search

llamafilm / tesla-http-proxy-addon

Tesla HTTP Proxy Add-on for Home Assistant
Apache License 2.0
45 stars 19 forks source link

Unable to Share Vehicle: This third party isn't registered with Tesla. We can't grant them access at the time. #41

Closed e2m32 closed 7 months ago

e2m32 commented 8 months ago

Describe the bug I've followed the instructions trying to set this up. Man, Tesla has really made a lot of hoops for us to jump through now 😢

I set up another domain using duckdns and registering it with the Duck DNS (with Lets Encrypt) addon. Everything seems to be working. I also forwarded port 443 to my home assistant behind my firewall. I am able to reach the server from outside the network (tested on cell connection). With the this addon and nginx running when I go to my https:// I get the Web UI for this addon with the "Generate OAuth token" and other buttons.

When I click "Generate OAuth token" and authenticate with Tesla, everything seems to work and I get the Tesla Custom component token information in this addon's logs 👍.

Then when I go back to the WebUI and click "Enroll public key in your vehicle", my Tesla app opens as expected and it starts to try to authenticate... then I get a popup that stays: ❌Unable to Share Vehicle: This third party isn't registered with Tesla. We can't grant them access at the time. image

When I click the "Test public key endpoint", chrome opens on my phone with the "Dangerous site" warning (something wrong with the certificate?). If I bypass the warning (Details > this unsafe site), I just get a blank white page. image

When I restart the addon I get this in the logs:

s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
[14:52:01] INFO: Found existing keypair
[14:52:01] NOTICE: Starting temporary Python app for authentication flow
[14:52:02] main:INFO: *** Generating Partner Authentication Token ***
[14:52:03] main:INFO: *** Registering Tesla account ***
[14:52:04] main:ERROR: Error 400: Bad Request
[14:52:04] main:INFO: {"response":null,"error":"Invalid EC public key","error_description":""}
[14:52:04] main:INFO: *** Starting Flask server... ***
[14:52:04] werkzeug:INFO: WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
 * Running on all addresses (0.0.0.0)
 * Running on http://127.0.0.1:8099
 * Running on http://172.30.33.13:8099
[14:52:04] werkzeug:INFO: Press CTRL+C to quit

Where did I go wrong? Help 🙏

Environment (please complete the following information):

llamafilm commented 8 months ago

It sounds like something is wrong with the TLS cert on your domain. Please share your real domain name so we can help you debug it.

cebertowicz commented 8 months ago

Experiencing the same issue with A+ report from SSL labs

llamafilm commented 8 months ago

If you don't share your real domain I can't help you.

e2m32 commented 8 months ago

I'm nervous publicly posting my domain and home assistant IP address for all to see.

I did notice that mycom.tesla.3p.public-key.pem file is empty which might explain the {"response":null,"error":"Invalid EC public key","error_description":""} error in the log file.

llamafilm commented 8 months ago

Ah, ok it sounds like you hit the same bug as another user. Delete that file, then update to 1.3.3 and try again.

e2m32 commented 8 months ago

Ok, cool. Tried it and I am still getting the same "Dangerous Site" error for https://<REDACTED>.duckdns.org/.well-known/appspecific/com.tesla.3p.public-key.pem and I get the same error in the Tesla app.

The logs give this error:

[03:47:21] main:ERROR: Error 424: Failed Dependency
[03:47:21] main:INFO: {"response":null,"error":"Public key download failed for https://<REDACTED>.duckdns.org/.well-known/appspecific/com.tesla.3p.public-key.pem, error: SSL_connect returned=1 errno=0 peeraddr=<XX.XX.XX.XX>:443 state=error: certificate verify failed (self signed certificate)","error_description":""}

Chrome doesn't complain about the SSL cert if I go to https://<REDACTED>.duckdns.org... that brings up the AddOn's button page. 🙄

I checked the cert using https://dnschecker.org/ and it all looks correct. The domains align and it's signed by Let's Encrypt... ahh, but I just hit refresh and it's pulling my pfSense self-signed cert... Eh, how do I fix that?

ryanelliottsmith commented 8 months ago

I had this issue same error, but different symptoms(the public key was fine). For me, it was because the domain I was using for tesla-http-proxy wasn't in the "Allowed Origin's" list in the tesla app. I misread "matching the FQDN of your Home Assistant server" in the docs...

llamafilm commented 8 months ago

You should be able to view the public key in a web browser with no errors. If that’s not working, you need to solve that before doing anything else.

cnn888 commented 8 months ago

Me too have this problem. I have followed all the steps but always stuck at generating oauth.

IMG_4203

Logging in the oauth link of the webui gives me a blank page saying error cannot open page

IMG_4204

if this helps, the nginx gives me this error too

IMG_4205

What do I need to do? Could you please help me? Thanj you

llamafilm commented 8 months ago

It sounds like something is wrong with your nginx config. It’s hard to help without knowing how your domain, nameservers, and network are configured.

cnn888 commented 8 months ago

Ok i will check the nginx and see if this is the culprit. I am using cloudflare tunnel as well if that might be causing it.

e2m32 commented 7 months ago

I have tried getting this to work for 5 days now 😭 and have spent hours cycling in what feels like infinite loops. Please, please can anyone help before I loose my sanity. 🙏

After trying everything I could think of to get this to work with duckdns domins, I gave up and decided to just purchase a domain.

Cloudflare attempt

I got a domain from namecheap and set it up with cloudflare as the dns provider. I then setup the Cloudflare integration in HA to keep my IP address in sync with cloudflare. I set up an A type DNS record in cloudflare that points to my network and have port 443 forwarded to HA. I setup the NGINX addon with the new domain and got a SSL cert from cloudflare and put them in the /ssl directory and pointed the NGINX at them.

image image

The issue is that when I go to my domain externally, it times out. But if I set up NGINX with a duckdns domain, it works like a charm. So my guess is that there is something that cloudflare is doing or not doing where the domain data is not passed on to NGINX and therefore it ignores the request instead of forwarding it on. NGINX doesn't give me any log information if a request fails though. Is there a way to turn that on? Is there some type of setting I am missing in Cloudflare? Am I doomed to just not get this working?

Things I've tried:

llamafilm commented 7 months ago

@e2m32 your description sounds correct to me. I really don't understand the hesitation of sharing a public domain name. Your public IP is probably being port scanned every day by Chinese bots anyway.

curl, netcat, nmap, and dig may be helpful for troubleshooting.

ryanelliottsmith commented 7 months ago

@e2m32 what do the logs on the cloudflared process look like? There's something in the config(at least when I last looked at it) that breaks SNI when using a reverse proxy, even if you're passing through headers. I was seeing "name unknown" type responses from nginx with the tesla-http-proxy config that the app builds. I saw this both with cloudflared, and with nginx-ingress. You won't see this logged by nginx, just the reverse proxy In the short term, I reconfigured it for http between cloudflare and nginx, when I get some time I'll dig into it.

e2m32 commented 7 months ago

Hey, thank you for your suggestions! I was able to get my main domain to work with cloudflare when I set the encryption mode to Flexible. I think there was an issue with the SSL cert that I created in Cloudflare and was using with Nginx Proxy Manager. I ended up using Nginx Proxy Manager to create a LetsEncrypt cert for me (using a DNS Edit API key) and started using that. Now I can use cloudflare's Full encryption mode 🙌

I went back to NGINX Home Assistant SSL proxy add-in so I could use it with tesla-http-proxy-addon and loaded the new SSL certs, followed the DOCS and was able to authenticate with tesla and my car! 🎉 My domain is now listed under keys in the car's display. So cool.

I restarted the tesla-http-proxy-addon , and attempted to link it with Tesla Custom Integration and then ran into another hiccup. 😞 After entering the requested info (Refresh token, etc), it fails to authenticate. There is no info in the tesla-http-proxy-addon logs. Just the following:

image

Any advise at this point?

My thoughts:

llamafilm commented 7 months ago

I don't think profile information is required in the scopes. Port 4430 is not used for anything in a standard HAOS installation. It sounds like this addon is working properly. Please enable debug logging from the Tesla integration and share the logs (in a formatted code block). The most common issue I see is the login_required error which means the refresh token has already been used. If that happens, you'll need to delete the car "device" and add it back.

By the way, there is no reason to redact a public key. It is by nature, public.

e2m32 commented 7 months ago

Got it! I removed the Tesla Custom integration and went through the entire process again, and now it is working! Thank you so much! 🚗♥🏠 again! :)

chowdarygm commented 7 months ago

edit: Ignore, this, created a new issue for better support.