[hue] Fix bridge certificate handling (openhab#20400)

* support v3 bridge intermediate certificate
* disable tls host name check when using ip address
* fix lifecycle bug when config changes
- decouple ssl settings from common http client
- ignore https host name before config params are set
* fix resource not found when called from another thread
* use trust manager for TLS
* v2+ bridge default to use full certificate validation

Signed-off-by: Andrew Fiddian-Green <software@whitebear.ch>

Author: andrewfg

bundles/org.openhab.binding.hue/doc/readme_v2.md

@@ -34,7 +34,10 @@ Bridge hue:bridge-api2:1 [ ipAddress="192.168.0.64", applicationKey="qwertzuiopa
 | ipAddress                | Network address of the Hue Bridge. **Mandatory**.                                                  |
 | applicationKey           | A code generated by the bridge that allows to access the API. **Mandatory**                        |
 | checkMinutes             | Interval in minutes between retrying the HTTP 2 and SSE connections. Default is 60. **Advanced**   |
-| useSelfSignedCertificate | Use self-signed certificate for HTTPS connection to Hue Bridge. Default is `true`. **Advanced**    |
+| useSelfSignedCertificate | Use self-signed certificate for HTTPS connection to Hue Bridge. Default is `false`. **Advanced**   |
+
+When `useSelfSignedCertificate` is true, it will trust whatever certificate is present on the Bridge for securing the HTTPS communication.
+Otherwise, the binding will validate the Bridge's certificate against that of the official Philips / Signify issuing Certificate Authority.
 
 ### Devices, Rooms, Zones, and Areas
 

bundles/org.openhab.binding.hue/src/main/java/org/openhab/binding/hue/internal/connection/Clip2Bridge.java

@@ -45,9 +45,11 @@
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReadWriteLock;
 import java.util.concurrent.locks.ReentrantReadWriteLock;
+import java.util.regex.Pattern;
 
 import javax.net.ssl.HttpsURLConnection;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
 import javax.ws.rs.core.MediaType;
 
 import org.eclipse.jdt.annotation.NonNullByDefault;
@@ -532,7 +534,8 @@ public void close() {
 
     /**
      * Static method to attempt to connect to a Hue Bridge, get its software version, and check if it is high enough to
-     * support the CLIP 2 API.
+     * support the CLIP 2 API. The bridge may redirect HTTP to HTTPS, but since we do not yet have the certificate
+     * configuration parameters for a real bridge, we implement a trustAll policy and disable host name verification.
      *
      * @param hostName the bridge IP address.
      * @return true if bridge is online and it supports CLIP 2, or false if it is online and does not support CLIP 2.
@@ -546,10 +549,6 @@ public static boolean isClip2Supported(String hostName) throws IOException {
         try {
             URL url = new URI(String.format(FORMAT_URL_CONFIG, hostName)).toURL();
             httpConnection = (HttpURLConnection) url.openConnection();
-            /*
-             * TODO we manually check if the bridge redirects to HTTPS, and if so, since v3 bridges
-             * currently don't provide a full certificate chain we force use of a TrustAllTrustManager
-             */
             httpConnection.setInstanceFollowRedirects(false);
             int status = httpConnection.getResponseCode();
             if (status == 301 || status == 302) {
@@ -559,6 +558,7 @@ public static boolean isClip2Supported(String hostName) throws IOException {
                     sslContext.init(null, new TrustAllTrustManager[] { TrustAllTrustManager.getInstance() }, null);
                     httpsConnection = (HttpsURLConnection) new URI(redirectUrl).toURL().openConnection();
                     httpsConnection.setSSLSocketFactory(sslContext.getSocketFactory());
+                    httpsConnection.setHostnameVerifier((hostname, session) -> true); // don't verify host name
                     try (InputStream in = httpsConnection.getInputStream()) {
                         response = new String(in.readAllBytes(), StandardCharsets.UTF_8);
                     }
@@ -620,20 +620,38 @@ public static boolean isClip2Supported(String hostName) throws IOException {
     private @Nullable Thread recreateThread;
     private @Nullable Future<?> checkAliveTask;
 
+    private static final String IPV4_PART = "(25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)";
+    private static final String IPV4_REGEX = "^(" + IPV4_PART + "\\.){3}" + IPV4_PART + "$";
+    private static final Pattern IPV4_PATTERN = Pattern.compile(IPV4_REGEX);
+
     /**
      * Constructor.
      *
      * @param httpClientFactory the OH core HttpClientFactory.
      * @param bridgeHandler the bridge handler.
+     * @param trustManagerProvider the Hue TLS trust manager provider
      * @param hostName the host name (ip address) of the Hue bridge
      * @param applicationKey the application key.
      * @throws ApiException if unable to open Jetty HTTP/2 client.
      */
-    public Clip2Bridge(HttpClientFactory httpClientFactory, Clip2BridgeHandler bridgeHandler, String hostName,
-            String applicationKey) throws ApiException {
+    public Clip2Bridge(HttpClientFactory httpClientFactory, Clip2BridgeHandler bridgeHandler,
+            HueTlsTrustManagerProvider trustManagerProvider, String hostName, String applicationKey)
+            throws ApiException {
         LOGGER.debug("Clip2Bridge()");
         httpClient = httpClientFactory.getCommonHttpClient();
-        http2Client = httpClientFactory.createHttp2Client("hue-clip2", httpClient.getSslContextFactory());
+        SslContextFactory sslContextFactory = new SslContextFactory.Client();
+        try {
+            SSLContext sslContext = SSLContext.getInstance("TLS");
+            sslContext.init(null, new TrustManager[] { trustManagerProvider.getTrustManager() }, null);
+            sslContextFactory.setSslContext(sslContext);
+        } catch (NoSuchAlgorithmException | KeyManagementException e) {
+            throw new ApiException("Could not initialize Hue SSL Context", e);
+        }
+        // don't verify host name when using an IP address since Hue certificates don't contain IP SANs
+        if (IPV4_PATTERN.matcher(hostName).matches()) {
+            sslContextFactory.setEndpointIdentificationAlgorithm("");
+        }
+        http2Client = httpClientFactory.createHttp2Client("hue-clip2", sslContextFactory);
         http2Client.setConnectTimeout(Clip2Bridge.TIMEOUT_SECONDS * 1000);
         http2Client.setIdleTimeout(-1);
         startHttp2Client();

bundles/org.openhab.binding.hue/src/main/java/org/openhab/binding/hue/internal/connection/HueTlsTrustManagerProvider.java

@@ -12,37 +12,42 @@
  */
 package org.openhab.binding.hue.internal.connection;
 
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
+import java.security.KeyStore;
+import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.util.Collection;
 
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509ExtendedTrustManager;
 
 import org.eclipse.jdt.annotation.NonNullByDefault;
 import org.eclipse.jdt.annotation.Nullable;
 import org.openhab.core.io.net.http.PEMTrustManager;
-import org.openhab.core.io.net.http.PEMTrustManager.CertificateInstantiationException;
 import org.openhab.core.io.net.http.TlsTrustManagerProvider;
 import org.openhab.core.io.net.http.TrustAllTrustManager;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
- * Provides a {@link PEMTrustManager} to allow secure connections to any Hue Bridge.
+ * Provides a {@link X509ExtendedTrustManager} to allow secure connections to any Hue Bridge.
  *
  * @author Christoph Weitkamp - Initial Contribution
+ * @author Andrew Fiddian-Green - Add support for intermediate certificates on V3 bridges
  */
 @NonNullByDefault
 public class HueTlsTrustManagerProvider implements TlsTrustManagerProvider {
 
-    private static final String PEM_CACERT_V1_FILENAME = "huebridge_cacert.pem";
-    private static final String PEM_CACERT_V2_FILENAME = "huebridge_cacert_v2.pem";
+    private static final String PEM_CACERT_FILENAME = "huebridge_cacert.pem";
     private final String hostname;
     private final boolean useSelfSignedCertificate;
-    private final boolean isBridgeV3orHigher;
 
     private final Logger logger = LoggerFactory.getLogger(HueTlsTrustManagerProvider.class);
 
@@ -51,21 +56,18 @@ public class HueTlsTrustManagerProvider implements TlsTrustManagerProvider {
     /**
      * Creates a new instance of {@link HueTlsTrustManagerProvider}.
      *
-     * See the documentation for more details about 'Signify private CA Certificates V1 and V2 for Hue Bridges'.
+     * See the documentation for more details about 'Signify private CA Certificates for Hue Bridges'.
      *
      * @see <a href=
      *      "https://developers.meethue.com/develop/application-design-guidance/using-https/">https://developers.meethue.com/develop/application-design-guidance/using-https/</a>
      *
-     * @param hostname the hostname of the Hue Bridge
+     * @param hostname the host name of the Hue Bridge
      * @param useSelfSignedCertificate true, to use the self-signed certificate downloaded from the Hue Bridge;
-     *            false, to use the Signify private CA Certificate V1 or V2 for Hue Bridges from resources
-     * @param isBridgeV3orHigher true, to use the 'Signify private CA Certificate V2 for Hue Bridges';
-     *            false, to use the 'Signify private CA Certificate V1 for Hue Bridges'
+     *            false, to use the Signify private CA Certificate(s) for Hue Bridges from resources
      */
-    public HueTlsTrustManagerProvider(String hostname, boolean useSelfSignedCertificate, boolean isBridgeV3orHigher) {
+    public HueTlsTrustManagerProvider(String hostname, boolean useSelfSignedCertificate) {
         this.hostname = hostname;
         this.useSelfSignedCertificate = useSelfSignedCertificate;
-        this.isBridgeV3orHigher = isBridgeV3orHigher;
     }
 
     @Override
@@ -87,50 +89,80 @@ public X509ExtendedTrustManager getTrustManager() {
         if (localTrustManager != null) {
             return localTrustManager;
         }
-
-        // TODO V3 bridges currently don't provide the full certificate chain (missing intermediate certificate)
-        if (isBridgeV3orHigher) {
-            logger.error("Hue V3 Bridge has incomplete PEM certificate chains - defaulting to a TrustAllTrustManager");
-            return TrustAllTrustManager.getInstance();
-        }
-
         try {
             if (useSelfSignedCertificate) {
                 logger.trace("Use self-signed certificate downloaded from Hue Bridge.");
                 // use self-signed certificate downloaded from Hue Bridge
                 localTrustManager = PEMTrustManager.getInstanceFromServer("https://" + getHostName());
             } else {
-                logger.trace("Use Signify private CA Certificate for Hue Bridges from resources.");
-                // use Signify private CA Certificate V1 or V2 for Hue Bridges from resources
-                localTrustManager = getInstanceFromResource(
-                        isBridgeV3orHigher ? PEM_CACERT_V2_FILENAME : PEM_CACERT_V1_FILENAME);
+                logger.trace("Use Signify private CA Certificate(s) for Hue Bridges from resources.");
+                // use Signify private CA Certificate(s) for Hue Bridges from resources
+                localTrustManager = getInstanceFromResource(PEM_CACERT_FILENAME);
             }
             this.trustManager = localTrustManager;
         } catch (CertificateException | MalformedURLException e) {
-            logger.debug("An unexpected exception occurred: {}", e.getMessage(), e);
+            logger.warn("An unexpected exception occurred: {}", e.getMessage(), e);
         }
         return localTrustManager;
     }
 
     /**
-     * Creates a {@link PEMTrustManager} instance by reading the PEM certificate from the given file.
-     * This is useful if you have a private CA Certificate stored in a file.
+     * Creates a {@link X509ExtendedTrustManager} instance by reading one or more PEM certificates from the given
+     * file. The returned trust manager will trust all certificates that are signed by any of the certificates in
+     * the PEM file, including certificates with intermediates. This is useful if you have private CA Certificate(s)
+     * stored in a file.
      *
-     * @param fileName name to the PEM file located in the resources folder
-     * @return a {@link PEMTrustManager} instance
-     * @throws CertificateInstantiationException
+     * @param fileName name of the PEM file located in the resources folder
+     * @return a {@link X509ExtendedTrustManager} instance
+     * @throws CertificateException
      */
-    private PEMTrustManager getInstanceFromResource(String fileName) throws CertificateException {
-        String pemCert = readPEMCertificateStringFromResource(fileName);
-        if (pemCert != null) {
-            return new PEMTrustManager(pemCert);
+    private X509ExtendedTrustManager getInstanceFromResource(String fileName) throws CertificateException {
+        String certificatesString = readPEMCertificatesStringFromResource(fileName);
+        if (certificatesString == null) {
+            throw new CertificateException("Certificate resource '" + fileName + "' not found or not accessible.");
+        }
+        try {
+            CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+            // load all certificates from the PEM file
+            Collection<? extends Certificate> certificates;
+            try (InputStream input = new ByteArrayInputStream(certificatesString.getBytes(StandardCharsets.UTF_8))) {
+                certificates = certificateFactory.generateCertificates(input);
+            }
+            if (certificates.isEmpty()) {
+                throw new CertificateException("No certificates found in " + fileName);
+            }
+            // build a key store containing all the certificates
+            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+            keyStore.load(null, null);
+            int index = 0;
+            for (Certificate cert : certificates) {
+                keyStore.setCertificateEntry("cert-" + index++, cert);
+            }
+            // build a trust manager from this key store
+            TrustManagerFactory trustManagerFactory = TrustManagerFactory
+                    .getInstance(TrustManagerFactory.getDefaultAlgorithm());
+            trustManagerFactory.init(keyStore);
+            for (TrustManager trustManager : trustManagerFactory.getTrustManagers()) {
+                if (trustManager instanceof X509ExtendedTrustManager x509) {
+                    return x509;
+                }
+            }
+            throw new CertificateException("No X509ExtendedTrustManager available.");
+        } catch (Exception e) {
+            throw new CertificateException("Failed to load certificates: " + e.getMessage(), e);
         }
-        throw new CertificateInstantiationException(
-                String.format("Certificate resource '%s' not found or not accessible.", fileName));
     }
 
-    private @Nullable String readPEMCertificateStringFromResource(String fileName) {
-        URL resource = Thread.currentThread().getContextClassLoader().getResource(fileName);
+    /**
+     * Reads the content of a PEM file from the resources folder and returns it as a string. It may contain multiple
+     * certificates, e.g. a certificate chain with intermediate certificates. If the file is not found or cannot be
+     * read, null is returned.
+     *
+     * @param fileName name of the PEM file located in the resources folder
+     * @return the content of the PEM file as a string, or null if the file is not found or cannot be read
+     */
+    private @Nullable String readPEMCertificatesStringFromResource(String fileName) {
+        URL resource = HueTlsTrustManagerProvider.class.getClassLoader().getResource(fileName);
         if (resource != null) {
             try (InputStream certInputStream = resource.openStream()) {
                 return new String(certInputStream.readAllBytes(), StandardCharsets.UTF_8);

bundles/org.openhab.binding.hue/src/main/java/org/openhab/binding/hue/internal/handler/Clip2BridgeHandler.java

@@ -206,7 +206,12 @@ private synchronized void checkConnection() {
             getClip2Bridge().testConnectionState();
             updateSelf(); // go online
         } catch (HttpUnauthorizedException unauthorizedException) {
-            logger.debug("checkConnection() {}", unauthorizedException.getMessage(), unauthorizedException);
+            Clip2BridgeConfig config = getConfigAs(Clip2BridgeConfig.class);
+            if (config.applicationKey.isBlank()) {
+                logger.debug("checkConnection() no application key configured");
+            } else {
+                logger.debug("checkConnection() {}", unauthorizedException.getMessage(), unauthorizedException);
+            }
             if (applKeyRetriesRemaining > 0) {
                 updateStatus(ThingStatus.OFFLINE, ThingStatusDetail.CONFIGURATION_ERROR,
                         "@text/offline.api2.conf-error.press-pairing-button");
@@ -491,6 +496,12 @@ public void initialize() {
     private void initializeAssets() {
         logger.debug("initializeAssets() {}", this);
         synchronized (this) {
+            ServiceRegistration<?> temp = trustManagerRegistration;
+            if (temp != null) {
+                temp.unregister();
+                trustManagerRegistration = null;
+            }
+
             Clip2BridgeConfig config = getConfigAs(Clip2BridgeConfig.class);
 
             String ipAddress = config.ipAddress;
@@ -512,10 +523,8 @@ private void initializeAssets() {
                 return;
             }
 
-            String modelId = thing.getProperties().get(Thing.PROPERTY_MODEL_ID);
-            boolean useSignifyCaCertificateVersion2 = modelId != null && HueBridgeModel.getGeneration(modelId) >= 3;
             HueTlsTrustManagerProvider trustManagerProvider = new HueTlsTrustManagerProvider(ipAddress + ":443",
-                    config.useSelfSignedCertificate, useSignifyCaCertificateVersion2);
+                    config.useSelfSignedCertificate);
 
             if (Objects.isNull(trustManagerProvider.getPEMTrustManager())) {
                 updateStatus(ThingStatus.OFFLINE, ThingStatusDetail.CONFIGURATION_ERROR,
@@ -530,7 +539,7 @@ private void initializeAssets() {
             applicationKey = Objects.nonNull(applicationKey) ? applicationKey : "";
 
             try {
-                clip2Bridge = new Clip2Bridge(httpClientFactory, this, ipAddress, applicationKey);
+                clip2Bridge = new Clip2Bridge(httpClientFactory, this, trustManagerProvider, ipAddress, applicationKey);
             } catch (ApiException e) {
                 logger.trace("initializeAssets() communication error on '{}'", ipAddress, e);
                 setStatusOfflineWithCommunicationError(e);
@@ -751,7 +760,7 @@ private void updateSelf() {
      */
     private void updateThingFromLegacy() {
         if (isInitialized()) {
-            logger.warn("Cannot update bridge thing '{}' from legacy since handler already initialized.",
+            logger.debug("Cannot update bridge thing '{}' from legacy since handler already initialized.",
                     thing.getUID());
             return;
         }

bundles/org.openhab.binding.hue/src/main/java/org/openhab/binding/hue/internal/handler/HueBridgeHandler.java

@@ -698,7 +698,7 @@ public void initialize() {
                     scheduler.submit(() -> {
                         // register trustmanager service
                         HueTlsTrustManagerProvider tlsTrustManagerProvider = new HueTlsTrustManagerProvider(
-                                ip + ":" + hueBridgeConfig.getPort(), hueBridgeConfig.useSelfSignedCertificate, false);
+                                ip + ":" + hueBridgeConfig.getPort(), hueBridgeConfig.useSelfSignedCertificate);
 
                         // Check before registering that the PEM certificate can be downloaded
                         if (tlsTrustManagerProvider.getPEMTrustManager() == null) {

bundles/org.openhab.binding.hue/src/main/resources/OH-INF/thing/bridge.xml

@@ -94,7 +94,7 @@
 			<parameter name="useSelfSignedCertificate" type="boolean">
 				<label>Use Self-Signed Certificate</label>
 				<description>Use self-signed certificate for HTTPS connection to Hue Bridge.</description>
-				<default>true</default>
+				<default>false</default>
 				<advanced>true</advanced>
 			</parameter>
 		</config-description>