Change zigbee secure network key, Zigbee2MQTT

Hi, I know I have put my self in this stupid situation. I use ZHA for most of my devises. I got a extra Sonoff 3.0 dongle and would like to have a look at zigbee2mqtt, just to understand the difference etc. Set it up, and everything worked perfect, moved some of my devices to make a real life test. I actually like the overview and interface of Zigbee2Mqtt in the HA setup, and it is rock solid and performing. So, moved some more devices:-)

Now the problem. I never used time to figure out how to make a zigbee2mqtt network, I just installed. Now Im stuck with the insecure standard network key.

I would like to move to a secure key before moving some of my more vital devices, however would like the process to be as easy as possible for the 30+ devices already in Zigbee2mqtt.

I know I have to re-pair the devices, however if I could avoid recreating them in Zigbee2mqtt I would save a lot of time in redoing automations and graphs.

Anyone tried this and figured out a good process?

I did pretty much the same thing. It was a while ago but from memory I did not delete the devices from zigbee2mqtt. All I did was:

  1. Change the network key and restart the addon
  2. Permit join all
  3. Re-pair the devices.

This reconnected the existing devices in zigbee2mqtt.

Hi Tom,
Just tried, and ended up with some problem. My process

  1. Stop Zigbee2MQTT
  2. Change the network key
  3. Delete the backup file (otherwise it will not start, as there is different keys)
  4. Start Zigbee2Mqtt

Ended with a error stating there was a nearby netowrk with the same PANID and would not start. Thourght that the best was to revert and investigate, however even after chaging the netowrk ID again Zigbee2Mqtt would not start. Got a “Bad gateway 502”, even after a restart of HA.
To be sure I got in control I reinstalled the latest backup from last night. No everything is back to normal.

Do you remember anything about the PANID. Maybe I should just change that also , it has a entry in the configuration?

Br
Sune

A short follow-up, as reference for others in the same situation. My change was done on a RPi4 using HAOS and Zigbee2MQTT in supervisor.

  1. Do a backup, to get back if you run into problems
  2. Stop Zigbee2MQTT
  3. Change the network key
  4. Change the PANID (I changed my PANID to 1, it is not important for security, however solve interference from the old network, where the devices will be looking for the coordinator)
  5. Delete the configuration backup file.
  6. Repower HA, to ensure the coordinator get power recycled (found out by trial and error)
  7. When up, there might be errors in zigbee2mqtt log about network not established. If yes, then do a reboot (not sure why, I expierenced it)
  8. Zigbee2MQTT should start. Some device errors might happen as they are not paired, I got quite a few as the devices are not there.
  9. Set zigbee2mqtt to pairing mode (remember it only is in paring for 255 seconds, so you need to enable multiple times until you are finished)
  10. Pair you devices. Remember to start with “mains” close to the coordinator

As all the devices are in the zigbee2mqtt overview, the repair is super fast. No need to do anything in zigbee2mqtt. All devices keep all settings and entity names in HA:-)

4 Likes

Thanks for this post.
I’m also using HAOS and Zigbee2MQTT Add-on. I’ve just started last week.
It seems very difficult to change the Zigbee network key via the GUI.
It is under the Zigbee2MQTT Settings > Advanced - Network Key.
I tried entering this as a string and it corrupted the Zigbee2MQTT config file (rolled back to HA backup, power cycle reboot Raspberry Pi)
So I tried ‘network key (array)’ and it allows you to enter values (any number) but unless you enter exactly 16 bytes again it corrupts the config.
I’m guessing most people use the ‘Home Assistant Command Line’ and edit the config file directly
so these bugs remain?
I’m begining to wish I’d just gone down the docker route. Probably much more ‘eyes on’
I’m running Versions:
Zigbee2MQTT version 1.29.1
Home Assistant Core Update 2023.1.2
Supervisor 2022.12.1
Operating System 9.4
Frontend 20230104.0 - latest

To edit the Z2M configuration file, I believe the easy method is installing the add-on called “Samba Share”. When running, I just connet to the HA device as any other fileserver and access the configuration files from a Windows PC. You can then use e.g. Notepad to change the configuration.

You can also install another add-on called “Studio Code Server” which will give you a very efficient and functional editor directly in HA.

Correct, the key need to be exactly the same number of bytes, as the standard key. I just change the values one by one.

1 Like

Thanks installed Samba share - \HOMEASSISTANT now available in File Explorer in Windows 11
Will try Studio Code Server. Was using vi editor and trying to copy and paste in Home Assistant Command Line!