# Can the gateway see a webthing that is using ssl?

**URL:** <https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122>\
**Category:** WebThings\
**Created:** [June 17, 2020, 3:50am UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122 "2020-06-17T03:50:36Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 17, 2020, 3:50am UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/1 "2020-06-17T03:50:36Z")

</div>

Hi,

I’m currently using the webthings python framework. I passed ssl\_options to the tornado server and have the thing running.

I can connect to the thing via https and wss, but the thing-url-adapter does not see my things when I try to add them to the gateway.

If I do not use ssl I can add my things to the gateway as usual.

Does the thing-url-adapter support webthings using ssl? Looking at the thing-url-adapter code makes me think it does not but I am not sure.

Thanks

---

<div class="post-metadata">

**Author:** ![mstegeman](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@mstegeman](https://discourse.mozilla.org/u/mstegeman)\
**Post date:** [June 17, 2020, 6:22am UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/2 "2020-06-17T06:22:53Z")

</div>

Yes, but with a caveat. The problem is that the web things need to have certificates that are trusted by the gateway, which is hard on a home network. You either have to give them certificates generated by an actual CA, e.g. Let’s Encrypt, or you generate self-signed certificates from your own CA, and then put the CA’s public certificate on the gateway for verification.

Alternatively, we could add an option to the adapter to allow self-signed certificates, which obviously has its own set of security issues.

---

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 17, 2020, 3:50pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/3 "2020-06-17T15:50:47Z")

</div>

Hi,

I am using self signed certificates. I added the root certificate to the gateway following the instructions [here](https://thomas-leister.de/en/how-to-import-ca-root-certificate/) which are:

```
sudo mkdir /usr/local/share/ca-certificates/extra
sudo cp root.cert.pem /usr/local/share/ca-certificates/extra/root.cert.crt
sudo update-ca-certificates

```

Is there some other way I need to be doing this?

A few of data points:

1. The gateway and thing are running on the same raspberry pi. I am not using the Mozilla image. I built the gateway and uploaded the required sources to the pi.

2. When I try to add the thing by url

3. I can wget and curl to the thing from gateway successfully using [https://raspisentry.local:8888](https://raspisentry.local:8888)

Thanks

---

<div class="post-metadata">

**Author:** ![mstegeman](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@mstegeman](https://discourse.mozilla.org/u/mstegeman)\
**Post date:** [June 17, 2020, 4:23pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/4 "2020-06-17T16:23:23Z")

</div>

Is your code available somewhere so that I can do some local testing?

Also, is your server creating one web thing or multiple? If only one, there should not be a `/0` at the end of your URL.

---

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 17, 2020, 4:42pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/5 "2020-06-17T16:42:31Z")

</div>

Hi,

I’m using a multiple thing.

Which part of the code would you need? The thing server implements a pca9685 and ads1015 as two web things. Both only use properties. I could try to recreate the issue using one of the examples from the python webthings repo. I can also zip up my stuff and send you a link.

I’d also be glad to do the leg work, but I would need to get up to speed on debugging a gateway plugin.

Also – could this kind of thing be node version sensitive? I built the gateway using 10, but the gateway is running on 12.

---

<div class="post-metadata">

**Author:** ![mstegeman](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@mstegeman](https://discourse.mozilla.org/u/mstegeman)\
**Post date:** [June 17, 2020, 5:27pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/6 "2020-06-17T17:27:42Z")

</div>

Can you try to replicate the issue with the multiple-things example, and show me the changes you made? That would be the easiest.

---

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 17, 2020, 6:27pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/7 "2020-06-17T18:27:30Z")

</div>

In the multiple thing example I added code at line 161 and 167. Just added ssl\_options and passed them to the webthing server.

The thing shares the certs with the gateway.

The gateway and thing url adapter are un modified.

Here is the thing:

```
from __future__ import division, print_function
from webthing import (Action, Event, MultipleThings, Property, Thing, Value,
                      WebThingServer)
import logging
import random
import time
import tornado.ioloop
import uuid

class OverheatedEvent(Event):

    def __init__ (self, thing, data):
        Event. __init__ (self, thing, 'overheated', data=data)

class FadeAction(Action):

    def __init__ (self, thing, input_):
        Action. __init__ (self, uuid.uuid4().hex, thing, 'fade', input_=input_)

    def perform_action(self):
        time.sleep(self.input['duration'] / 1000)
        self.thing.set_property('brightness', self.input['brightness'])
        self.thing.add_event(OverheatedEvent(self.thing, 102))

class ExampleDimmableLight(Thing):
    """A dimmable light that logs received commands to stdout."""

    def __init__ (self):
        Thing. __init__ (
            self,
            'urn:dev:ops:my-lamp-1234',
            'My Lamp',
            ['OnOffSwitch', 'Light'],
            'A web connected lamp'
        )

        self.add_property(
            Property(self,
                     'on',
                     Value(True, lambda v: print('On-State is now', v)),
                     metadata={
                         '@type': 'OnOffProperty',
                         'title': 'On/Off',
                         'type': 'boolean',
                         'description': 'Whether the lamp is turned on',
                     }))

        self.add_property(
            Property(self,
                     'brightness',
                     Value(50, lambda v: print('Brightness is now', v)),
                     metadata={
                         '@type': 'BrightnessProperty',
                         'title': 'Brightness',
                         'type': 'integer',
                         'description': 'The level of light from 0-100',
                         'minimum': 0,
                         'maximum': 100,
                         'unit': 'percent',
                     }))

        self.add_available_action(
            'fade',
            {
                'title': 'Fade',
                'description': 'Fade the lamp to a given level',
                'input': {
                    'type': 'object',
                    'required': [
                        'brightness',
                        'duration',
                    ],
                    'properties': {
                        'brightness': {
                            'type': 'integer',
                            'minimum': 0,
                            'maximum': 100,
                            'unit': 'percent',
                        },
                        'duration': {
                            'type': 'integer',
                            'minimum': 1,
                            'unit': 'milliseconds',
                        },
                    },
                },
            },
            FadeAction)

        self.add_available_event(
            'overheated',
            {
                'description':
                'The lamp has exceeded its safe operating temperature',
                'type': 'number',
                'unit': 'degree celsius',
            })

class FakeGpioHumiditySensor(Thing):
    """A humidity sensor which updates its measurement every few seconds."""

    def __init__ (self):
        Thing. __init__ (
            self,
            'urn:dev:ops:my-humidity-sensor-1234',
            'My Humidity Sensor',
            ['MultiLevelSensor'],
            'A web connected humidity sensor'
        )

        self.level = Value(0.0)
        self.add_property(
            Property(self,
                     'level',
                     self.level,
                     metadata={
                         '@type': 'LevelProperty',
                         'title': 'Humidity',
                         'type': 'number',
                         'description': 'The current humidity in %',
                         'minimum': 0,
                         'maximum': 100,
                         'unit': 'percent',
                         'readOnly': True,
                     }))

        logging.debug('starting the sensor update looping task')
        self.timer = tornado.ioloop.PeriodicCallback(
            self.update_level,
            3000
        )
        self.timer.start()

    def update_level(self):
        new_level = self.read_from_gpio()
        logging.debug('setting new humidity level: %s', new_level)
        self.level.notify_of_external_update(new_level)

    def cancel_update_level_task(self):
        self.timer.stop()

    @staticmethod
    def read_from_gpio():
        """Mimic an actual sensor updating its reading every couple seconds."""
        return abs(70.0 * random.random() * (-0.5 + random.random()))

def run_server():
    # Create a thing that represents a dimmable light
    light = ExampleDimmableLight()

    # Create a thing that represents a humidity sensor
    sensor = FakeGpioHumiditySensor()

    # If adding more than one thing, use MultipleThings() with a name.
    # In the single thing case, the thing's name will be broadcast.
    ssl_options = {
        "certfile": "/home/pi/.mozilla-iot/ssl/certificate.pem",
        "keyfile": "/home/pi/.mozilla-iot/ssl/privatekey.pem"
    }
    server = WebThingServer(MultipleThings([light, sensor],
                                           'LightAndTempDevice'),
                            port=8888, ssl_options=ssl_options)
    try:
        logging.info('starting the server')
        server.start()
    except KeyboardInterrupt:
        logging.debug('canceling the sensor update looping task')
        sensor.cancel_update_level_task()
        logging.info('stopping the server')
        server.stop()
        logging.info('done')

if __name__ == ' __main__':
    logging.basicConfig(
        level=10,
        format="%(asctime)s %(filename)s:%(lineno)s %(levelname)s %(message)s"
    )
    run_server()
```

---

<div class="post-metadata">

**Author:** ![mstegeman](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@mstegeman](https://discourse.mozilla.org/u/mstegeman)\
**Post date:** [June 17, 2020, 6:48pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/8 "2020-06-17T18:48:57Z")

</div>

Ah, so it turns out that Node.js uses its own separate list of CA certificates. You can append to the list by setting the `NODE_EXTRA_CA_CERTS` environment variable: [https://nodejs.org/api/cli.html#cli\_node\_extra\_ca\_certs\_file](https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file)

---

<div class="post-metadata">

**Author:** ![mstegeman](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@mstegeman](https://discourse.mozilla.org/u/mstegeman)\
**Post date:** [June 17, 2020, 6:49pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/9 "2020-06-17T18:49:48Z")

</div>

If that fails, and you want to just accept anything, you can also set `NODE_TLS_REJECT_UNAUTHORIZED=0`: [https://nodejs.org/api/cli.html#cli\_node\_tls\_reject\_unauthorized\_value](https://nodejs.org/api/cli.html#cli_node_tls_reject_unauthorized_value)

---

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 17, 2020, 7:54pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/10 "2020-06-17T19:54:45Z")

</div>

Hi,

Setting NODE\_EXTRA\_CA\_CERTS did the trick, mostly. I can add things by url but the gateway does not see them when it is scanning for things.

Looks to be working as expected otherwise.

Never occurred to me that node would have it’s own CA stuff.

Thanks !! I have become reliant on the auto-generating ui the gateway provides.

Let me know if I can do anything else.

---

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 17, 2020, 9:55pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/11 "2020-06-17T21:55:46Z")

</div>

Hi again,

I did a quick hack on one of the thing-url-adapter files and was able to get the gateway to scan and see my things with ssl enabled.

In the file thing-url-adapter.js lines 744 and 748 changed http to https :

 ![Screen Shot 2020-06-17 at 2.53.24 PM](https://us1.discourse-cdn.com/flex001/uploads/mozilla/original/3X/c/d/cde48722d59705b475779e1fda53d254e00b10a3.png)

Of course my things that are not using ssl do not show up while scanning for things.

---

<div class="post-metadata">

**Author:** ![mstegeman](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@mstegeman](https://discourse.mozilla.org/u/mstegeman)\
**Post date:** [June 18, 2020, 5:42pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/12 "2020-06-18T17:42:36Z")

</div>

Yeah, I noticed this issue the other day when I was looking at this. Basically, the mDNS record needs a way to show if it’s using TLS or not.

---

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 18, 2020, 6:25pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/13 "2020-06-18T18:25:14Z")

</div>

We could add a tag to the properties to flag it:

 ![Screen Shot 2020-06-18 at 11.17.35 AM](https://us1.discourse-cdn.com/flex001/uploads/mozilla/original/3X/8/9/89ded8e926eb56a4044cb8980a5ebd76f42b2341.png)

It is only a couple of lines of code in the python implementation in server.py:

 ![Screen Shot 2020-06-18 at 11.13.41 AM](https://us1.discourse-cdn.com/flex001/uploads/mozilla/original/3X/1/4/14f7c4da625d40161ea6d546fc129d274b9201da.png)

 ![Screen Shot 2020-06-18 at 11.17.01 AM](https://us1.discourse-cdn.com/flex001/uploads/mozilla/original/3X/e/8/e81985824c988a165b10301f4ff2acda15c609a6.png)

Alternately the property could be added only of ssl is enabled. Gonna have to check that it is there anyway.

Then the thing-url-adapter could look for the tag and use the correct protocol.

---

<div class="post-metadata">

**Author:** ![mstegeman](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@mstegeman](https://discourse.mozilla.org/u/mstegeman)\
**Post date:** [June 18, 2020, 7:51pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/14 "2020-06-18T19:51:41Z")

</div>

Already done: [Change mDNS record to note TLS support. by mrstegeman · Pull Request #75 · WebThingsIO/webthing-python · GitHub](https://github.com/mozilla-iot/webthing-python/pull/75)

Adapter support is now merged as well: [Add support for discovery of web things using TLS. by mrstegeman · Pull Request #93 · WebThingsIO/thing-url-adapter · GitHub](https://github.com/mozilla-iot/thing-url-adapter/pull/93)

New versions are available of both. 😃

---

<div class="post-metadata">

**Author:** ![marcgraham](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/marcgraham/32/36804_2.png) [@marcgraham](https://discourse.mozilla.org/u/marcgraham)\
**Post date:** [June 18, 2020, 8:21pm UTC](https://discourse.mozilla.org/t/can-the-gateway-see-a-webthing-that-is-using-ssl/62122/15 "2020-06-18T20:21:29Z")

</div>

Sweet!! Life just got a little better!

Thanks