Failed to connect to wss

[myiotcenter]

Hi, Tried to setup this plugin based on the instruction on the readme section. and create Long Lived Token and paste into Access-Token field, Click Save and (re)connect button but always getting the message "Failed to connect to" URL.

I then install Chrome Extension called WebSocket Test Client, set the same URL and open Websocket connection:

received expected response that auth required. Then sent a request auth and access token :

and received message auth ok. I use the same URL and same Access Token in Stream Deck HA Plugin but still getting the same Failed to Connect to message.

Any idea what kind of config in the plugins I might missed? Thanks!

[cgiesche]

Hi myiotcenter,

can you please try, if it works with "ws://" instead of "wss://". You are using port 8123, which, by default, is not SSL secured. I think this could already fix the issue.

(I see, that "wss" works inside the test client, but maybe it is very forgiving?)

[myiotcenter]

Tried that earlier and just now, but still failed

Using test client giving error message

any idea how to debug or trace the issue?

[myiotcenter]

using websocket test client, I add more characters to the access token and can see this error message in HA Core log

tried to use that modified access token in Stream Deck, getting the same message Failed to connect to but no log entry in HA Core Log...

[cgiesche]

Hi,

there is a way to enable debugging: https://developer.elgato.com/documentation/stream-deck/sdk/create-your-own-plugin/#debugging

After that, you can open an URL in your Browser and connect to the Propery-Inspector (1) (=settings page inside stream deck, which must be ACTIVE, otherwise it won't show up) or the plugin (2) itself. In your case, you want to debug the Property Inspector:

From there, you can use the developer tools of chrome or edge to get more information (i changed my url to something invalid to show some console output):

[myiotcenter]

Hi, Tried it just now and found this error in the console:

and also this one on network says blocked:other not sure what is blocking

[cgiesche]

Hmm, these messages are "normal" (chrome tries to load source code maps for the plugin). Did you open the "Home Assistant Plugin PI" (PI suffix is important) in the debug tools? It only shows up, when a button with the plugin is selected in the stream deck app. After you successfully connected the debugger, you can then try to change and save the settings to observe the changes in the debug view.

[myiotcenter]

Hi, Yes I got the Home Assistant Plugin PI appears when open localhost:23654

This is the console when I clicked on the Home Assistant Plugin PI

I then changed the url in Stream Deck App and click Save and (re)connect but nothing showed up in the console in chrome but Stream Deck is still giving the same error that it failed to connect to url.

[mmuziek]

same problem here. Once i got it connected but said invalid token (even when its a brand new one fully working) but once i generated a new token it could not connect again. and again and again. Sadly only testing systems can connect fine without issues. my local tool aswell this plugin not.

[acalejos]

For what it's worth, I found that a workaround is to have nginx act as the SSL proxy so that internal/local traffic to your home assistant instance does not have to be over SSL. From what I can tell, the issue is when the plugin tries to validate the self-signed certificate since I got this error: Error in connection establishment: net::ERR_CERT_COMMON_NAME_INVALID. So I followed this guide to have all local traffic use HTTP and anything else will hit the proxy and get directed to SSL. Then change your plugin to use normal ws instead of wss. Hope this helps.

[jessiewestlake]

For what it's worth, I found that a workaround is to have nginx act as the SSL proxy so that internal/local traffic to your home assistant instance does not have to be over SSL. From what I can tell, the issue is when the plugin tries to validate the self-signed certificate since I got this error: Error in connection establishment: net::ERR_CERT_COMMON_NAME_INVALID. So I followed this guide to have all local traffic use HTTP and anything else will hit the proxy and get directed to SSL. Then change your plugin to use normal ws instead of wss. Hope this helps.

I think you are correct on the cause of the problem. I was/am facing the same issue if I try to use local IP address to connect. If I use my public (with ssl enabled on default port 443) URL and the wss:// URI scheme, then it works. I'm not using a proxy to redirect HTTP to HTTPS; I have HTTPS enabled directly on Home Assistant, so I think you are right about that being why it's not working over local IP, because the certificate doesn't secure the IP in the Subject or SAN.

[electrofloat]

Yes, it seems that it cannot connect to HA if it uses a self signed cert.

Although it also seems that the plugin become abandonware? (like most of the HA integrations unfortunately...)

[electrofloat]

Could someone with enlightment info on how to "compile" (what? compile a script?)/run this repo try this patch out?:

diff --git a/src/modules/common/homeassistant.js b/src/modules/common/homeassistant.js
index 064819c..a1bd708 100644
--- a/src/modules/common/homeassistant.js
+++ b/src/modules/common/homeassistant.js
@@ -3,7 +3,7 @@ export class Homeassistant {
     constructor(url, accessToken, onReady, onError, onClose) {
         this.requests = new Map()
         this.requestIdSequence = 1
-        this.websocket = new WebSocket(url)
+        this.websocket = new WebSocket(url, { rejectUnauthorized: false });
         this.accessToken = accessToken;
         this.onReady = onReady;
         this.onError = onError;

should disable the cert validation, and make this work.

[electrofloat]

For the mean time I think I've found a solution. If you follow this https://learn.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate to install the CA you used to sign your cert with what HA uses, to Certificates (Local Computer) ->Trusted Root Certification Authorities-> Certificates, then if you use wss:// instead of ws:// it will just work with self signed CA-s.

This has also the advantage/disadvantage (depending on how you need it) of any software that uses the windows cert store to validate certificates to accept your self signed cert.

[cgiesche]

I will close this due to inactivity. There is nothing i can do via code.