For everyone who has had issues with getting TTS working over Sonos devices with an SSL-enabled NGINX reverse proxy, try this:
- Make sure your Sonos devices have the latest firmware. Launch the Sonos app on your phone to double-check.
- Set your homeassistant.http.base_url in configuration.yaml to https://your.home.assistant (obviously use your own server name) and restart Home Assistant.
- In the NGINX configuration for your SSL server, make sure you’re running on port 443. Set your ciphers (and use all the usual SSL parameters from https://cipherli.st)
- Change your ssl_ecdh_curve parameter to include prime256v1:
ssl_ecdh_curve secp384r1:prime256v1;
- Restart your NGINX proxy and enjoy.
The strongest elliptic curve cipher that Sonos devices support is ECDHE-RSA-AES256-GCM-SHA384 (per the docs). However, what Sonos developer documents omit is that these devices do not currently support the stronger scep384r1 ECDH curve; they only support prime256v1.
I was banging my head against my desk trying to figure out why Sonos devices weren’t working with an NGINX SSL reverse proxy, until I thought to start changing cipher suites and curves. Turns out if you add prime256v1 to the list, Sonos will happily connect and play TTS sound files! As an added bonus, scep384r1 will still be used by clients that support it, as it is first in the list of choice ECDH curves, so you don’t compromise your security much by doing this.
If anyone would like to see my full NGINX config, please let me know.