Support Let's Encrypt certificates provided for freeboxos.fr domains #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Please note that I've gone this way because the discovered endpoint does not work because of SSL issues: |
|
Didn't know about this feature of the Freebox, thanks. I'll merge your PR so that custom subdomains can be used, but I'll need to make sure the default one works as well. As far as I understand the documentation, the default certificate can be validated by trusting the Freebox CA, so I suppose I must have misused python.ssl. |
pdecat
commented
Jun 19, 2018
| @@ -54,9 +54,13 @@ def __init__(self, app_desc=app_desc, token_file=token_file, api_version='v3', t | |||
| if not self._is_app_desc_valid(self.app_desc): | |||
| raise InvalidTokenError('invalid application descriptor') | |||
|
|
|||
| cert_path = os.path.join(os.path.dirname(__file__), 'freebox_root_ca.pem') | |||
| if host.endswith('.freeboxos.fr'): | |||
There was a problem hiding this comment.
On second thought, I'm thinking about reversing the check to only use the freebox_root_ca.pem CA for fbxos.fr subdomains.
What do you think?
There was a problem hiding this comment.
I was thinking the same thing, it is possible to configure a fully custom domain name that does not necessarily end in freeboxos.fr. I even wonder if testing domains is really a good idea, perhaps it would be better to simply register the Free certificates as trusted authorities and always use the default SSL context creation. I'm not sure exactly yet how to do that, I'll do some tests.
By the way, I didn't manage to reproduce issue #2 at home. What Freebox do you have? If I continue failing to reproduce, would you be willing to perform some tests if I push a PR?
There was a problem hiding this comment.
I'm not fond of trusting custom CAs as you lose all the security work done upstream by the distribution.
I have a Freebox v6 r1 from july 2011 (the one from december 2010 broke and was exchanged), current firmware version 3.5.2.
Open for testing.
There was a problem hiding this comment.
Hmm, I'm not sure I understand: the CA would only be trusted in the context of the library, what would be the risk? (sorry if that's a dumb question, I'm pretty much discovering SSL as we're speaking!)
If trusting the Freebox CA is a security risk, perhaps we could make it optional so that the user can decide whether she wants to enable insecure access or not, instead of relying on the domain used. I guess this parameter would need to be propagated to Home Assistant as well, but it would make the setup more complex, and prevent automatic discovery to work correctly.
There was a problem hiding this comment.
Let's continue this discussion on PR #3
stilllman
added a commit
to stilllman/home-assistant
that referenced
this pull request
Jun 23, 2018
The previous version of aiofreepybox was not working with custom domain names, which uses a Let's Encrypt certificates. Also, it was not working with the default domain name when connecting to Freebox v6. This should be fixed in aiofreepybox 0.0.4. See hacf-fr/freebox-api#1, hacf-fr/freebox-api#3 and hacf-fr/freebox-api#2 for more info.
4 tasks
balloob
pushed a commit
to home-assistant/core
that referenced
this pull request
Jun 25, 2018
The previous version of aiofreepybox was not working with custom domain names, which uses a Let's Encrypt certificates. Also, it was not working with the default domain name when connecting to Freebox v6. This should be fixed in aiofreepybox 0.0.4. See hacf-fr/freebox-api#1, hacf-fr/freebox-api#3 and hacf-fr/freebox-api#2 for more info.
eavanvalkenburg
pushed a commit
to eavanvalkenburg/home-assistant
that referenced
this pull request
Jun 28, 2018
) The previous version of aiofreepybox was not working with custom domain names, which uses a Let's Encrypt certificates. Also, it was not working with the default domain name when connecting to Freebox v6. This should be fixed in aiofreepybox 0.0.4. See hacf-fr/freebox-api#1, hacf-fr/freebox-api#3 and hacf-fr/freebox-api#2 for more info.
girlpunk
pushed a commit
to girlpunk/home-assistant
that referenced
this pull request
Sep 4, 2018
) The previous version of aiofreepybox was not working with custom domain names, which uses a Let's Encrypt certificates. Also, it was not working with the default domain name when connecting to Freebox v6. This should be fixed in aiofreepybox 0.0.4. See hacf-fr/freebox-api#1, hacf-fr/freebox-api#3 and hacf-fr/freebox-api#2 for more info.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This official way to get HTTPS support without providing a custom CA certificate when connecting to the Freebox API is to setup a custom freeboxos.fr subdomain: https://dev.freebox.fr/bugs/task/19630
Without this change, accessing mycustomdomain.freeboxos.fr:54321 from Home Assistant fails with the following error:
Note: using a custom domain does not work with discovery and requires adding configuration:
Tested with Home Assistant 0.72.0b2 (homeassistant/home-assistant:0.72.0b2 docker image)