Error when enrolling vehicle ... dejavu

[jimkhoo]

Hi Elliot @llamafilm,

Thanks for your add-on. There was a previous post where vehicle enrolling failed with the "Unable to Share Vehicle" error message where your recommendation was to switch on “regenerate auth” and restart the addon.

I have deleted the public keys in the /share/tesla folder and then regenerate auth public keys.

I can confirm that the com.tesla.3p.public-key.pem is accessible from local and public networks.

I can also confirm that my tesla account indicates that my third party app is associated to the account with selected scopes.

I am also able to login to my Tesla account and getting the refresh token. But when I scan the QR code to enrol the virtual key, I get the "Unable to share vehicle - This third party isn't registered with Tesla. We can't grant them access this time".

Edit: Here are the logs indicating successful login and refresh token obtain:

[18:42:51] werkzeug:INFO: 172.30.32.2 - - [26/Apr/2024 18:42:51] "GET / HTTP/1.1" 200 -
[18:42:52] webui:DEBUG: Callback URL: https://{FQDN{/callback?code=NA_198ede2c849dc66a8e340059cf4463125af848d337f00227b025e4e98406&state=5fd9d931bd&issuer=https%3A%2F%2Fauth.tesla.com%2Foauth2%2Fv3
[18:42:52] webui:DEBUG: code: NA_198ede2c849dc66a8e340059cf4463125af848d337f00227b025e4e98406
[18:42:52] urllib3.connectionpool:DEBUG: Starting new HTTPS connection (1): auth.tesla.com:443
[18:42:53] urllib3.connectionpool:DEBUG: https://auth.tesla.com:443 "POST /oauth2/v3/token HTTP/1.1" 200 1321
[18:42:53] webui:WARNING: Obtained refresh token: NA_387cea98e73cf326cb7f366c04bc51178141c48b58b82a62d55e996302506f22
[18:42:53] werkzeug:INFO: 172.30.32.2 - - [26/Apr/2024 18:42:53] "GET /callback?callback_url=https://{FQDN}/callback?code%3DNA_198ede2c849dc66a8e340059cf4463125af848d337f00227b025e4e98406%26state%3D5fd9d931bd%26issuer%3Dhttps%253A%252F%252Fauth.tesla.com%252Foauth2%252Fv3 HTTP/1.1" 200 -

EDIT2: I have retraced all my steps including checking that the public key is accessible via multiple devices over the internet. Upon restarting the Add-On with regen oAuth, there is an error returned from https://fleet-api.prd.na.vn.cloud.tesla.com:443 that the public key cannot be downloaded with error 403 forbidden.

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFMnkw1oHUAij4bp2pmhhTiGtoGZs
G1Jqfyed93Y4Nqr1gyKTsqCYnD3Y7F3rzG3f0VKbXy0A31fSPKobubTTyQ==
-----END PUBLIC KEY-----
[20:33:03] INFO: Running auth.py
[20:33:04] webui:INFO: Starting Flask server for Web UI...
[20:33:04] werkzeug:INFO: WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.

• Running on all addresses (0.0.0.0)
• Running on http://127.0.0.1:8099
• Running on http://172.30.33.4:8099
  [20:33:04] werkzeug:INFO: Press CTRL+C to quit
  [20:33:05] auth:INFO: Generating Partner Authentication Token
  [20:33:05] urllib3.connectionpool:DEBUG: Starting new HTTPS connection (1): auth.tesla.com:443
  [20:33:06] urllib3.connectionpool:DEBUG: https://auth.tesla.com:443 "POST /oauth2/v3/token HTTP/1.1" 200 786
  [20:33:06] auth:DEBUG: {"access_token":"Redacted","expires_in":28800,"token_type":"Bearer"}
  [20:33:06] auth:INFO: Registering Tesla account...
  [20:33:06] urllib3.connectionpool:DEBUG: Starting new HTTPS connection (1): fleet-api.prd.na.vn.cloud.tesla.com:443
  [20:33:07] urllib3.connectionpool:DEBUG: https://fleet-api.prd.na.vn.cloud.tesla.com:443 "POST /api/1/partner_accounts HTTP/1.1" 424 248
  [20:33:07] auth:ERROR: Error 424: {"response":null,"error":"Public key download failed for https://{FQDN}/.well-known/appspecific/com.tesla.3p.public-key.pem, error: must return 200 response code, got 403","error_description":"","txid":"652c0e3dee2e324f637e6b600e773bd1"}

I host my files using Apache server add on instead of nginx. I'm already out of idea on what I may missed along the way. Been working on this for the past 8 hours. Any help is appreciated. Thank you again.

Regards,
Jimmy

[llamafilm]

It's hard to help if you don't share your domain name.

[jimkhoo]

My domain name is https://tesla.khoohome.au. Thank you.

[llamafilm]

I tried https://tesla.khoohome.au/.well-known/appspecific/com.tesla.3p.public-key.pem and got a 403. I think your Cloudflare may be blocking certain regions.

[jimkhoo]

Good catch Elliot. I just got into my cloudflare account and there is geofence on for certain regions. I've turned it off for now. Thanks again for helping me out. I'll create a separate rule for the key later. Good learning to consider adding into the wiki to ensure cloudflared users check WAF setting if they get the "cannot share car" error. I've managed to get the key added and will update the wiki later today.

[jimkhoo]

Hi Elliott, Out of curiosity, how often is the public key access is needed? Is it only needed during the initial registration process? Thanks again for the help.

[llamafilm]

The car checks the key every time you send a command

[jimkhoo]

Sorry being a noob here. Does the selfsigned.pem key need to be exposed as well or that is a private key that needs to be secured?