Hue bridge certificate

[LKNSI]

Hi,

So I'm new to Node and Javascript slightly, and I've managed to implement this library within my home controller network (it has worked previously but this error appears every so often and now its currently here for good), but for some reason I'm getting this error whenever I try execute any code from the library:

(node:5506) UnhandledPromiseRejectionWarning: Error: Error: The hue bridge certificate does not match the expected issuer at sslCertificate.get.then.catch.error (/root/hue-backend/node_modules/node-hue-api/lib/api/http/request.js:38:17) at <anonymous> at process._tickCallback (internal/process/next_tick.js:188:7) (node:5506) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 1)

An example js script I have that I directly copied from here to test out the library and implement it basically into my control panel;

`var hue = require("node-hue-api"),
HueApi = hue.HueApi,
lightState = hue.lightState;

var displayResult = function(result) {
console.log(result);
};

var displayError = function(err) {
console.error(err);
};

var host = "192.168.1.7",
username = ".....",
api = new HueApi(host, username),
state = lightState.create();

api.setLightState(1, state.off(), function(err, result) {
if (err) throw err;
displayResult(result);
});

api.setLightState(2, state.off(), function(err, result) {
if (err) throw err;
displayResult(result);
});`

I've ran the above via a shelljs request as well directly from node and it results in the same outcome.

I am using the 2.0 API, but when trying with 3.0+, I still get the same error. I don't believe its a problem with the code I have, but rather someone wrong with my setup and I'm wondering if you have come across this error before. From digging through the code, It seems that the SSL generation from the Hue requested config is just going a-miss, would you have an idea?

[peter-murray]

Hi there, you are falling foul of this check in the code, https://github.com/peter-murray/node-hue-api/blob/master/lib/api/http/request.js#L25.

The library now uses https connections to the bridge and unfortunately due to the self signing of the cert from the bridge, will not pass the checks that node.js will make. To work around this and check that the bridge is a hue bridge, before continuing to allow you to pass things like a username, the library performs a rudimentary check on the certificate the bridge serves. This is what is failing here for you. The issuer CN in the certificate from the bridge does not match the bridge mac address for the bridge you are passing in.

You can open the hue bridge in the browser using https://192.168.1.7 as per your example and then inspect the certificate. Can you provide that certificate in this issue thread so I can further investigate. There may be a change in the certificates due to a bridge update.

[LKNSI]

Hi Peter,

Sorry for the long delay,

Attached the certificate exported from 192.168.1.7

Hue06.09.2019.zip

[peter-murray]

Thanks, the certificate is as expected in this case.

Can you provide me with the JSON output for the unauthenticated config endpoint which in your example would be https://192.168.1.7/api/config

You should have a JSON result like

{"name":"Philips hue","datastoreversion":"83","swversion":"1933144020","apiversion":"1.33.0","mac":"00:17:88:23:f3:a8","bridgeid":"001788FFFE23F3A8","factorynew":false,"replacesbridgeid":"001788FFFE096103","modelid":"BSB002","starterkitid":""}

There has to be a mismatch between the bridgeid value in that for the check to fail.

[LKNSI]

Okay here’s is the JSON output from the bridge under that URL;

{"name":"Philips hue","datastoreversion":"83","swversion":"1933144020","apiversion":"1.33.0","mac":"ec:b5:fa:0a:62:c3","bridgeid":"ECB5FAFFFE0A62C3","factorynew":false,"replacesbridgeid":null,"modelid":"BSB002","starterkitid":""}

[LKNSI]

Yup mac address!
"mac":"ec:b5:fa:0a:62:c3" vs the bridge ID @
ECB5FAFFFE0A62C3

[peter-murray]

The check I do uses the bridgeId not the mac address as I recalled (incorrectly)...

I have released version 3.1.1 of the library to npm registry contains debugging information (if you set an environment variable of NODE_BEDUG=node-hue-api) that will print out the checks (along with other debug information) but will indicate where the mismatch lies.

I have updated the field that I check on from the certificate, it was the issuer, but now I use the subject as the problem for you is that your certificate the issuer CN is root-bridge whereas for mine it was the same as my bridgeId. The subject field is the correct field to validate on here, so that should correct the issues you are facing.

[LKNSI]

Hi Peter,

Much thanks for your help on the above, solution was correct!

Performing validation of bridgeId "ecb5fafffe0a62c3" against certifcate subject "ecb5fafffe0a62c3"; matched? true

Equally, the execution speed of the script has improved dramatically as a result of that change! (30 Seconds down to 2 Seconds)

Again, thank you! :)