philipshue wizard does not work with hue bridge pro

[kylewhirl]

• I confirm that this is an issue rather than a question.

Bug report

Philips hue wizard does not work with the new hue bridge pro, likely because of the requirement to communicate via https

Steps to reproduce

Connection to hue bridge pro in the wizard

What is expected?

Should create a user and client key

What is actually happening?

Nothing, doesn’t recognize when pressing the button on the bridge

System

Hyperion Server:
- Build:             (HEAD detached at aed4abc) (GitHub-b8255a9/aed4abc-1724602844)
- Build time:        Aug 26 2024 01:10:58
- Git Remote:        https://github.com/hyperion-project/hyperion.ng
- Version:           2.0.17-beta.1+nightly20240826aed4abc03b87f4be6f3491beb9e3515d2bb28557
- UI Lang:           en (BrowserLang: en-US)
- UI Access:         default
- Avail Screen Cap.: dispmanx,framebuffer,qt
- Avail Video  Cap.: v4l2
- Avail Audio  Cap.: audio
- Avail Services:    boblight,cec,effectengine,forwarder,flatbuffer,protobuffer,mDNS,SSDP,borderdetection
- Config path:       /root/.hyperion
- Database:          read/write
- Mode:              Non-GUI

Hyperion Server OS:
- Distribution:      Raspbian GNU/Linux 11 (bullseye)
- Architecture:      arm
- CPU Model:         ARMv7 Processor rev 4 (v7l)
- CPU Type:          Raspberry Pi 3 Model B Plus Rev 1.3
- CPU Revision:      a020d3
- CPU Hardware:      BCM2835
- Kernel:            linux (6.1.19-v7+ (WS: 32))
- Root/Admin:        true
- Qt Version:        5.15.2
- Python Version:    3.9.2
- Browser:           Mozilla/5.0 (iPhone; CPU iPho

[Lord-Grey]

Hyperion and Hue communicate by default via https.
I learned that Phillips issued an alternative certificate in June and its current absence might cause the failure.

Would you mind switching Hyperion to debug logging, try to create a userkey and share the logs please.
Just want to sort out other issues.

In addition, may I ask you to update the hostname with the Hue Bridge's IP address. Put the IP address into the host field and click the refresh button. Then create a userkey.
I am aware there are currently some issues with mDNS and I would like to close out issues here too.

I am currently traveling and will look into getting the alternate certificate read in 1-2 weeks time.

Edit: Are you configuring a new Bridge or did you migrate an old one to the new Pro Bridge?

[kylewhirl]

Hyperion and Hue communicate by default via https. I learned that Phillips issued an alternative certificate in June and its current absence might cause the failure.

Would you mind switching Hyperion to debug logging, try to create a userkey and share the logs please. Just want to sort out other issues.

In addition, may I ask you to update the hostname with the Hue Bridge's IP address. Put the IP address into the host field and click the refresh button. Then create a userkey. I am aware there are currently some issues with mDNS and I would like to close out issues here too.

I am currently traveling and will look into getting the alternate certificate read in 1-2 weeks time.

Edit: Are you configuring a new Bridge or did you migrate an old one to the new Pro Bridge?

I migrated from an old one to a new one, with same ip. I’ve tried entering the ip manually as well and it doesn’t even connect or recognize the bridge. It also doesn’t discover the bridge, which means I am not able to press the button to generate a client key or username. I used a curl command to generate my own username and client key and inputting this still does not fix the issue. If you want, I can attach debug logs for when I do any of these things. Another user also mentioned these details about the new bridge pro for a Homebridge plugin:

I got myself a brand new Hue bridge pro. I am particularly interested in the MotionAware feature, but for now, let's make sure Homebridge Hue (and ph) can work with it. This involves a bit more changes than I had anticipated.

Unsurprisingly, the Hue bridge pro has a new modelid, BSB003. Mine also uses a new MAC address prefix, C42996;
As communicated by Signify, they're phasing out support for plain HTTP. The Hue Bridge Pro only supports HTTPS. The gen-2 (square) bridge will drop HTTP support with a not so distant firmware update;
Similarly, the Bridge Pro doesn't announce itself over UPnP, and no longer provides description.xml. mDNS is the way forward for local discovery. The MeetHue discovery server actually returns the port (443 for HTTPS) of the registered bridges;
I couldn't migrate my existing gen-2 bridge, because it wasn't signed in to the Hue cloud. As we've seen before, Signify are pushing their cloud aggressively. I did sign on, but now the migration wants see see some firmware updates first.
The Bridge Pro updated as soon as I connected it to the Internet. It now has swversion [2071096000](tel:2071096000) (newer than gen-2 bridge) and apiversion 1.73.0 (same as gen-2 bridge).
Signify claim they've replaced all self-signed SSL certificates with certificates issued by their CA. As per their guidance, I should drop support for certificate pinning and no longer accept self issued certificates. This does require gen-2 bridges to be updated with recent firmware. so they're issued a certificate by their CA. See https://developers.meethue.com/develop/application-design-guidance/using-https/ for details.
While Homebridge Hue and ph already support HTTPS, they still use HTTP for the unauthenticated GET config call, to retrieve the bridge parameters (amongst which the swversion that indicates whether the bridge supports HTTPS). I need to change the discovery logic, incl. the check whether this is indeed a Hue bridge. And I need to remove the logic to pin self-signed certificates, and specify Signify's certificate authorities instead. This will break HTTPS support for gen-2 Hue bridges with older firmware, still using a self-signed certificate. These will need to be updated, or you need to specify forceHttp to fall back to plain HTTP. Note that in that case, Homebridge Hue cannot use the event stream feature, which is part of the APIv2, only available over HTTPS.

[Lord-Grey]

Thanks for you input.
Let me first fix the general connectivity issues and add the additional certificate.
Then I need your support with additional logging to better understand where things might break.

[kylewhirl]

Sounds good, let me know when you’d like the debug logs and for what to do

[kylewhirl]

Do you have a beta version I can install to test these changes whenever they are ready?

[Lord-Grey]

@kylewhirl Just got back from vacation today. Please give me a bit of time preparing an update.

Can you do me one favour and execute in the meantime

curl http://YOUR_BRIDE_IP/api/config

Just want to check how the Pro-Bridge behaves.

You can ping me the output as a private message on the Discord ("Lord-Grey") or via the Hyperion forum
If it is just an error message without private details, you can of course post here.