ClearCenter has posted a blog on this as well. Congratz Fredrik!

https://www.clearcenter.com/blogs/timeline

Hi Fred,

I've purchased the app. Great job !!
The only thing i'm missing at this moment is the service job in the menu https://www.serverid:81/app/services

If this a feature for the future ?

For the https i'm using an External SSL (LetEncrypt). Can i change some the path to the script or maybe you can make a setting in the config menu ?

Patrick,
You should be able to see Domoticz among the services. See screenshot from my testserver:

I tend to remember that you did your own init.d script before. Did you erase that one before you installed app-domoticz? I guess there could be some interfering things otherwise.

When it comes to SSL, I am not sure I understand how your setup works. Can you explain a bit more?

/Fred

Fredrik Fornstad wrote:

Patrick,
You should be able to see Domoticz among the services. See screenshot from my testserver:

I tend to remember that you did your own init.d script before. Did you erase that one before you installed app-domoticz? I guess there could be some interfering things otherwise.

When it comes to SSL, I am not sure I understand how your setup works. Can you explain a bit more?

/Fred

It is working now.
I've uninstalled the app, removed the /init.d/domoticz and did a re-install.

About the SSL.
The SSL connection is not using my LetsEncrypt certificate, but i think the standard ClearOS certificate.
This is causing the connection to be "Unsave", because it is using the wrong certificate.
Where can i change the location of the certifcate for Domoticz to use.

In Webconfig you can choose which certifcate to use

Patrick,
Domoticz has its own webserver, and in the current (default) setup, it uses its own domoticz certificate. But it can be changed. Read on.

In my first beta, I actually had a possibility for the user to specify what certificate files to use with domoticz but I removed it after feedback from the ClearOS team (to simplify the interface). Then the idea was to let ClearOS do all the access control by having it act as a reverse proxy and that would have solved "everything". However, that turned out not possible with all the different use cases.

Domoticz is a bit picky about what formats of certificates it will accept. I need to work on this a bit (and check with the ClearOS team maybe) before I can make a general improvement here that could use the selected certificate files in the general ClearOS setup.

In the mean time you can try this, logged in as "root" (You will need to force a refresh in your browser afterwards. I am not sure it will work, and I am just guessing where your private key and cert are located):

cp -a /var/domoticz/server_cert.pem /var/domoticz/server_cert.pem.original

cat /etc/letsencrypt/live/privkey.pem /etc/letsencrypt/live/fullchain.pem /etc/dhparams.pem > /var/domoticz/server_cert.pem

systemctl restart domoticz

If this works (please let me know), then you will have to repeat this whenever your letsencrypt SSL-keys are updated (I think it is evey 90 days).

If it does not work, or if you want to revert back to the default setup for any other reason do this (as root):

mv /var/domoticz/server_cert.pem.original /var/domoticz/server_cert.pem

systemctl restart domoticz

/Fred

Hi Fred,

This worked.

cp -a /var/domoticz/server_cert.pem /var/domoticz/server_cert.pem.original

cat /etc/letsencrypt/live/pdebrabander.nl/privkey.pem /etc/letsencrypt/live/pdebrabander.nl/fullchain.pem > /var/domoticz/server_cert.pem

systemctl restart domoticz

You need to add you domainname in the directory structure.
I cycle every months to be sure i've a valid certificate.
For this i've made a small script to update the certificate and copy the renewed certificates to the HTTP and Webconfig directories

Patrick,
Nice to hear it works.

I am still investigating what I can do to make the certificate handling more integrated with ClearOS. My thinking is now a two step approach:
1. Release an update soon (on its way now, may take a day or so before it is rolled out) where I will simplify things a bit by removing the need to fiddle around with DH-parameters (see explanation below)
2. Release another update later on (weeks) if I can find a good way to introduce a more integrated solution with ClearOS for the certificates

The way domoticz is currently configured, it expects the server_cert.pem file to contain DH-parameters at the end of the file. But you did not include the content from the /etc/dhparam.pem file (that file only exist on your server if ftp has been installed, so you might be missing it). This means that your Domoticz log will throw a warning at startup that DH file parameters are missing. Your browser might also give you some warning message. In an upcoming update of app-domoticz I will take care of the DH parameter part, so if it is working for you now I suggest you wait for that.

If you absolutely want to add DH parameters to you newly added server_cert.pem file before I release the update you can do this (as root):

cd /home/<your-normal-user-here-where-the-file-will-be-stored>

openssl dhparam -out dhparameters.pem 2048

It takes maybe 5 minutes to generate the file (CPU dependent) so be patient.
When the file has been generated you can add its content to your certificate file that is missing the DH-parameters:

cat dhparameters.pem >> /var/domoticz/server_cert.pem

systemctl restart domoticz

/Fred

Hi Fred,

I have indead not the FTP server installed and no file on the server called "dhparam"
The HTTPS site of Domoticz is working now with my SSL certificate and is not giving any errors in log file or accessing the site.

Any additional functionality is always welcome.
I find the standard apps in ClearOS somethime to lean. (lack of options to configure in webconfig)
May you can make submenus to make it look more organized.

A heads up:
I have now integrated the SSL-certificate handling with ClearOS and made it possible for the user to select one of the following:

1. The same SSL Certificate that is used for ClearOS webconfig/webserver etc. Any update in ClearOS will automatically be copied to Domoticz.
2. Standard Domoticz SSL certificate that is shipped with Domoticz
3. Customized SSL certificate pem-file. The user will need to edit the pem file to make it contain the correct certificates. Help text is available in the documentation.

Option1. is the default, and I think it should work for Patrick as well, and normally no one should really need option 3.

I have this build in beta test right now, and MAYBE it can be released tomorrow, but I will test it with the ClearOS 7.3 version first.

NOTE for Patrick: the upgrade MIGHT reset any change of portnumber, logrotation and attack detector setting that you might have done for the Domoticz application (only the parts done in ClearOS webconfig. Nothing within the Domoticz will be affected.) Sorry for that. This was a neccessary thing in order to introduce the SSL-settings. So keep an eye open the coming two days or so.

/Fred

Hi Fred,

How the updates are working for this app.
I see version 3.1-2.v7 is available at http://koji.clearos.com/koji/builds, but i've still 3.0-1 installed.

No worries about the settings, i'm glad to help testing

Patrick,
The version 3.1-2.v7 is the version that I am testing right now and (hopefully) it is that version that is released very soon. You have the released version which is still 3.0-1 .

Forgot to say, since you updated the /var/domoticz/server_cert.pem file you will need to restore it (after the upgrade) if you want to use the "domoticz standard SSL cert".

mv /var/domoticz/server_cert.pem.original /var/domoticz/server_cert.pem

should do the trick I guess.

If you need to use the "customized SSL" option after the upgrade, the file to edit is /var/domoticz/server_cert_custom.pem

/Fred

Fredrik Fornstad wrote:

Patrick,
The version 3.1-2.v7 is the version that I am testing right now and (hopefully) it is that version that is released very soon. You have the released version which is still 3.0-1 .

Forgot to say, since you updated the /var/domoticz/server_cert.pem file you will need to restore it (after the upgrade) if you want to use the "domoticz standard SSL cert".

mv /var/domoticz/server_cert.pem.original /var/domoticz/server_cert.pem

should do the trick I guess.

If you need to use the "customized SSL" option after the upgrade, the file to edit is /var/domoticz/server_cert_custom.pem

/Fred

Hi Fred,

I've updated Domoticz and app-domoticz.
When i choose "Same as for this ClearOS server" or Custom (after reading the documentation) both are giving the SSL page offline.
I must do something wrong, but at least the same as ClearOS should be working out of the box.

Patrick,
If you get the screen below "Domoticz Offline", then it is most likely your browser cache that needs to be refreshed (press <Ctrl> + <F5> ). This is due to that Domoticz is using your browser cache for its html5 coding, and if the code in your browser cache cannot communicate with Domoticz then you get this message. It can also happen if the Domoticz server is not running any longer. In your case I think a browser refresh should do the trick.

/Fred

Fredrik Fornstad wrote:

Patrick,
If you get the screen below "Domoticz Offline", then it is most likely your browser cache that needs to be refreshed (press <Ctrl> + <F5> ). This is due to that Domoticz is using your browser cache for its html5 coding, and if the code in your browser cache cannot communicate with Domoticz then you get this message. It can also happen if the Domoticz server is not running any longer. In your case I think a browser refresh should do the trick.

/Fred

Hi Fred,

Thanks. That worked.

Hello Fred,

I've received the follow error last night, which i think i caused by the upgrade to ClearOS 7.3 final.

/etc/cron.daily/update_clearos_cert_in_domoticz:



cat: SSLCertificateKeyFile: No such file or directory

/etc/cron.daily/update_clearos_cert_in_domoticz: line 17: $'\302\240exit\302\2401': command not found

Error opening Certificate SSLCertificateFile

140563512391584:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('SSLCertificateFile','r')

140563512391584:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:

unable to load certificate

/etc/cron.daily/update_clearos_cert_in_domoticz: line 19: $'\302\240exit\302\2401': command not found

See this link for more info : LINK

Patrick,
Yes it is probably related to that last minute change. I am not using your setup, so I have not experienced it.

The reason why you get the error is that the file /usr/clearos/sandbox/etc/httpd/conf.d/framework.conf does not contain a valid certificate file name after a heading "SSLCertificateKeyFile". That should normally never happen... But I am not sure exactly what the clearos team did with this "last minute change"...

Please check the file /usr/clearos/sandbox/etc/httpd/conf.d/framework.conf . Does it contain valid entries for:

SSLCertificateFile
SSLCertificateKeyFile
SSLCertificateChainFile (might be missing, and that is OK)
SSLCACertificateFile (might be missing, and that is OK)

If you find the "SSL-keywords" with a valid file path after them, then please check that the actual files exist.
Example: It should look something like this:

SSLCertificateFile /etc/pki/CA/sys-0-cert.pem

SSLCertificateKeyFile /etc/pki/CA/private/sys-0-key.pem

SSLCACertificateFile /etc/pki/CA/ca-cert.pem

In this example, please check that the files /etc/pki/CA/sys-0-cert.pem , /etc/pki/CA/private/sys-0-key.pem and /etc/pki/ca-cert.pem actually exist.

EDIT: I looked a bit closer to the code. I am pretty sure that you have something like this in your file:

SSLCertificateKeyFile SSLCertificateKeyFile

(That is, the SSL-keyword appears twice on the same line)


The content of the file /usr/clearos/sandbox/etc/httpd/conf.d/framework.conf should normally only be changed by the ClearOS webconfig settings. App-domoticz will NEVER change it, only read the information in order to use copy the certificate for domoticz usage too. However, this time it did not work for you for some reason...

/Fred

Hi Fred,

I'd already changed this files, because the webconfig certificate was not working any more.
This function was removed by the ClearOS team after 7.3b3.


In the files /usr/clearos/sandbox/etc/httpd/conf.d/framework.conf i now have the following:

    

SSLCertificateFile /etc/clearos/certificate_manager.d/LetsEncrypt.crt

SSLCertificateKeyFile /etc/clearos/certificate_manager.d/LetsEncrypt.key

The webconfig certificate is working again, but Domoticz not at the SSL port

Patrick,
app-domoticz should "fix itself" in 24 hours.
But you can force an update by selecting "Edit" in the app-domoticz and then press "Update" (no need to change parameters).

/Fred

Fredrik Fornstad wrote:

Patrick,
app-domoticz should "fix itself" in 24 hours.
But you can force an update by selecting "Edit" in the app-domoticz and then press "Update" (no need to change parameters).

/Fred

Fred,

Somehow, it is not working.

In the log file is see this:

2017-03-05 15:56:43.480  Startup Path: /usr/share/domoticz/

2017-03-05 15:56:43.480  Startup delay... waiting 0 seconds...

2017-03-05 15:56:43.493  Sunrise: 07:20:00 SunSet:18:29:00

2017-03-05 15:56:43.493  EventSystem: reset all events...

2017-03-05 15:56:43.495  Active notification subsystems: email, lms, prowl (3/12)

2017-03-05 15:56:43.500  WebServer(HTTP) started on address: :: with port 9200

2017-03-05 15:56:43.501  Error: WebServer(SSL) startup failed on address 0.0.0.0 with port: 9300: use_certificate_chain_file: no start line

2017-03-05 15:56:43.501  Error: WebServer(SSL) check if no other application is using port: 9300

2017-03-05 15:56:43.501  Proxymanager started.

I've updated fromework.conf and added the SSLCertificateChainFile and SSLCACertificateFile at several ways
For example:

SSLCertificateFile /etc/clearos/certificate_manager.d/LetsEncrypt.crt

    SSLCertificateKeyFile /etc/clearos/certificate_manager.d/LetsEncrypt.key

    SSLCertificateChainFile /etc/letsencrypt/live/pdebrabander.nl/fullchain.pem

    SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

Patrick,
Yes, something is not OK in your setup now. I suggest you do this:
1. Restore the file /usr/clearos/sandbox/etc/httpd/conf.d/framework.conf so that it only contains the only two rows that you have used before.
2. Run this from command line (as root):

/bin/rm -rf /var/domoticz/server_cert_clearos.pem

/bin/cp -a /var/domoticz/server_cert.pem server_cert_clearos.pem

3. Go to the webconfig ->app-domoticz and press "Edit" and then press "Update" (I assume you have selected SSL cert = "Same as for this ClearOS server")
4. Look at the Domoticz log (restart it if neccessary)

Now it should be ok (if your SSL-cert itself is OK, which I guess it is).
/Fred

Edit: I had some trouble with this forum-page and posted an incorrect command sequence first. Sorry about that. The above is correct (I hope )
Edit again: Sorry. I thought the "Edit" + "Update" would actually update the cert. It does not. You will need to run (as root) at the command line:

run-parts /etc/cron.daily

or wait until cron daily is run automatically. After that it SHOULD work.

Fredrik Fornstad wrote:

Patrick,
Yes, something is not OK in your setup now. I suggest you do this:
1. Restore the file /usr/clearos/sandbox/etc/httpd/conf.d/framework.conf so that it only contains the only two rows that you have used before.
2. Run this from command line (as root):

/bin/rm -rf /var/domoticz/server_cert_clearos.pem

3. Go to the webconfig ->app-domoticz and press "Edit" and then press "Update" (I assume you have selected SSL cert = "Same as for this ClearOS server")
4. Look at the Domoticz log (restart it if neccessary)

Now it should be ok (if your SSL-cert itself is OK, which I guess it is).
/Fred

Unfortunately, is this also not working.
I've restored the original framework.conf file and after this the framework files working with my Letsencrypt cert.
ClearOS webconfig is working nively with the Letsencrypt certificate, but both configurations are not working with Domoticz.

Shame that the certificate was working perfectly in 7.3b3 and due a change by ClearOS now not working any more

Patrick,
Oh, you managed to get the unfinished reply that I posted. I had some browser issues (or maybe a problem with the ClearOS forum server) so I posted the unfinished post. I corrected it, but you managed to get started with the uncomplete version...

Please look again at my post or just add:

/bin/cp -a /var/domoticz/server_cert.pem server_cert_clearos.pem

run-parts /etc/cron.daily

/Fred

Fredrik Fornstad wrote:

Patrick,
Oh, you managed to get the unfinished reply that I posted. I had some browser issues (or maybe a problem with the ClearOS forum server) so I posted the unfinished post. I corrected it, but you managed to get started with the uncomplete version...

Please look again at my post or just add:

/bin/cp -a /var/domoticz/server_cert.pem server_cert_clearos.pem

run-parts /etc/cron.daily

/Fred

Fred,

Domoticz in SSL is working again. Thanks for yor your support !!!

I've found the problem, because the problem accured during running "run-parts /etc/cron.daily/update_clearos_cert_in_domoticz.
You are using the grep command to get the certificate file and i had comment out the original settings with a #

#    SSLCertificateFile /usr/clearos/sandbox/etc/httpd/conf/server.crt

#    SSLCertificateKeyFile /usr/clearos/sandbox/etc/httpd/conf/server.key

    SSLCertificateFile /etc/clearos/certificate_manager.d/LetsEncrypt.crt

    SSLCertificateKeyFile /etc/clearos/certificate_manager.d/LetsEncrypt.key

After removing the # lines it is working again.

Patrick,
Nice to hear that it is working again. I have already made a couple of tweaks in my development branch so the code will be a bit more robust in the next release of app-domoticz (I have nothing planned right now so it may take some time).
/Fred

Hi Fred,

i've still one issue.
Since the latest update to domoticz-3.5877-6.v7, i've problems to connecting to the Toon Thermostat.
It is repsonding, but giving a login error.
When i remove it, i'm not able to re-install it. I've seen on the Domoticz forum, that is a error which occur more often but was solved in later Beta version.


--------- UPDATE --------
Toon Thermostat is working again after a reset (sorry)


it looks that the RPM in not containing the /usr/share/open-zwave/config content.
The directory is not made, but the link is available in /usr/share/domoticz

it looks that the RPM in not containing the /usr/share/open-zwave/config content.
The directory is not made, but the link is available in /usr/share/domoticz

Not sure if I understand you correctly. But I will try to explain how it designed today:
The domoticz source code requires the libopenzwave installation to be in place to enable z-wave, which is fine. However, then it supplies its own copy of the libopenzwave files which if you ask me is not how things should be done. Furthermore, domoticz require those libopenzwave files to be in its own "home directory". I guess this works if you compile all the stuff yourself, but it tends to get very nasty in a modular environment using rpm or apt.

I have solved it by omitting the domoticz version of the libopenzwave config files at compile time of the domoticz.rpm, and instead create a soft link pointing to the /usr/share/open-zwave/config directory instead where the "original" libopenzwave files reside.

So:
1. domoticz.rpm requires libopenzwave.rpm at installation time
2. libopenzwave.rpm creates the directory (and the content in it) /usr/share/open-zwave/config
3. domoticz.rpm creates the directory /usr/share/domoticz (and the soft link to /usr/share/open-zwave/config "fooling" domoticz that the config files are under /usr/share/domoticz/config)

In this way libopenzwave can be updated with new config files (as long as we are talking stepping of the minor version) while still having the same domoticz version. Since new z-wave config files are added at least every week and domoticz is not released more often than once or twice a year, this will allow a possibility to keep the environment up to date. However, if/when libopenzwave API is changed then the release needs to be syncronized with a new domoticz release. I will look after that part.

/Fred

Hello Fred,

The certificate manager has been updated and the custom SSL certificate option has been put back as an option.
Now of course this not working any more with Domoticz.

I will see what I can do to make the domoticz certificate handling to work better with the new ClearOS customized certificate system.
I am quite busy right now, so it will likely take 1-2 weeks.
/Fred

Well, I had a quick look at it and it was easier to fix the certificate problem than I thought. A new version of app-domoticz is just built. I might ask for it to be released already tomorrow, we will see. However, as before the Domoticz certificate handling is not integrated into the clearos-certificate-manager. It will still give you 3 choices:

1. The same certificate that is used by the ClearOS server (Webconfig). If this changes (for instance by the clearos certificate-manager) it may take up to 24 hours until the change is cascaded to Domoticz. You can force the cascading by pressing "Edit" and then "Update" at the app-domoticz webconfig page. (No need to change the parameters.)

2. The standard certificate that ships with Domoticz

3. A customized certificate that the user need to prepare himself (read the instructions in the app-domoticz documentation that is available from the webconfig page)

/Fred

Hi Fred,

I'm getting a notification in the Domoticz contralpage that there is an update available.
Can i run this upgrade or do you need make the update through marketplace ?

I am travelling so I Will not be able to release the update until mid next week or so...

Upgrades are only possible via the marketplace.

/Fred