OpenSSL3 config option not allowing unsafe legacy renegotiation

[Alazoral]

After upgrading Node.js (via upgrading the Homebridge docker image) the plugin can't seem to connect to the AC any more. Adding OpenSSL3 in to the config hasn't helped. This is my config:

        {
            "name": "Daikin",
            "apiroute": "https://192.168.20.10",
            "temperature_unit": "C",
            "uuid": "my-uuid-here",
            "system": "Default",
            "swingMode": "1",
            "disableFan": false,
            "fanMode": "FAN",
            "fanPowerMode": "FAN only",
            "fanName": "Daikin Fan",
            "defaultMode": "1",
            "enableHumiditySensor": false,
            "enableTemperatureSensor": true,
            "response": 2000,
            "deadline": 60000,
            "retries": 5,
            "accessory": "Daikin-Local",
            "OpenSSL3": true
        }

Error:

_doSendGetRequest: ERROR: API request to https://192.168.20.10/aircon/get_control_info returned error Error: write EPROTO C0B71504FD7E0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:../deps/openssl/openssl/ssl/statem/extensions.c:922:

    at WriteWrap.onWriteComplete [as oncomplete] (node:internal/stream_base_commons:94:16) {
  errno: -71,
  code: 'EPROTO',
  syscall: 'write',
  response: undefined,
  retries: 0
}

Thanks so much for your assistance, when it was working this plugin was incredibly useful and I hugely admire the work you folks do.

[cbrandlehner]

Responding to let you know that I have no device to test this. So I have no way to debug or test this issue.

I am hoping someone in the community will take the lead and submit a proposed solution, as we successfully did with the initial OpenSSL patch.

[woodgieboodgie]

is there anything I can do to assist? happy to co-ordinate remote access if needed, or logs..

[Alazoral]

I found a workaround, by downgrading to Node 16. I opened a bash shell in the container, then ran

hb-service update-node 16.20.1 --allow-root

and that seems to have done the trick, for now.

[cbrandlehner]

I opened the console in Homebridge and updated to NodeJS v18.17.1 using
hb-service update-node

This is my config

        {
            "name": "Daikin Büro",
            "apiroute": "http://192.168.1.135",
            "temperature_unit": "C",
            "system": "Default",
            "OpenSSL3": true,
            "swingMode": "3",
            "disableFan": true,
            "fanMode": "FAN",
            "fanPowerMode": "FAN only",
            "fanName": "Büro FAN",
            "defaultMode": "3",
            "enableHumiditySensor": false,
            "enableTemperatureSensor": true,
            "response": 2000,
            "deadline": 60000,
            "retries": 5,
            "_bridge": {
                "username": "0E:D1:55:36:A0:49",
                "port": 33541
            },
            "accessory": "Daikin-Local"
        },

Using this config I can not reproduce the problem with my device and NodeJS v18.17.1.

[woodgieboodgie]

Still presenting the error for me with NodeJS v18.17.1:

_doSendGetRequest: ERROR: API request to https://192.168.0.141/aircon/get_sensor_info returned error Error: write EPROTO 001AF4B6:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:../deps/openssl/openssl/ssl/statem/extensions.c:922:

at WriteWrap.onWriteComplete [as oncomplete] (node:internal/stream_base_commons:94:16) {

errno: -71,
code: 'EPROTO',
syscall: 'write',
response: undefined,
retries: 0
}

[woodgieboodgie]

My config:

{
"name": "Daikin Aircon",
"apiroute": "https://192.168.0.141",
"temperature_unit": "C",
"uuid": "xyz123",
"system": "Default",
"swingMode": "1",
"disableFan": false,
"fanMode": "FAN",
"fanPowerMode": "Complete Device",
"fanName": "Kitchen FAN",
"defaultMode": "3",
"enableHumiditySensor": false,
"enableTemperatureSensor": true,
"response": 2000,
"deadline": 60000,
"retries": 5,
"_bridge": {
"username": "0E:44:1E:F3:FD:79",
"port": 36946
},
"accessory": "Daikin-Local"
}

[cbrandlehner]

@woodgieboodgie Have you tried the "OpenSSL3": true option?

[cbrandlehner]

Closing this issue due to inactivity and the reported problem seems to be a configuration issue only.