Repository navigation
Tapo C225 V2 (EU/2.0) firmware 1.3.1 causes SSL handshake failure in Home Assistant while C225 EU/1.0 firmware 1.2.2 works correctly #1727
Description
Title
Tapo C225 V2 (EU/2.0) firmware 1.3.1 causes SSL handshake failure in Home Assistant while C225 EU/1.0 firmware 1.2.2 works correctly
Summary
I would like to report what appears to be a reproducible compatibility issue between the latest firmware of the TP-Link Tapo C225 V2 and the Home Assistant TP-Link Smart Home integration (python-kasa).
I own three Tapo C225 cameras installed in the same environment.
Two cameras are the newer EU/2.0 (HVIN: Tapo C225V2) hardware revision and both are running firmware 1.3.1.
The third camera is the older EU/1.0 hardware revision running firmware 1.2.2.
The two V2 cameras consistently fail with an SSL handshake error while the older camera continues to work perfectly.
Because all cameras are installed in the same Home Assistant instance, on the same local network and using the same TP-Link account, this provides a direct comparison under nearly identical conditions.
Home Assistant Environment
- Installation Method: Home Assistant OS
- Home Assistant Core: 2026.7.2
- Supervisor: 2026.07.3
- Operating System: 18.1
- Frontend: 20260624.5
The system is fully up to date.
Camera Inventory
Working Camera
- Model: Tapo C225
- Hardware Revision: EU/1.0
- HVIN: Tapo C225
- Firmware: 1.2.2
- Serial Number: 2241ADN000741
- MAC Address: 74-FE-CE-2B-FE-26
Status:
Works perfectly with the native Home Assistant TP-Link Smart Home integration.
Failing Camera #1
- Model: Tapo C225
- Hardware Revision: EU/2.0
- HVIN: Tapo C225V2
- Firmware: 1.3.1
- Serial Number: 224C424000159
- MAC Address: EC-75-0C-DA-BF-22
Status:
Integration setup fails with SSL handshake error.
Failing Camera #2
- Model: Tapo C225
- Hardware Revision: EU/2.0
- HVIN: Tapo C225V2
- Firmware: 1.3.1
- Serial Number: 225305B000856
- MAC Address: 98-03-8E-19-11-E9
Status:
Integration setup fails with the same SSL handshake error.
Comparison
| Camera | Hardware | Firmware | Result |
|---|---|---|---|
| C225 | EU/1.0 | 1.2.2 | ✅ Works |
| C225 | EU/2.0 | 1.3.1 | ❌ SSL Handshake Failure |
| C225 | EU/2.0 | 1.3.1 | ❌ SSL Handshake Failure |
Error Message
Home Assistant continuously reports an integration setup failure similar to the following:
Setup failed, will retry: Device connection error
Cannot connect to host 192.168.xxx.xxx:443
SSLV3_ALERT_HANDSHAKE_FAILURE
ssl/tls alert handshake failure
ClientConnectorSSLError
The cameras are reachable over the local network.
The failure occurs during the SSL/TLS handshake.
Symptoms
The affected cameras continue to operate normally.
The following functions continue to work without any issues:
- Tapo App
- Live View
- Camera Settings
- Motion Detection
- Notifications
- Local Recording
- RTSP Streaming
- Wi-Fi Connectivity
- Local Network Connectivity
Only the native Home Assistant TP-Link Smart Home integration fails.
Timeline
Both affected cameras worked correctly before.
The issue appeared after both cameras were updated to firmware 1.3.1.
The older C225, which is still running firmware 1.2.2, continues to work normally.
The issue therefore affects two different physical cameras with the same hardware revision and firmware version.
Troubleshooting Already Performed
I have already tested all of the following:
- Restarted both cameras from the Tapo App
- Power-cycled both cameras
- Restarted Home Assistant
- Reloaded the TP-Link Smart Home integration
- Attempted to reconfigure the integration
- Verified DHCP reservations
- Verified local network connectivity
- Verified Wi-Fi connectivity
- Verified that all cameras use the same TP-Link account
- Enabled and disabled Privacy Mode
- Confirmed that RTSP streaming continues to work
- Confirmed that the Tapo App continues to work normally
None of these actions changed the behavior.
Why This Appears To Be Firmware Related
All cameras are installed under identical conditions:
- Same Home Assistant instance
- Same TP-Link Smart Home integration
- Same router
- Same Wi-Fi network
- Same TP-Link account
- Same local network
The only known differences are:
- Hardware revision
- Firmware version
The results are fully reproducible:
- Older hardware + firmware 1.2.2 → Works
- Newer hardware + firmware 1.3.1 → Fails
- Second newer hardware + firmware 1.3.1 → Fails
This strongly suggests either:
- a firmware regression introduced in version 1.3.1,
- a change in the TLS implementation on the C225 V2 hardware,
- or an incompatibility between firmware 1.3.1 and python-kasa.
Additional Observation
The TCP connection successfully reaches the cameras.
The SSL/TLS negotiation itself fails.
This does not appear to be a network connectivity problem.
The cameras remain fully operational through both the Tapo App and RTSP.
Only the encrypted local communication used by the Home Assistant TP-Link Smart Home integration fails.
Request
Could someone please investigate whether firmware 1.3.1 introduced any changes affecting:
- TLS versions
- Cipher suites
- Certificate handling
- HTTPS communication
- Local encrypted API
- Authentication sequence
that could explain the SSL handshake failure with python-kasa?
Since I own both the working hardware revision (EU/1.0) and the failing hardware revision (EU/2.0), I am able to perform comparison testing if needed.
I would also be happy to provide:
- Home Assistant diagnostics
- Debug logs
- python-kasa debug output
- Firmware build numbers
- Packet captures
- Additional testing results
Thank you for your time and for maintaining this integration.
Activity
Nino6689 commented on Aug 6, 2026
The root cause of this one is already identified in #1724 — it is a cipher-suite mismatch, not a certificate or account problem, which is why your EU/1.0 on 1.2.2 keeps working while the two EU/2.0 units on 1.3.1 fail.
The newer firmware restricts port 443 to ECDHE-only suites, while SslAesTransport in python-kasa offers only static-RSA ones (AES256-GCM-SHA384, AES256-SHA256, AES128-GCM-SHA256, AES128-SHA256, AES256-SHA). The intersection is empty, so the camera answers with handshake_failure. Your older camera predates that firmware change and still accepts the static-RSA suites.
I can confirm the same failure and the same fix on a C225 (login_version: 3) with python-kasa 0.10.2 — details and a per-cipher breakdown in #1724. Adding ECDHE-RSA-AES128-GCM-SHA256 / ECDHE-RSA-AES256-GCM-SHA384 to that list takes the entry from setup_retry to loaded; the static-RSA entries stay so older units are unaffected.
You can verify it on your own units without changing anything:
The 1.3.1 cameras should list only TLS_ECDHE_RSA_WITH_AES_*, and the 1.2.2 one should also offer the static-RSA suites.
Worth closing this as a duplicate of #1724 so the discussion stays in one place.
mhddf2y4gf-jpg commented on Aug 7, 2026
TP-Link has now provided firmware 1.3.2 Build 260716 Rel.32412n, and after updating both affected C225 V2 cameras from 1.3.1 to 1.3.2, the Home Assistant integration works normally again without any changes on the Home Assistant/python-kasa side. The SSL handshake errors have completely disappeared.
TP-Link specifically told me that this new firmware “may resolve this issue”, so it appears they were aware of the problem and addressed it in firmware 1.3.2.
Thank you for the detailed explanation and for identifying the cipher-suite mismatch. I agree that this issue can be closed as a duplicate of #1724.