Missing support for TPAP encryption type · Issue #1590 · python-kasa/python-kasa · GitHub

"TPAP" encryption type is not supported

A new encryption type TPAP has been reported on some devices and it is not currently supported.
This is a known issue, so if your device is already listed in the list below, please refrain from commenting if you don't have more details about how we can get this supported.
Instead, you can subscribe this issue to get updated when something changes, or just click that thumbs up for visibility.

List of known devices & firmwares using TPAP

TAPO RV 30 Max v1.3.0 (Missing support for TP-Link TPAP encryption (RV30, P100, ..) home-assistant/core#154300)
Some P100 firmwares (toggling 3rd party support might help to fix it)

Original issue text

from home-assistant/core#154300

After firmware upgrade of my two RV30-Max to Version 1.3.0 Build 250909 Rel.135514 the connection no longer works:

Verbindungsfehler: Unsupported device 192.168.0.84 of type SMART.TAPOROBOVAC with encrypt_scheme EncryptionScheme(is_support_https=True, encrypt_type='TPAP', http_port=4433, lv=2)

kasa --host 192.168.0.84 discover raw
Discovering device 192.168.0.84 for 10 seconds
{
"discovery_response":{
	"result":{
		"device_id":"xxx",
		"owner":"xxx",
		"device_type":"SMART.TAPOROBOVAC",
		"device_model":"RV30 Max(UN)",
		"ip":"192.168.0.84",
		"mac":"xxx",
		"is_support_iot_cloud":true,
		"tpap":{
			"tls":2,
			"dac":1,
			"noc":1,
			"pake":[
				2
			],
			"port":4433
		},
		"obd_src":"tplink",
		"protocol_version":1,
		"factory_default":false,
		"mgt_encrypt_schm":{
			"is_support_https":true,
			"http_port":4433,
			"encrypt_type":"TPAP",
			"lv":2
		}
	},
	"error_code":0
	},
	"meta":{
		"ip":"192.168.0.84",
		"port":20002
	}
}
Raised error: Unsupported device 192.168.0.84 of type SMART.TAPOROBOVAC with encrypt_scheme EncryptionScheme(is_support_https=True, encrypt_type='TPAP', http_port=4433, lv=2)

kasa --host 192.168.0.84 --username xxx --password xxx discover config
Attempt to connect to 192.168.0.84 with SmartProtocol + KlapTransportV2 + SmartDevice + https failed
Attempt to connect to 192.168.0.84 with IotProtocol + KlapTransport + IotPlug + http failed
Attempt to connect to 192.168.0.84 with SmartProtocol + KlapTransportV2 + SmartDevice + http failed
Attempt to connect to 192.168.0.84 with SmartProtocol + SslTransport + SmartDevice + https failed
Attempt to connect to 192.168.0.84 with SmartCamProtocol + SslAesTransport + SmartCamDevice + https failed
Attempt to connect to 192.168.0.84 with SmartProtocol + AesTransport + SmartDevice + http failed
Attempt to connect to 192.168.0.84 with IotProtocol + XorTransport + IotPlug + http failed
Unable to connect to 192.168.0.84

It looks like another new encryption protocol. I haven't seen TPAP before, kind of like the new_klap for the older IOT devices. I can look around inside the APK and see if I can find anything to do with it, maybe pull something together like I did for new_klap, @rytilahti if you're ok with me giving it a shot and @unze if you're ok with being a guinea pig?

Sounds good to me! I'm happy to be your guinea pig and give it a shot.

@rytilahti @unze Ok, so far, I've been digging into this quite a bit. There are two methods of authentication for TPAP.

UNOC: This uses Cloud derived information and calls to create client certificates with Tapo Cloud and stores those certificates to be used for device communication.

SPAKE2+: This uses cloud derived username and password information to handle the authentication.

Now, SPAKE2+ seems like the better choice for python-kasa because it does not require any stored information, but the usage of which authentication method is based on the device. Based on the device information you provided above, we can use SPAKE2+ without any additional certificate verification methods, but this is not guaranteed for all devices and this authentication method.

With all of this in mind, my plan is to do as follows:

I will implement the full aspect of the SPAKE2+ authentication for TPAP. This will handle the username and password authentication and the optional certificate check based on the device information. This should be the easiest and most straightforward.
I will implement the full NOC authentication for TPAP. I will make it so that the python-kasa library will provide the certificate information from the cloud and have it read-able by 3rd-Party Systems, i.e. my Homebridge Plugin or Home Assistant and that way they can later be used in device calls without having to create new certificates each time as long as the keys and everything match.

This will take some time, but so far so good and once I have something that I will be able to test, I will let you know.

Ok, I believe I have the base framework for everything. I still have some variable values to figure out, but should be able to get those squared away.

I have the base TPAP transport framework, if the device has encryption type TPAP it should be chosen. There are essentially three paths inside of the transport and the encryption information from discovery will be used to determine the path.

UNOC - This uses TPLink Cloud created certificates with a TPLink Cloud userToken to authenticate with the device certificates.
SPAKE2+ with DAC - This is username and password authentication with device attestation using a certificate on the device.
SPAKE2+ without DAC - This is username and password authentication without the device attestation.

My thoughts with all of this is to have UNOC a two step process:

Get the client side certificates and store them for later use.
Use the stored client side certificates, get the userToken, and then pass all of that to authenticate with the device.

I am still working on all of the certificate pieces and the userToken generation. I am also working on the actual encryption ciphers and handling of all paths. I also need to figure out how to handle this from the CLI side of things as well since getting and storing certificates may be difficult for users and since python-kasa does not really store device sessions or anything, the library itself cannot handle this.

I believe I am close to having something for testing, but I will let everyone know as I move along.

In the meantime, if someone with one of the plugs that is having the issue can get me the debug output like the above output for the robot vacuum, that would be helpful as well. I need to be able to understand a little better about the different devices and how they're being handled. I don't have the Tapo Plugs or a Robot Vacuum, so I'm flying blind for a lot of this but hopefully we can get something working.

@unze @rytilahti Ok, I think I have it. I will be sending everything up and creating a PR shortly.

Ok, I have PR[#1592] started. If someone can check it out using the gh cli and see if they can communicate with their devices that were previously unable to communicate with.

git clone https://github.com/python-kasa/python-kasa.git
cd python-kasa
gh pr checkout 1592
uv sync --all-extras
uv run kasa --username 'USERNAME' --password 'PASSWORD' --debug --host IP_ADDRESS discover config

Hi,
tested with:

git clone ... (as described)
cd python-kasa

git fetch origin pull/1592/head:review/1592
git checkout review/1592

shamefully cannot use 'gh' command for some reason, please lmk if the way I used is ok, too
but if not, another one has to test, I can't install / use that 'gh' cmd

then continued:
python -m venv <path-to-python_kasa>
uv sync --all-extras
uv run kasa ... (as described)

Exception thrown:

Raised error: ('Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:4433 ssl:<ssl.SSLContext object at 0x7fff7e02c370> [[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)]',
ClientConnectorSSLError(ConnectionKey(host='XXX.XXX.XXX.XXX', port=4433, is_ssl=True, ssl=<ssl.SSLContext object at 0x7fff7e02c370>, proxy=None, proxy_auth=None, proxy_headers_hash=None), SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE]
ssl/tls alert handshake failure (_ssl.c:1032)')))

This is odd again - shouldn't SSLv3 have been deprecated long ago? It is insecure.
So then that would lead to the assumption that TPLink still uses SSLv3 on their devices?
In the "comments thread" (home-assistant/core#154300) I myself suggested that
the Tapo App should be upgraded again, or at least be checked if newer version(s) exist and then be upgraded to
the latest version. Now that is the case for me. But really - no newer firmware for the RoboVac present, and they
still use SSLv3?

(Annot.: does someone beyond scope want to discredit TP-Link / weaken their reputation? That should not happen.
Really. They make good products.)

Or, put it in other words; for example, your file "kasa/transports/tpaptransport.py" definitely is present after that
git fetch/git checkout that I used (just to verify that that combination fetch/checkout indeed worked),
but that SSLv3 error is thrown before the device can be "queried"; so the connection
establishment itself already fails - because of that old SSLv3? That is weird.
I mean, luckily it fails - because SSLv3 is insecure! But that won't help us.

If I run that "uv run kasa ..." part outside of the cloned git repo / outside of the python venv,
then I get:

== Unsupported device ==
== Discovery Result ==
Device Type: SMART.TAPOROBOVAC
Device Model: RV30 Max Plus(EU)
IP: XXX.XXX.XXX.XXX
MAC: XX-XX-XX-XX-XX-XX
Device Id (hash):
Owner (hash):
Supports IOT Cloud: True
OBD Src: tplink
Encrypt Type: TPAP
Supports HTTPS: True
HTTP Port: 4433
Login version: 2

Unable to create device for XXX.XXX.XXX.XXX

... which would correspond to the (so-far known) HA error message regarding the missing TPAP-scheme.

Or did I miss something and I can't test the scenario like I did?

In fact, of course some others should test, too.

But I hope that was a bit of a help anyways.

And yes, needs to be mentioned, too @ZeliardM (and others): thank you for your work! Very much appreciated!

@r1ms4ab0r4ht5 Thanks for testing. If gh doesn't work, it just means yo don't have the GitHub CLI installed, using git like you did should work.

I just pushed a new commit with some changes, git pull in the pr again and try again and let me know.

Thanks!

Hi again,

pulled the pr again and this is the debug log ("discover config"):

DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.KLAP.HTTPS DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.KLAP.HTTPS DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.KLAP DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.KLAP DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.KLAP.HTTPS DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.KLAP.HTTPS DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.KLAP DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOPLUG DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.KLAP DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOPLUG DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.KLAP.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.KLAP.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.KLAP DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Using IotPlug for IOT.SMARTPLUGSWITCH DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.KLAP DEBUG Created KLAP transport for XXX.XXX.XXX.XXX DEBUG Using IotPlug for IOT.SMARTPLUGSWITCH DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Using SmartCamDevice for SMART.IPCAMERA DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Using SmartCamDevice for SMART.IPCAMERA DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Created ssltransport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Created ssltransport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Created ssltransport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Created ssltransport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.AES.HTTPS DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.AES.HTTPS DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.AES DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOPLUG DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.AES DEBUG Created AES transport for XXX.XXX.XXX.XXX DEBUG Using SmartDevice for SMART.TAPOPLUG DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.AES.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.AES.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.AES DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.AES DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.XOR.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.XOR.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.XOR DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.XOR DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.XOR.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.XOR.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.XOR DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.XOR DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.XOR.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.XOR.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.XOR DEBUG Using IotPlug for IOT.SMARTPLUGSWITCH DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.XOR DEBUG Using IotPlug for IOT.SMARTPLUGSWITCH DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.TPAP.HTTPS DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.TPAP.HTTPS DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.TPAP DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoRobovac DEBUG Finding transport for SMART.TPAP DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.TPAP.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.TPAP.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.TPAP DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.SmartTapoPlug DEBUG Finding transport for SMART.TPAP DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotIpCamera DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.TPAP.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.TPAP.HTTPS DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.TPAP DEBUG Finding protocol for XXX.XXX.XXX.XXX DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch DEBUG Finding transport for IOT.TPAP DEBUG Trying to connect with SmartProtocol DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Initializing XXX.XXX.XXX.XXX of type DEBUG XXX.XXX.XXX.XXX multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1 _cloud_state"}]}}'
DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Posting to DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Device XXX.XXX.XXX.XXX waiting 0.24475319699922693 DEBUG Posting to DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Device XXX.XXX.XXX.XXX waiting 0.24715519999881508 DEBUG Posting to DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Device XXX.XXX.XXX.XXX waiting 0.24710084800244658 DEBUG Posting to DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Posting to DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Device XXX.XXX.XXX.XXX waiting 0.24444136300007813 DEBUG Posting to DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Device XXX.XXX.XXX.XXX waiting 0.247234237001976 DEBUG Posting to DEBUG Starting handshake with XXX.XXX.XXX.XXX DEBUG Device XXX.XXX.XXX.XXX waiting 0.24672193999867886 DEBUG Posting to DEBUG Going to send {"method":"multipleRequest","request_time_milis":17 loud_state"}]}}
DEBUG Transport not established or session DEBUG Going to send login request DEBUG Sending {"method":"login","params":{"passw DEBUG Posting to DEBUG Will perform handshaking... DEBUG Posting to DEBUG XXX.XXX.XXX.XXX multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1 _cloud_state"}]}}'
DEBUG Will perform handshaking... DEBUG Device XXX.XXX.XXX.XXX waiting 0.24320880500090425 DEBUG Posting to DEBUG Will perform handshaking... DEBUG Device XXX.XXX.XXX.XXX waiting 0.24610862400004407 DEBUG Posting to DEBUG Will perform handshaking... DEBUG Device XXX.XXX.XXX.XXX waiting 0.24618838300011703 DEBUG Posting to Attempt to connect to XXX.XXX.XXX.XXX with DEBUG Trying to connect with IotProtocol DEBUG XXX.XXX.XXX.XXX >> {"system":{"get_sysinfo":{}}} DEBUG Unable to query the device: XXX.XXX.XXX.XXX, DEBUG Unable to connect with IotProtocol: Attempt to connect to XXX.XXX.XXX.XXX with DEBUG Trying to connect with SmartProtocol DEBUG Using SmartDevice for SMART.TAPOROBOVAC DEBUG Initializing XXX.XXX.XXX.XXX of type DEBUG XXX.XXX.XXX.XXX multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1 _cloud_state"}]}}'
DEBUG Posting to DEBUG Device XXX.XXX.XXX.XXX waiting 0.24391949200071394 DEBUG Posting to DEBUG Device XXX.XXX.XXX.XXX waiting 0.24759171899859211 DEBUG Posting to DEBUG Device XXX.XXX.XXX.XXX waiting 0.24758592299986049 DEBUG Posting to klaptransport.py:317
2F%2FXXX.XXX.XXX.XXX%3A4433%2Fapp%2Fhandshake1">https://XXX.XXX.XXX.XXX:4433/app/handshake1 httpclient.py:88
os error, enabling sequential request delay: Cannot connect to host XXX.XXX.XXX.XXX:4433 ssl:<ssl.SSLContext object at 0x7fff2a4de5d0> [[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] httpclient.py:136
error, will retry 3 times: ('Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:4433 ssl:<ssl.SSLContext object at 0x7fff2a4de5d0> [[SSL: smartprotocol.py:145
handshake failure (_ssl.c:1032)]', ClientConnectorSSLError(ConnectionKey(host='XXX.XXX.XXX.XXX', port=4433, is_ssl=True, ssl=<ssl.SSLContext object at
proxy_headers_hash=None), SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
smartprotocol.py:241
760879423122,"terminal_uuid":"hghEoUHw52p9RLkyaJQrUw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
klaptransport.py:317
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX%3A4433%2Fapp%2Fhandshake1">https://XXX.XXX.XXX.XXX:4433/app/handshake1 httpclient.py:88
smartprotocol.py:241
760879423385,"terminal_uuid":"hghEoUHw52p9RLkyaJQrUw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
klaptransport.py:317
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX%3A4433%2Fapp%2Fhandshake1">https://XXX.XXX.XXX.XXX:4433/app/handshake1 httpclient.py:88
smartprotocol.py:241
760879423647,"terminal_uuid":"hghEoUHw52p9RLkyaJQrUw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
klaptransport.py:317
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX%3A4433%2Fapp%2Fhandshake1">https://XXX.XXX.XXX.XXX:4433/app/handshake1 httpclient.py:88
smartprotocol.py:152
('Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:4433 ssl:<ssl.SSLContext object at 0x7fff2a4de5d0> [[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] discover.py:684
ClientConnectorSSLError(ConnectionKey(host='XXX.XXX.XXX.XXX', port=4433, is_ssl=True, ssl=<ssl.SSLContext object at 0x7fff2a4de5d0>, proxy=None, proxy_auth=None,
SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
SmartProtocol + KlapTransportV2 + SmartDevice + https failed
discover.py:681
device_factory.py:180
<class 'kasa.smart.smartdevice.SmartDevice'> device.py:214
smartprotocol.py:241
760879423926,"terminal_uuid":"Mu0DyG+z+tPJxDD2vR9VZA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
klaptransport.py:317
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
os error, enabling sequential request delay: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:<ssl.SSLContext object at 0x7fff2a4dfe30> [Connect call failed ('XXX.XXX.XXX.XXX', 80)] httpclient.py:136
error, will retry 3 times: ("Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:<ssl.SSLContext object at 0x7fff2a4dfe30> [Connect smartprotocol.py:145
torError(ConnectionKey(host='XXX.XXX.XXX.XXX', port=80, is_ssl=False, ssl=<ssl.SSLContext object at 0x7fff2a4dfe30>, proxy=None, proxy_auth=None,
"Connect call failed ('XXX.XXX.XXX.XXX', 80)")))
smartprotocol.py:241
760879423938,"terminal_uuid":"Mu0DyG+z+tPJxDD2vR9VZA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
klaptransport.py:317
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
smartprotocol.py:241
760879424192,"terminal_uuid":"Mu0DyG+z+tPJxDD2vR9VZA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
klaptransport.py:317
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
smartprotocol.py:241
760879424448,"terminal_uuid":"Mu0DyG+z+tPJxDD2vR9VZA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
klaptransport.py:317
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
smartprotocol.py:152
("Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:<ssl.SSLContext object at 0x7fff2a4dfe30> [Connect call failed ('XXX.XXX.XXX.XXX', discover.py:684
.XXX.XXX.XXX', port=80, is_ssl=False, ssl=<ssl.SSLContext object at 0x7fff2a4dfe30>, proxy=None, proxy_auth=None, proxy_headers_hash=None),
failed ('XXX.XXX.XXX.XXX', 80)")))
SmartProtocol + KlapTransportV2 + SmartDevice + http failed
discover.py:681
device_factory.py:180
<class 'kasa.iot.iotplug.IotPlug'> device.py:214
iotdevice.py:314
iotprotocol.py:146
klaptransport.py:317
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
os error, enabling sequential request delay: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:<ssl.SSLContext object at 0x7fff2a538190> [Connect call failed ('XXX.XXX.XXX.XXX', 80)] httpclient.py:136
iotprotocol.py:146
klaptransport.py:317
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
iotprotocol.py:146
klaptransport.py:317
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
iotprotocol.py:146
klaptransport.py:317
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp%2Fhandshake1">http://XXX.XXX.XXX.XXX/app/handshake1 httpclient.py:88
iotprotocol.py:94
("Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:<ssl.SSLContext object at 0x7fff2a538190> [Connect call failed ('XXX.XXX.XXX.XXX', 80)]", discover.py:684
port=80, is_ssl=False, ssl=<ssl.SSLContext object at 0x7fff2a538190>, proxy=None, proxy_auth=None, proxy_headers_hash=None), ConnectionRefusedError(111,
> IotProtocol + KlapTransport + IotPlug + http failed
discover.py:681
device_factory.py:180
<class 'kasa.smartcam.smartcamdevice.SmartCamDevice'> device.py:214
smartprotocol.py:241
760879425516,"terminal_uuid":"nyI297YHy21K5Av3D0WADg==","params":{"requests":[{"method":"getDeviceInfo","params":{"device_info":{"name":["basic_info","info"]
component":{"name":"app_component_list"}}},{"method":"getConnectionType","params":{"network":{"get_connection_type":{}}}}]}}'
sslaestransport.py:618
2F%2FXXX.XXX.XXX.XXX">https://XXX.XXX.XXX.XXX httpclient.py:88
os error, enabling sequential request delay: Cannot connect to host XXX.XXX.XXX.XXX:443 ssl:<ssl.SSLContext object at 0x7fff2a538050> [Connect call failed ('XXX.XXX.XXX.XXX', httpclient.py:136
error, will retry 3 times: ("Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:443 ssl:<ssl.SSLContext object at 0x7fff2a538050> [Connect smartprotocol.py:145
ctorError(ConnectionKey(host='XXX.XXX.XXX.XXX', port=443, is_ssl=True, ssl=<ssl.SSLContext object at 0x7fff2a538050>, proxy=None, proxy_auth=None,
"Connect call failed ('XXX.XXX.XXX.XXX', 443)")))
smartprotocol.py:241
760879425531,"terminal_uuid":"nyI297YHy21K5Av3D0WADg==","params":{"requests":[{"method":"getDeviceInfo","params":{"device_info":{"name":["basic_info","info"]
component":{"name":"app_component_list"}}},{"method":"getConnectionType","params":{"network":{"get_connection_type":{}}}}]}}'
sslaestransport.py:618
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX">https://XXX.XXX.XXX.XXX httpclient.py:88
smartprotocol.py:241
760879425785,"terminal_uuid":"nyI297YHy21K5Av3D0WADg==","params":{"requests":[{"method":"getDeviceInfo","params":{"device_info":{"name":["basic_info","info"]
component":{"name":"app_component_list"}}},{"method":"getConnectionType","params":{"network":{"get_connection_type":{}}}}]}}'
sslaestransport.py:618
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX">https://XXX.XXX.XXX.XXX httpclient.py:88
smartprotocol.py:241
760879426042,"terminal_uuid":"nyI297YHy21K5Av3D0WADg==","params":{"requests":[{"method":"getDeviceInfo","params":{"device_info":{"name":["basic_info","info"]
component":{"name":"app_component_list"}}},{"method":"getConnectionType","params":{"network":{"get_connection_type":{}}}}]}}'
sslaestransport.py:618
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX">https://XXX.XXX.XXX.XXX httpclient.py:88
smartprotocol.py:152
("Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:443 ssl:<ssl.SSLContext object at 0x7fff2a538050> [Connect call failed ('XXX.XXX.XXX.XXX', discover.py:684
X.XXX.XXX.XXX', port=443, is_ssl=True, ssl=<ssl.SSLContext object at 0x7fff2a538050>, proxy=None, proxy_auth=None, proxy_headers_hash=None),
failed ('XXX.XXX.XXX.XXX', 443)")))
SmartCamProtocol + SslAesTransport + SmartCamDevice + https failed
discover.py:681
device_factory.py:180
<class 'kasa.smart.smartdevice.SmartDevice'> device.py:214
smartprotocol.py:241
760879426308,"terminal_uuid":"7lBkaRdyyYqdm76zdogJtw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
ssltransport.py:220
60879426308,"terminal_uuid":"7lBkaRdyyYqdm76zdogJtw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect_c
expired, logging in ssltransport.py:222
ssltransport.py:199
ord":"DB48B99D5BC7D1907ECE23F4C7F26BF3","username":"sannhu75@gmail.com"}} to https://XXX.XXX.XXX.XXX:4433/app ssltransport.py:139
2F%2FXXX.XXX.XXX.XXX%3A4433%2Fapp">https://XXX.XXX.XXX.XXX:4433/app httpclient.py:88
not retrying: ('Unable to query the device: XXX.XXX.XXX.XXX: unexpected character: line 1 column 1 (char 0)', JSONDecodeError('unexpected character: line 1 column 1 smartprotocol.py:191
('Unable to query the device: XXX.XXX.XXX.XXX: unexpected character: line 1 column 1 (char 0)', JSONDecodeError('unexpected character: line 1 column 1 (char 0)')) discover.py:684
SmartProtocol + SslTransport + SmartDevice + https failed
discover.py:681
device_factory.py:180
<class 'kasa.smart.smartdevice.SmartDevice'> device.py:214
smartprotocol.py:241
760879426838,"terminal_uuid":"dFuZfKLwVxS3uEnfOvKQBw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
aestransport.py:302
F%2FXXX.XXX.XXX.XXX%2Fapp">http://XXX.XXX.XXX.XXX/app httpclient.py:88
os error, enabling sequential request delay: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:False [Connect call failed ('XXX.XXX.XXX.XXX', 80)] httpclient.py:136
error, will retry 3 times: ("Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:False [Connect call failed ('XXX.XXX.XXX.XXX', 80)]", smartprotocol.py:145
port=80, is_ssl=False, ssl=False, proxy=None, proxy_auth=None, proxy_headers_hash=None), ConnectionRefusedError(111, "Connect call failed
smartprotocol.py:241
760879426852,"terminal_uuid":"dFuZfKLwVxS3uEnfOvKQBw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
aestransport.py:302
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp">http://XXX.XXX.XXX.XXX/app httpclient.py:88
smartprotocol.py:241
760879427108,"terminal_uuid":"dFuZfKLwVxS3uEnfOvKQBw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
aestransport.py:302
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp">http://XXX.XXX.XXX.XXX/app httpclient.py:88
smartprotocol.py:241
760879427367,"terminal_uuid":"dFuZfKLwVxS3uEnfOvKQBw==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
aestransport.py:302
seconds to send request httpclient.py:81
F%2FXXX.XXX.XXX.XXX%2Fapp">http://XXX.XXX.XXX.XXX/app httpclient.py:88
smartprotocol.py:152
("Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:80 ssl:False [Connect call failed ('XXX.XXX.XXX.XXX', 80)]", discover.py:684
port=80, is_ssl=False, ssl=False, proxy=None, proxy_auth=None, proxy_headers_hash=None), ConnectionRefusedError(111, "Connect call failed
SmartProtocol + AesTransport + SmartDevice + http failed
discover.py:681
iotprotocol.py:146
not retrying: Unable to connect to the device: XXX.XXX.XXX.XXX:9999: [Errno 111] Connect call failed ('XXX.XXX.XXX.XXX', 9999) iotprotocol.py:132
Unable to connect to the device: XXX.XXX.XXX.XXX:9999: [Errno 111] Connect call failed ('XXX.XXX.XXX.XXX', 9999) discover.py:684
IotProtocol + XorTransport + IotPlug + http failed
discover.py:681
device_factory.py:180
<class 'kasa.smart.smartdevice.SmartDevice'> device.py:214
smartprotocol.py:241
760879427644,"terminal_uuid":"9jcCziG78uEbUqzzpqNEOA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
2F%2FXXX.XXX.XXX.XXX%3A4433%2F">https://XXX.XXX.XXX.XXX:4433/ httpclient.py:88
os error, enabling sequential request delay: Cannot connect to host XXX.XXX.XXX.XXX:4433 ssl:<ssl.SSLContext object at 0x7fff2a5382d0> [[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] httpclient.py:136
error, will retry 3 times: ('Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:4433 ssl:<ssl.SSLContext object at 0x7fff2a5382d0> [[SSL: smartprotocol.py:145
handshake failure (_ssl.c:1032)]', ClientConnectorSSLError(ConnectionKey(host='XXX.XXX.XXX.XXX', port=4433, is_ssl=True, ssl=<ssl.SSLContext object at
proxy_headers_hash=None), SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
smartprotocol.py:241
760879427665,"terminal_uuid":"9jcCziG78uEbUqzzpqNEOA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX%3A4433%2F">https://XXX.XXX.XXX.XXX:4433/ httpclient.py:88
smartprotocol.py:241
760879427928,"terminal_uuid":"9jcCziG78uEbUqzzpqNEOA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX%3A4433%2F">https://XXX.XXX.XXX.XXX:4433/ httpclient.py:88
smartprotocol.py:241
760879428192,"terminal_uuid":"9jcCziG78uEbUqzzpqNEOA==","params":{"requests":[{"method":"component_nego"},{"method":"get_device_info"},{"method":"get_connect
seconds to send request httpclient.py:81
2F%2FXXX.XXX.XXX.XXX%3A4433%2F">https://XXX.XXX.XXX.XXX:4433/ httpclient.py:88
smartprotocol.py:152
('Device connection error: XXX.XXX.XXX.XXX: Cannot connect to host XXX.XXX.XXX.XXX:4433 ssl:<ssl.SSLContext object at 0x7fff2a5382d0> [[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] discover.py:684
ClientConnectorSSLError(ConnectionKey(host='XXX.XXX.XXX.XXX', port=4433, is_ssl=True, ssl=<ssl.SSLContext object at 0x7fff2a5382d0>, proxy=None, proxy_auth=None,
SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
SmartProtocol + TpapTransport + SmartDevice + https failed

Also I have to mention: It could be I messed up some things (in my mind) concerning that SSLv3 "deprecated" topic in my last post - sorry for that; that whole issue is a bit confusing right now.

Anyway, thanks again for your help.

Ok ... have to (hopefully) clarify a bit more, from my side: I was confused lately about that seemingly (still?) needed SSLv3 for connection establishment, which should not be like so. Then, I felt like: "Wait... wasn't there something about SSLv3 still being needed under certain circumstances?" But apparently, I assume that that assumption was wrong, and now I feel sorry for perhaps having disturbed the bugfixing process - such was not my intention.
Entering "sslv3 still needed for connection establishment?" in google really reveals: Nope - SSLv3 should be disabled for being insecure.
So again, sorry for the noise - please carry on with the bugfixing process :-) ...

I have been working on this today without much movement, still trying to figure out the authentication pieces. Looks like I will have to implement NOC but having issues getting the information and URLs for the certificate registration with the Tapo cloud. There is an API rate limit which causes problems as well. So, I'm still working on this, but nothing yet.

@Dan1jel @GSzabados At this time, no. There are items in the pipeline but no ETA on updates to a new release yet.

RV30 Max TPAP validation against PR #1592

I tested the TPAP implementation from PR #1592 against a real Tapo RV30 Max.

Summary of the result:

Area	Result	Notes
UDP discovery without credentials	Partial	The device is detected as RV30 Max / SMART.TAPOROBOVAC / TPAP / HTTPS / login version 2, but the authenticated follow-up update cannot complete without credentials, as expected
UDP discovery with credentials	OK	Discovery and authenticated update complete successfully
UDP discovery detail with credentials	OK	Detailed device information and feature list are retrieved successfully when using an explicit communication timeout
TPAP direct connection	OK	Device is reachable over TPAP/HTTPS
Status reads	OK	vacuum_status and other feature values are readable
Reversible writes	OK	vacuum_fan_speed, mop_waterlevel, clean_count and carpet_boost can be changed and restored
Motion controls	OK	Start, pause, resume and return-home work correctly
Matter setup info	Partial	get_matter_setup_info returns UNKNOWN_METHOD_ERROR, but this does not block TPAP operation
Consumable resets	Not tested	Intentionally skipped because they are destructive/irreversible

Observed status mapping during the test:

1: Cleaning
4: Going home
6: Charged
7: Paused

From a practical RV30 Max perspective, PR #1592 appears to solve the main issue tracked here: TPAP discovery, authenticated communication, reads, safe writes and core vacuum commands are working on real hardware.

I added the detailed validation report to PR #1592, since that is the implementation PR. I can run more targeted tests if maintainers need additional coverage.

Working native C# TPAP implementation — no third-party compatibility toggle required. Tested on L900-5(EU), P110(UK), L530E(EU), and H100(UK) all on latest TPAP firmware. Covers plugs, bulbs, light strips, and hubs including child device enumeration. Automatic transport negotiation across TPAP, KLAP, and legacy XOR.
https://github.com/oznetmaster/KasaTapoClient

Hello, recently bought a pair of P110-EU, hw revision 1.20. Made the mistake to setup with their app. Running firmware 1.4.0 and I can confirm successfull usage when running from this PR #1592 for at least:

discover
join wifi
disable auto update
power metering
toggle/off/on

The LED sticks to Orange

== Primary features ==
State (state): True
Current consumption (current_consumption): 38.9 W
Voltage (voltage): 231.5 V== Information ==
Signal Level (signal_level): 3
Auto off at (auto_off_at): None
Cloud connection (cloud_connection): True
Today's consumption (consumption_today): 0.001 kWh
This month's consumption (consumption_this_month): 0.001 kWh
Update available (update_available): None
Check latest firmware (check_latest_firmware): <Action>
Overloaded (overloaded): False

== Configuration ==
Auto off enabled (auto_off_enabled): False
Auto off in (auto_off_minutes): 120 min (range: 0-65536)
Auto update enabled (auto_update_enabled): False
LED (led): True
Power protection threshold (power_protection_threshold): 0 W (range: 0-3916)

Current (current): 0.17 A

Unfortunately, it looks like even once setup this way, support for this TPAP protocol being missing on Home Assistant side (since it's not merged), so I cannot yet integrate it.

Managed to setup my L535 with Firmware: 1.4.2 Build 260203 Rel.034329 and Hardware: 3.0 on NixOS, using branch from #1592. Worked from the first try!

Hello,

I tested the TPAP implementation from PR #1592 against a real Tapo L930 LED light strip.

Context: I initially hit the Unsupported device ... SMART.TAPOBULB with encrypt_scheme EncryptionScheme(is_support_https=False, encrypt_type='TPAP', lv=2) error when trying to add the device via the official Home Assistant TP-Link integration.

Summary of the result:

Copier le tableau

Area	Result	Notes
UDP discovery with credentials	OK	Device detected as SMART.TAPOBULB / TPAP / no HTTPS / login version 2
TPAP direct connection	OK	Attempt to connect ... with SmartProtocol + TpapTransport + SmartDevice + http succeeded
Status reads	OK	State, brightness, color, HSV, color temp all readable
Effects	OK	Light effect list and active effect retrieved correctly

Steps used:

gh pr checkout 1592
uv sync --all-extras
uv run kasa --username 'xxx' --password 'xxx' --debug --host <IP> discover config

CLI options reported for a direct connection:

--device-family SMART.TAPOBULB --encrypt-type TPAP --no-https

From a practical L930 perspective, PR #1592 solves the original connection issue: TPAP discovery, authenticated communication and reads are all working correctly on real hardware.

Thanks for the great work on this @ZeliardM — happy to run more tests if needed!

Claude told me to help out and add this. Sorry if Claude was wrong (bad Claude!):

Adding a device/firmware variant not yet on the list: Kasa KP125M(US), firmware 1.3.0.

This one differs from the reported RV30 Max / P100 cases in two ways that may be relevant:

The TPAP parameters are all zero and the port is 80 rather than 4433 (tls: 0, dac: 0, noc: 0, pake: [0]), with is_support_https: false.
There is a tpap_preferred: true flag in the discovery response.

The plug was commissioned into Apple Home as a Matter device and has never been onboarded via the Kasa app — note owner is empty and obd_src is matter. It works fine over Matter in Apple Home; only the python-kasa path fails. Because the device isn't bound to a TP-Link account, toggling Third-Party Compatibility in the Kasa app has no effect on it, so that workaround isn't available here.

kasa --host 192.168.10.30 discover raw

{
  "discovery_response": {
    "result": {
      "device_id": "REDACTED",
      "owner": "",
      "device_type": "SMART.KASAPLUG",
      "device_model": "KP125M(US)",
      "ip": "192.168.10.30",
      "mac": "3C-6A-D2-00-00-00",
      "is_support_iot_cloud": true,
      "tpap_preferred": true,
      "tpap": {
        "tls": 0,
        "dac": 0,
        "noc": 0,
        "pake": [0],
        "port": 80
      },
      "obd_src": "matter",
      "protocol_version": 1,
      "factory_default": false,
      "mgt_encrypt_schm": {
        "is_support_https": false,
        "http_port": 80,
        "encrypt_type": "TPAP",
        "lv": 2
      }
    },
    "error_code": 0
  },
  "meta": {
    "ip": "192.168.10.30",
    "port": 20002
  }
}

Raised error: Unsupported device 192.168.10.30 of type SMART.KASAPLUG with encrypt_scheme EncryptionScheme(is_support_https=False, encrypt_type='TPAP', http_port=80, lv=2)

I also have the same issue as #1590 (comment). I'm using homeassistant with the TPLink smart home integration. Which is odd because it says this device is matter enabled.

here's a relevant snippet:

{
  "discovery_response":{
    "result":{
      "device_id":"xxx",
      "owner":"xxx",
      "device_type":"SMART.KASAPLUG",
      "device_model":"KP125M(US)",
      "ip":"xxx",
      "mac":"xxx",
      "is_support_iot_cloud":true,
      "tpap_preferred":true,
      "tpap":{
        "tls":0,
        "dac":1,
        "noc":1,
        "pake":[
          2
        ],
        "port":80
      },
      "obd_src":"tplink",
      "protocol_version":1,
      "factory_default":false,
      "mgt_encrypt_schm":{
        "is_support_https":false,
        "http_port":80,
        "encrypt_type":"TPAP",
        "lv":2
      }
    },
    "error_code":0
  },
  "meta":{
    "ip":"xxx",
    "port":20002
  }
}

Adding a P410M (Tapo, energy-monitoring smart plug — not yet in the known-devices list above) as another affected model/firmware combination.

Trying to add it via Home Assistant's tplink integration (python-kasa 0.10.2) fails with:

Connection error: Unsupported device 192.168.10.64 of type SMART.TAPOPLUG with encrypt_scheme EncryptionScheme(is_support_https=False, encrypt_type='TPAP', http_port=80, lv=2)

Firmware on this unit: 1.4.3 Build 251023 Rel.170250 (HW 1.0).

One thing that might be a useful data point: I have four other P410M units on the same network, same model, all still on plain KLAP — but on a higher firmware version number (1.4.4 Build 251203). This one is on a numerically lower version string and already speaks TPAP. So at least for the P410M line, TPAP rollout doesn't look tied to a simple monotonically increasing firmware version — looks more like a separate manufacturing/firmware branch or staggered regional rollout. Not sure if that's already understood, but wanted to flag it in case it helps narrow down which builds to expect this on.

Happy to run kasa --host <ip> discover --discover-timeout 10 --json (or similar) against this unit and attach the raw discovery response if that would help.

Pin python-kasa to the unmerged TPAP support fork (ZeliardM/python-ka…

Additional affected device/firmware combination: Tapo P110, firmware 1.4.8 Build 260804 Rel.045837.

Environment: Home Assistant Green, Home Assistant OS 18.3, Core 2026.9.4, Supervisor 2026.09.3. Hardware revision and installed python-kasa version have not been verified.

Adding the plug by its local IP address through the built-in TP-Link Smart Home integration fails before the credential step with:

Unsupported device <LOCAL_IP> of type SMART.TAPOPLUG with encrypt_scheme EncryptionScheme(is_support_https=False, encrypt_type='TPAP', http_port=80, lv=2)

The plug works normally in the official Tapo app. Third-Party Compatibility was enabled, then explicitly toggled off and on, and the plug was power-cycled. Retrying setup still returns the same error. Removing and recreating the Home Assistant TP-Link integration entries did not resolve it. Other HS100 plugs work through the integration.

Reporting this firmware variant as an additional data point for TPAP support. No raw discovery dump or test of the proposed TPAP implementation has been performed.

KH100(EU) Kasa hub with KE100 + T315 children — works with PR #1592

Adding a device not yet on the list: Kasa KH100(EU) (SMART.KASAHUB), hardware 1.0, firmware 1.8.0 Build 260729 Rel.042947, set up via the Kasa app.

Home Assistant 2026.10.1 (python-kasa 0.11.0.1) fails with:

Unsupported device <ip> of type SMART.KASAHUB with encrypt_scheme EncryptionScheme(is_support_https=False, encrypt_type='TPAP', http_port=80, lv=2)

Unicast discovery with python-kasa 0.11.0.1 got no response at all. With PR #1592 (commit e708447):

"device_type":"SMART.KASAHUB",
"device_model":"KH100(EU)",
"tpap_preferred":true,
"tpap":{"tls":0,"dac":1,"noc":1,"pake":[2],"port":80},
"obd_src":"tplink",
"mgt_encrypt_schm":{"is_support_https":false,"http_port":80,"encrypt_type":"TPAP","lv":2}

Area	Result	Notes
UDP discovery (no credentials)	OK	Detected as KH100(EU) / TPAP / lv=2 / port 80
discover config with credentials	OK	Connected with SmartProtocol + TpapTransport + SmartDevice + http (the HTTPS TPAP attempts fail first, as expected)
state (hub)	OK	Firmware, RSSI, alarm config, auto-update, LED, etc.
Child enumeration	OK	2× KE100 (fw 2.15.0 Build 260212) + 1× T315 (fw 1.12.0 Build 260424)
KE100 features	OK	Target temperature, current temperature, thermostat mode, battery level/low, child lock, temperature offset
T315 features	OK	Temperature, humidity, battery, warnings, report interval

One oddity: discover config suggests --device-family SMART.TAPOPLUG as the connection option for this hub, even though discovery correctly reports SMART.KASAHUB and state then identifies it as a hub with children.

Only read operations were tested; nothing was written to the hub or the thermostats.

Hello, I was using Zeliard's fork with tpap implementation, but home assistant 2026.10.1 bumped python kasa to latest and now I also have to pin home assistant to 2026.10.0 for the tpap fix to work. Is the tpap implementation supposed to come soon? Thanks.

Adding another device to the TPAP list: Tapo L510 (EU/UK), hardware 3.0.

Three units updated to firmware 1.4.0 Build 260826 Rel.012106 overnight on 21 Oct 2026, without the update being triggered manually. All three now advertise TPAP and fail in Home Assistant 2026.10.2 (python-kasa 0.11.0.1):

Unsupported device 192.168.20.239 of type SMART.TAPOBULB with encrypt_scheme EncryptionScheme(is_support_https=False, encrypt_type='TPAP', http_port=80, lv=2)

Before discovery picks it up, the existing KLAP config entry gets 403 to handshake1. Third-Party Compatibility was already enabled; toggling it off and on and power-cycling the bulbs didn't change the encrypt type.

For comparison, an L430C (fw 1.0.6 Build 260512) and a P110 (fw 1.4.8 Build 260804) on the same account still use KLAP and work.

Happy to test #1592 against an L510 if that's useful.

🤖 Field report gathered via AI Agent on behalf of the account owner (4× P115 fw 1.4.8, HA 2026.10.2). Full technical report + patch were posted on the PR to keep this thread short.

Confirming on 4× P115(EU) HW 1.0, fw 1.4.8 Build 260804 Rel.045837 — every plug is "unauthorized" in HA with correct Tapo credentials, for a specific protocol reason worth knowing before trying the usual advice:

Enabling "third-party compatibility" (and/or rebooting) does not help on 1.4.8. After the toggle the device advertises KLAP lv2 in discovery, but KLAP authentication then fails with correct credentials (Device response did not match our challenge) — with stock python-kasa and with the TPAP PR alike. Verified stable across power cycles.
The device is actually TPAP-only underneath: the same port-80 endpoint completes a full TPAP/SPAKE2+ login with the normal Tapo account — it just suppresses the tpap descriptor from discovery (and component_nego still lists a tpap component). So this is neither a wrong-password issue nor a cloud issue; released python-kasa simply has no TPAP transport.
A patched build (PR TPAP Implementation #1592 + two small robustness patches) runs all four plugs end-to-end in Home Assistant 2026.10.2 — config-flow add, live energy entities, switching, and credentials-hash-only auth across restarts. Patch, evidence, and test notes: → comment on PR #1592 (2026-10-22).

To maintainers/other affected: until #1592 (or equivalent) ships, there is no config-only workaround on 1.4.8 — building a patched wheel is currently the only local fix, so it would be great to get that PR rebased/released (it merges into master conflict-free as of today).

Missing support for TPAP encryption type · Issue #1590 · python-kasa/python-kasa · GitHub

Repository navigation

Missing support for TPAP encryption type #1590

"TPAP" encryption type is not supported

List of known devices & firmwares using TPAP

Original issue text

88 remaining items

RV30 Max TPAP validation against PR #1592

KH100(EU) Kasa hub with KE100 + T315 children — works with PR #1592

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Missing support for TPAP encryption type · Issue #1590 · python-kasa/python-kasa · GitHub

Repository navigation

Missing support for TPAP encryption type #1590

Description

"TPAP" encryption type is not supported

List of known devices & firmwares using TPAP

Original issue text

Activity

ZeliardM commented on Oct 16, 2025

unze commented on Oct 16, 2025

ZeliardM commented on Oct 16, 2025

ZeliardM commented on Oct 17, 2025

ZeliardM commented on Oct 18, 2025

ZeliardM commented on Oct 18, 2025

r1ms4ab0r4ht5 commented on Oct 19, 2025

ZeliardM commented on Oct 19, 2025

r1ms4ab0r4ht5 commented on Oct 19, 2025

r1ms4ab0r4ht5 commented on Oct 19, 2025

ZeliardM commented on Oct 20, 2025

88 remaining items

ZeliardM commented on May 6, 2026

Pacha-Icefree commented on Jun 12, 2026

RV30 Max TPAP validation against PR #1592

oznetmaster commented on Jun 16, 2026

lissyx commented on Jul 14, 2026

ZAZPRO commented on Aug 3, 2026

froeschthomas commented on Aug 4, 2026

sharkytowers commented on Aug 10, 2026

tonyjamesstark commented on Aug 13, 2026

mannymuster commented on Sep 12, 2026

fabiansteinbach-create commented on Oct 6, 2026

marvreichmann commented on Oct 11, 2026

KH100(EU) Kasa hub with KE100 + T315 children — works with PR #1592

iloveakitas commented on Oct 17, 2026

JBendarr commented on Oct 21, 2026

lgleim commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions