Why does my binding for Fritz!Box not work with HTTPS?

[phil816 (Philipp)]

I just installed a Raspberry Pi with the latest version of openHABian & openHAB 2.4.0. together with AVM FRITZ!Box Binding and connected my Fritz!Box successfully.

In the thing configuration of the Fritz!Box I chose the protocol HTTP to establish the connection between openHAB and Fritz!Box. I would like to change it to use HTTPS instead. But when I change the connection from HTTP to HTTPS it does not work any longer. This is a screenshot of the log:

My things configuration looks like this:

The Pi and the Fritz!Box are directly wired through a LAN cable.

I can reach the web frontend of the Fritz!Box in the browser without any problem by using this URL: https://fritz.box:8443/

Does anybody know what is missing? Do I need to tell the Pi to trust my certificate? If yes, how?

[cweitkamp (Christoph Weitkamp)]

Yes, the reason is the certificate. I am afraid you cannot use HTTPS locally. Only in combination with MyFRITZ! Service for remote access. Currently there is no “trust all” button in the framework. It would be possible to implement an own TrustManager for the binding but each FRITZ!Box provides its own certificate - either self-signed or from Let’s encrypt - the openHAB user would have to upload it somewhere. That is a little bit tricky.

[phil816 (Philipp)]

Ok. Thanks for clarification.

[Nuesel (Daniel)]

I have a similar issue here:

FritzBox SSL communication

By the way, the operating system (Ubuntu) is able to create a trusted SSL connection: openssl s_client -connect myfritzbox.domain:.443 -> Verify return code: 0 (ok) I also added my CA to /var/lib/openhab2/etc/keystore. I’m not sure, if this is the correct place for storing it. But due to my limited knowledge in Java, I don’t have any idea where else to put this CA. Similar issue here:

[cweitkamp (Christoph Weitkamp)]

A new post in an old thread rised my attention again. I submitted a fix for it:

[avmfritz] Added 'TlsTrustManagerProvider' / 'TrustAllTrustMananger' for hostname 'fritz.box'

[Nuesel (Daniel)]

Due to the lack of my java knowledge, the problem wasn’t clear to me, but the solution is quite easy:

FritzBox SSL communication

Okay, the solution is quite obviously: sudo keytool -importcert -alias my_ca_alias -keystore /usr/lib/jvm/zulu-8-amd64/jre/lib/security/cacerts -file myca.crt The default password is “changeit”. This works for a zulu implementation of java. For Oracle java the path is very similar, dependent on the java home directory. Thank you.

Thank you!