IHC binding on Raspberry Pi problem

[Stefan TP]

Hi

I'm got some problems getting the IHC binding to work on my raspberry.

The sonos binding is working fine, and the ihc binding also works when i run it on my windows pc.

After installing openhab and adding the ssl certificate to keystore, i get the following when i tries to start openhab:

pi@raspberrypi ~/openhab $ sudo ./start.sh

Launching the openHAB runtime...

osgi> 00:09:50.841 INFO  o.o.c.internal.CoreActivator[:92] - openHAB runtime has been started (v1.3.1).

00:10:26.588 INFO  o.o.m.c.i.ModelRepositoryImpl[:99] - Loading model 'test.items'

00:10:35.225 INFO  o.o.i.s.i.DiscoveryServiceImpl[:92] - mDNS service has been started

00:10:42.865 INFO  o.o.m.c.i.ModelRepositoryImpl[:99] - Loading model 'test.sitemap'

00:10:57.579 INFO  o.o.i.r.i.RESTApplication[:158] - Started REST API at /rest

00:11:03.592 INFO  o.o.u.w.i.s.WebAppServlet[:99] - Started Classic UI at /openhab.app

00:11:18.138 INFO  o.o.b.i.internal.IhcConnection[:139] - Connecting to IHC / ELKO LS controller [IP='192.168.1.20:443' Username='admin' Password='Thezone21'].

00:11:23.928 ERROR o.o.b.i.internal.IhcConnection[:188] - Connection to IHC / ELKO LS controller failed.

javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake

        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)

Caused by: java.io.EOFException: SSL peer shut down incorrectly

        at sun.security.ssl.InputRecord.read(InputRecord.java:505)

00:11:24.032 INFO  o.o.c.s.AbstractActiveService[:189] - IHC / ELKO LS refresh and notification listener service has been started

00:12:02.482 INFO  o.o.i.r.i.RESTApplication[:174] - Stopped REST API

00:12:06.826 INFO  o.o.u.w.i.s.WebAppServlet[:110] - Stopped Classic UI

Anybody how can help me with this problem?

Thanks.

Stefan

[Pauli Anttila]

Hi Stefan,

it looks like you have included port number into controller ip address? Have you tried without port number?

-Pali 

2014/1/20 Stefan TP <stefant...@gmail.com>

--
You received this message because you are subscribed to the Google Groups "openhab" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openhab+u...@googlegroups.com.
To post to this group, send email to ope...@googlegroups.com.
Visit this group at http://groups.google.com/group/openhab.
For more options, visit https://groups.google.com/groups/opt_out.

[Stefan TP]

Hi Pali

Yes I have also tried without the port number, but with the same result.

Adding the port number was just a wild guess.

[kas...@lomme.dk]

If you have something like this in your openhab.log

20:32:05.842 ERROR o.o.b.i.internal.IhcConnection[:168]- Connection to IHC / ELKO LS controller failed.

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1884)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1341)

at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153)

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)

at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)

at sun.security.validator.Validator.validate(Validator.java:260)

at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)

at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)

at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)

at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)

at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)

at sun.security.validator.Validator.validate(Validator.java:260)

at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)

its an SSL Certificate missing.

it took me some time to find the correct keystore, before the OpenHAB IHC Cert procedure worked for me ( https://github.com/openhab/openhab/wiki/IHC-Binding )

Try locate and import the certificate from your IHC controller with these commands

echo $JAVA_HOME

keytool -list -keystore /opt/java/ejre1.7.0_51/lib/security/cacerts | grep ihc

keytool -importcert -alias ihc -keystore /opt/java/ejre1.7.0_51/lib/security/cacerts  -file "/home/pi/LK IHC Controller.cer"

 keytool -list -keystore /opt/java/ejre1.7.0_51/lib/security/cacerts | grep ihc

tailf /opt/openhab/logs/openhab.log 

Br  Kasper

[Stefan TP]

Hi Kasper

I will try that as soon as i get home.

How did you get the certificate from the controller?

And how did you install java on the Raspberry?

Stefan

[Pauli Anttila]

Hi Stefan,

because controller closed the session, your problem should not be related to certificate. For me it's sound more like a faulty SSL/TLS implementation. Which java version you are using on raspberry?

Br,

Pali

[Kristoffer Graff]

Hi

I just installed OPENHAB 1.4.0 with the IHC binding on my Raspberry (RASPBIAN) and its working great.
Is there planned any update of this great binding? Mabye a way to change the level on dimmer.
BR
Kristoffer

[Pauli Anttila]

Mabye a way to change the level on dimmer.

 

Dimmers should be supported already. Dimmers don't work with classic ui, because classic UI use increase and decrease commands rather than absolute values (IHC controller support only absolute values), but GreenT, iOS and android UI's should work.

Is there planned any update of this great binding?

 

Well, I have just refactored the whole binding, but there is no new features. Reason is that I don't know what to add, because all features should be already supported. I personally don't use all features, so some of them could be broken. So all ideas or bug reports are welcome.

Br,

Pali

[Kristoffer Graff]

Hi Pali

Great, I will try on the Android app right away - do you have a example to make a dimmer?

I was just thinking if there is a fast way to make item file from the IHC project file.  

BR
Kristoffer

[Stefan TP]

Success!!!

I finaly got i to work.

I guess it was a Java problem, as Pali mentions, rather than a certificate problem.

I decided to start all over again, and made a new installation of Raspbian (for the fifth time).

Earlier i have installede Java 1.8 using this guide: http://morepootling.blogspot.dk/2013/09/home-automation-with-z-wave-on.html

But this time i tried to install Java 1.7 (http://www.raspberrypi.org/archives/4920) an OpenJDK (I saw some where that OpenJDK was necessary to use keytool, not sure uf that is true)

The hard part for me was to locate Java, and the cacerts file, but i found this command which helped me: "readlink -f /usr/bin/java" (im not sure what i does, but the output told me that Java was located at /usr/lib/jvm/..)

And after adding the certificate to keystore i works perfectly.

All times i have been using a copy of OH 1.3.1 which has been working on my windows laptop, so now i just needs to upgrade to 1.4.

Kristoffer which Java version did you use?

Many thanks for the feedback.

Stefan

[Kristoffer Graff]

HI Stefan

I use Java 1.7 - I get the same error as you with the 1.8 version :-/

BR

Kristoffer 

[Stefan TP]

Did you allso install OpenJDK? If not, how did you add the certificate?

[Kristoffer Graff]

Nope - i did a search for the cacerts. and imported the certificated with keytool.

sudo keytool -importcert -alias ihc -keystore /usr/lib/jvm/jdk-7-oracle-armhf/jre/lib/security/cacerts -file "/home/pi/LKIHCController"

BR

Kristoffer 

A tool to auto get and import the certificate to cacerts will be a good feature. 

[Stefan TP]

Thanks for the help.

I tried without OpenJDK, and it works perfectly :-)

Have a nice weekende.

Stefan

[Kristoffer Graff]

Good.. 

Please post if you find a solution to Java 8

Same 2 you Stefan.

Kristoffer