Boxine Connection offline - Certificate expired

Software TeddyCloud
1

Hi,

to begin with, great work from you guys, kudos!

I do have a ESP32 Toniebox, flashing, patching is working. I can connect Toniebox with Teddycloud and use previous used Tonies and custom RFIDs.

Unfortunately I do have a problem to get the connection to Boxine running.

I did already rerun flashing the backup binary + patch for a second time with the same result.

Here are the logs, given me the “Certificate expired” response message.

TeddyCloud v0.6.2 (203f12d) - 2024-10-26 18:14:34 +0000 debian linux-armv7l(32)

INFO |settings.c:0848:settings_load_ovl| Load settings from /teddycloud/config/config.overlay.ini
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/ca-root.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/ca-key.pem' detected as DER style RSA PRIVATE KEY
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/teddy-cert.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/teddy-key.pem' detected as DER style RSA PRIVATE KEY
ERROR|tls_adapter.c:0189:read_certificate| Failed to open '/teddycloud/certs/client/MACADDRESS/ca.der' for cert type detection
ERROR|tls_adapter.c:0376:load_cert| Loading cert '/teddycloud/certs/client/MACADDRESS/ca.der' failed
ERROR|tls_adapter.c:0189:read_certificate| Failed to open '/teddycloud/certs/client/MACADDRESS/client.der' for cert type detection
ERROR|tls_adapter.c:0376:load_cert| Loading cert '/teddycloud/certs/client/MACADDRESS/client.der' failed
ERROR|tls_adapter.c:0189:read_certificate| Failed to open '/teddycloud/certs/client/MACADDRESS/private.der' for cert type detection
ERROR|tls_adapter.c:0376:load_cert| Loading cert '/teddycloud/certs/client/MACADDRESS/private.der' failed
src/cyclone/common/os_port_posix.c:523:22: runtime error: signed integer overflow: -1097287716 * 1000 cannot be represented in type 'long int'
INFO |settings.c:0848:settings_load_ovl| Load settings from /teddycloud/config/config.ini
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/ca-root.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/ca-key.pem' detected as DER style RSA PRIVATE KEY
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/teddy-cert.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/teddy-key.pem' detected as DER style RSA PRIVATE KEY
INFO |tls_adapter.c:0197:read_certificate| File '/teddycloud/certs/client/ca.der' detected as DER style CERTIFICATE
INFO |tls_adapter.c:0197:read_certificate| File '/teddycloud/certs/client/client.der' detected as DER style CERTIFICATE
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/client/private.der' detected as DER style RSA PRIVATE KEY
INFO |settings.c:0848:settings_load_ovl| Load settings from /teddycloud/config/config.overlay.ini
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/ca-root.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/ca-key.pem' detected as DER style RSA PRIVATE KEY
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/teddy-cert.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/teddy-key.pem' detected as DER style RSA PRIVATE KEY
ERROR|tls_adapter.c:0189:read_certificate| Failed to open '/teddycloud/certs/client/MACADDRESS/ca.der' for cert type detection
ERROR|tls_adapter.c:0376:load_cert| Loading cert '/teddycloud/certs/client/MACADDRESS/ca.der' failed
ERROR|tls_adapter.c:0189:read_certificate| Failed to open '/teddycloud/certs/client/MACADDRESS/client.der' for cert type detection
ERROR|tls_adapter.c:0376:load_cert| Loading cert '/teddycloud/certs/client/MACADDRESS/client.der' failed
ERROR|tls_adapter.c:0189:read_certificate| Failed to open '/teddycloud/certs/client/MACADDRESS/private.der' for cert type detection
ERROR|tls_adapter.c:0376:load_cert| Loading cert '/teddycloud/certs/client/MACADDRESS/private.der' failed
INFO |tls_adapter.c:0390:tls_adapter_init| Loading certificates...
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/ca-root.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/ca-key.pem' detected as DER style RSA PRIVATE KEY
INFO |tls_adapter.c:0204:read_certificate| File '/teddycloud/certs/server/teddy-cert.pem' assumed PEM style
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/server/teddy-key.pem' detected as DER style RSA PRIVATE KEY
INFO |tls_adapter.c:0197:read_certificate| File '/teddycloud/certs/client/ca.der' detected as DER style CERTIFICATE
INFO |tls_adapter.c:0197:read_certificate| File '/teddycloud/certs/client/client.der' detected as DER style CERTIFICATE
INFO |tls_adapter.c:0201:read_certificate| File '/teddycloud/certs/client/private.der' detected as DER style RSA PRIVATE KEY
INFO |toniesJson.c:0280:tonies_readJson| Trying to read /teddycloud/config/tonies.custom.json with size 2
INFO |toniesJson.c:0280:tonies_readJson| Trying to read /teddycloud/config/tonies.json with size 5096098
INFO |toniesJson.c:0100:tonies_update| Updating tonies.json from api.revvox.de...
INFO |cloud_request.c:0200:web_request| Connecting to HTTP server api.revvox.de:443...
INFO |cloud_request.c:0252:web_request|   trying IP: 157.90.183.226
INFO |cloud_request.c:0382:web_request| Redirecting to: https://raw.githubusercontent.com/toniebox-reverse-engineering/tonies-json/release/tonies.json
INFO |cloud_request.c:0200:web_request| Connecting to HTTP server raw.githubusercontent.com:443...
INFO |cloud_request.c:0252:web_request|   trying IP: 185.199.109.133
INFO |toniesJson.c:0124:tonies_update| ... success updating tonies.json from api.revvox.de, reloading
INFO |toniesJson.c:0280:tonies_readJson| Trying to read /teddycloud/config/tonies.custom.json with size 2
INFO |toniesJson.c:0280:tonies_readJson| Trying to read /teddycloud/config/tonies.json with size 5096098
INFO |toniesJson.c:0211:tonieboxes_update| Updating tonies.json from api.revvox.de...
INFO |cloud_request.c:0200:web_request| Connecting to HTTP server api.revvox.de:443...
INFO |cloud_request.c:0252:web_request|   trying IP: 157.90.183.226
INFO |cloud_request.c:0382:web_request| Redirecting to: https://raw.githubusercontent.com/toniebox-reverse-engineering/tonies-json/release/tonieboxes.json
INFO |cloud_request.c:0200:web_request| Connecting to HTTP server raw.githubusercontent.com:443...
INFO |cloud_request.c:0252:web_request|   trying IP: 185.199.109.133
INFO |toniesJson.c:0238:tonieboxes_update| ... success updating tonieboxes.json from api.revvox.de, reloading
INFO |toniesJson.c:0280:tonies_readJson| Trying to read /teddycloud/config/tonies.custom.json with size 2
INFO |toniesJson.c:0280:tonies_readJson| Trying to read /teddycloud/config/tonies.json with size 5096098
INFO |server.c:0929:server_init| 1 open HTTPS Web connections
INFO |server.c:0929:server_init| 2 open HTTPS Web connections
WARN |tls_server_fsm.c:0260:tlsPerformServerHandshake| TLS handshake failure!
INFO |server.c:0929:server_init| 1 open HTTPS Web connections
INFO |server.c:0929:server_init| 3 open HTTPS Web connections
WARN |tls_server_fsm.c:0260:tlsPerformServerHandshake| TLS handshake failure!
INFO |server.c:0929:server_init| 2 open HTTPS Web connections
INFO |server.c:0929:server_init| 3 open HTTPS Web connections
INFO |handler_cloud.c:0041:handleCloudTime|  >> respond with current time
INFO |mqtt.c:0685:mqtt_init_box| Skipping client 'Toniebox' (cn: 'default')
INFO |server.c:0929:server_init| 16 open HTTPS Web connections
INFO |cloud_request.c:0200:web_request| Connecting to HTTP server prod.de.tbs.toys:443...
INFO |cloud_request.c:0252:web_request|   trying IP: 3.69.182.181
ERROR|cloud_request.c:0262:web_request| Failed to connect to HTTP server! HTTP=Unknown HTTP Status Code error=Certificate expired [535]
ERROR|handler_reverse.c:0029:handleReverse| cloud_request_get() failed
INFO |server.c:0929:server_init| 17 open HTTPS Web connections
INFO |cloud_request.c:0200:web_request| Connecting to HTTP server prod.de.tbs.toys:443...
INFO |cloud_request.c:0252:web_request|   trying IP: 3.69.182.181
ERROR|cloud_request.c:0262:web_request| Failed to connect to HTTP server! HTTP=Unknown HTTP Status Code error=Certificate expired [535]
ERROR|handler_reverse.c:0029:handleReverse| cloud_request_get() failed
INFO |server.c:0929:server_init| 18 open HTTPS Web connections
WARN |tls_server_fsm.c:0260:tlsPerformServerHandshake| TLS handshake failure!
INFO |server.c:0929:server_init| 17 open HTTPS Web connections

Additional worth to mention might be that I run the teddycloud on a raspberry pi 4, where already OpenHAB instance is installed. Therefore I added a second IP address for teaddycloud usage and for this reason the docker compose file looks like following. 8443 port is used for openHAB, therefore I use 8444 for teddycloud.

version: '3'
services:
  teddycloud:
    container_name: teddycloud
    hostname: teddycloud
    image: ghcr.io/toniebox-reverse-engineering/teddycloud:tc_v0.6.2_debian
    ports:
     - 192.168.177.22:80:80 #optional (for the webinterface)
     - 192.168.177.22:8444:8443 #optional (for the webinterface)
     - 192.168.177.22:443:443 #Port is needed for the connection for the box, must not be changed!
    volumes:
      - certs:/teddycloud/certs
      - config:/teddycloud/config
      - content:/teddycloud/data/content
      - library:/teddycloud/data/library
      - firmware:/teddycloud/data/firmware
      - cache:/teddycloud/data/cache
    restart: unless-stopped
volumes:
  certs:
  config:
  content:
  library:
  firmware:
  cache:

I would be grateful to get some feedback what the certificate problem might be. System time is in sync. Client and server cert files are verified with https://github.com/toniebox-reverse-engineering/teddycloud/blob/develop/contrib/verify-tc-certificates.sh script.

Thanks in advance and everything best
mott

2

I guess I figured out what might be the problem.

It seemed odd to me that with the date command I only get 1970 Jan, 1st 00:00 time back. And I could not set the time accordingly. Installing NTP or any other package was leading to chicken-egg-problem to install some packages a proper time was necessary…

I eventually find following thread:

Which lead me to the docker compose setting for the container:

    security_opt:
      - seccomp=unconfined

from Frequently Asked Questions - LinuxServer.io

Now the boxine connection is green in the web gui and I would check if everything else is working as intended next.

I guess thread can be closed :slight_smile:

1 Like