Can I force an ESP32 ESPHome device to connect to WPA(1)?

ESPHome
1

I have a problem with my boat setup. The Pi4 working as a hotspot does not play well with WPA3, and when setting up a hotspot with Network Manager I can only choose between Open, WPA(1) and WPA2/WPA3. The last setting makes all the ESPHome devices connect, but a few other, necessary devices (a tablet and another Pi) refuses to connect. The easiest would be if I could get the ESP-devices to connect to WPA(1), because there does not seem to be any viable way to force the Pi and the Android tablet to connect when the hotspot announces WPA3, but the chip does not support it. I am pretty sure that’s what happening.

So is there a way to force ESPHome devices to connect to WPA(1)? I have not found one in the documentation, but I wanted to ask, just in case.

2

you don’t have option
wpa-psk ?

3

Thanks for answering! I think that’s what WPA is in the Pi. It is with a pre-shared password/key. But the ESP refuses to connect unless it’s at least WPA2, it seems.

4

wpa-psk should do WPA2 and virtually all devices should be compatible.

1 Like
5

Either I’m not explaining clearly or you did not read the first message thoroughly enough. I’ll try again:

  1. The WPA2/WPA3 (PSK) settings for this Pi access point announces WPA3, but the USB network card (outdoors with a larger antenna) does not support it. That makes some devices insist to connect with WPA3, but since it does not actually work, they fail. That goes for my Android tablet and another Pi than the access point, both of which are essential for the boat.

  2. The only setting (besides Open, which I can’t use because my boat is docked in a populated area) that does work with those two devices, is WPA(1)-PSK. But the ESPs seems to refuse to connect to anything below WPA2.

This means that the easiest solution would be if I could get the ESPs to connect to WPA(1)-PSK. So what I need to know is if the ESPHome devices can connect to WPA(1)-PSK in any way. They do not as it is now.

Edit: The protocol for WPA2/WPA3 is called rsn in Network Manager, while the protocol for WPA(1) is called wpa. There is no protocol for WPA/WPA2 or WPA2 only. To change between them this command is used:

sudo nmcli connection modify Hotspot  wifi-sec.proto wpa
sudo nmcli connection modify Hotspot  wifi-sec.proto rsn
6

Unfortunately ESPHome only works with WPA2-PSK or newer, not old WPA/TKIP (“WPA1”). The issue is that your NetworkManager advertises WPA3 even though your Wi-Fi dongle doesn’t support it, so some devices will apparently fail to connect.

One way to fix it, is forcing WPA2-only mode like the example below:

sudo nmcli connection modify Hotspot wifi-sec.key-mgmt wpa-psk
sudo nmcli connection modify Hotspot wifi-sec.proto rsn
sudo nmcli connection up Hotspot

That should stop WPA3 ads and lets everything connect…

7

WPA1 is insecure and broken, so it shouldn’t be used anyways. Any device made in the last 15, even almost 20-, years should support WPA2PSK/ CCMP.

1 Like
8

Thank you very much! Now I can connect the Androit tablet, and I checked the hardware on the Pi that refused to connect. That was a plain 3B. It is luckily easy to replace (unlike the other Pi, which takes an hour to get out and in again from the waterproof box and around 25 cable coming out from the Pi, two ESP32 and one 16/16 digital Phidget card). I checked with a Pi 3B+, and that connected at once, so I will put that in the boat.

Normally I would agree, but something in this setup meant that it didn’t work with the Pi 3 and the IP67 Android tablet running Android 12. Real IP67 tablets (many Chinese “IP67” can’t take a walk through the shower, this takes salt water spray and any rain what so ever) are expensive, so I want to keep that one until it dies.

I’m very glad @LawrenceH’s solution worked, so I won’t have to use WPA1, but I do have to say that I wouldn’t be too afraid of using it here for what is in effect an IOT setup for my boat, the Mad Max:

image
image1920Ă—1080 259 KB

Everything on the boat (Home Assistant, NodeRed, SignalK (boating software), GaladrielMap (sea map software), MQTT, VNC/SSH to the Pi’s, file sharing and so on) has strong passwords, and the boat is on it’s own subnet on my pfSense box, so it is possible to get to the boat from the cabin on the ports I have opened, but not possible to get from the boat to the cabin except for with MQTT-messages. I seriously doubt that there is even a script kiddie around, as long as the network is shown as protected I can’t imagine anybody trying to get in. :grinning:

2 Likes
9

Wow, that’s a nicely equipped boat. Great shot, BTW! The archipelago looks like it’s somewhere in Scandinavia.

10

Thank you! It’s called the Mad Max because it sort of looks like something from the movies with the equipment I have for setting crawfish, lobster, crab and fish traps. I am also going “Pacific” by mounting a Scotty downrigger that I ordered from Canada to do some trolling. Almost everything electrical on the boat is controlled by relays and ESP32’s. There is a box underneath the front of the roof with speakers in, the lid is controlled by an ESP32 and an actuator.

And yes, it’s the southern tip of Norway. If I go around the island where it’s docked on the north side, there’s nothing but sea and Denmark south of me. :grin:

Btw it turns out that the commands do not survive a reboot, after a reboot of the Pi I have to run them again to make the tablet connect. No idea why, but I can add it to the start-up sequence, so the commands are run when the main power relay is turned on. :+1:

1 Like