a second Matter fabric, in this case the openHAB Matter Controller, to be added to the device.
First, install the Matter binding in openHAB and create a Matter Controller Thing if not already done so in the past.
Then, use the CHIP Tool to open a new commissioning window:
./chip-tool pairing open-commissioning-window 1 1 300 1000 1874
The parameters are:
- 1 — the Eltako device’s CHIP Tool node ID.
- 1 — Enhanced Commissioning Method.
- 300 — the commissioning window remains open for 300 seconds.
- 1000 — the PBKDF iteration count.
- 1874 — the original discriminator obtained from the Eltako device’s QR code.
The CHIP Tool will print a new pairing code and QR code. Look for output similar to:
[CTL] Manual pairing code: [1234567890]
[CTL] SetupQRCode: [MT:XXXXXXXXXXXXXXXX.XX]
Within the 300-second commissioning window, enter the generated pairing code in the Matter Controller in openHAB.
I used the complete MT:XXXXXXXXXXXXXXXX.XX string as the pairing code, and commissioning succeeded. The manual pairing code should work as well, although I did not test it.
The device is now commissioned to both the CHIP Tool fabric and the openHAB fabric.
Remove the CHIP Tool fabric
Once the device is working correctly in openHAB, the CHIP Tool fabric is no longer required and can be removed.
The connected Matter fabrics can be listed from the openHAB UI. Use the Matter node’s List Connected Matter Fabrics action to identify the CHIP Tool fabric, and then use Remove Connected Matter Fabric to remove it.
After removing the CHIP Tool fabric, the device remains commissioned to the openHAB Matter fabric.