TTS not working with LetsEncrypt

Configuration
21

Here is what i get from the sonos log:

[1970-01-21 11:44:35.949] <certval,1> (pass 1) local cert validation failed (27) for hass.mydomain.com
[1970-01-21 11:44:36.397] <certval,1> (pass 2) remote validation failed with result 27 with ttl 300 for hass.mydomain.com
[1970-01-21 11:44:36.398] <ssl,1> SSL connect error -0x2700 11 to hass.mydomain.com
[1970-01-21 11:44:36.424] <certval,1> (pass 1) local cert validation failed (27) for hass.mydomain.com
[1970-01-21 11:44:36.425] <certval,1> (pass 2) remote validation failed with local cache hit 27 for hass.mydomain.com
[1970-01-21 11:44:36.425] <ssl,1> SSL connect error -0x2700 11 to hass.mydomain.com
[1970-01-21 11:44:36.426] <chsrc,0> Transport error ERROR_LOST_CONNECTION for account type 0, URI: https://hass.mydomain.com/api/tts_proxy/9e7609d004e4703e1ae14b532277bb432912fe7e_no_-_google.mp3, friendly name: 9e7609d004e4703e1ae14b532277bb432912fe7e_no_-_google.mp3, share/server: hass.mydomain.com, path: https://hass.mydomain.com/api/tts_proxy/9e7609d004e4703e1ae14b532277bb432912fe7e_no_-_google.mp3, ip: 192.168.10.82, host: hass.mydomain.com, extra info: , http: -1, framer: mp3
22

Is the URI in the log correct?
Can you connect to the file using a web browser?
`https://hass.mydomain.com/api/tts_proxy/9e7609d004e4703e1ae14b532277bb432912fe7e_no_-_google.mp3

23

The Problem is, that many people forgeth to add the correct port to base_url.

24

The domain is not correct in this post, but i can open the url from a browser with the right domain.

25

which version of the domain? I ve tried every single one and none worked

26

How embarrassing… I left the .net off the base URL :grimacing:
All working now - Many thanks :blush:

27

I decided to switch system to HassIO. to see if the problem was in Hassbian .
and with Hassio i get a different error.

2017-07-25 16:13:20 ERROR (MainThread) [aiohttp.access] Error in logging
Traceback (most recent call last):
File “/usr/lib/python3.6/site-packages/aiohttp/helpers.py”, line 490, in log
for key, value in fmt_info:
File “/usr/lib/python3.6/site-packages/aiohttp/helpers.py”, line 473, in
return ((key, method(args)) for key, method in self._methods)
File “/usr/lib/python3.6/site-packages/aiohttp/helpers.py”, line 426, in _format_a
peername = args[3].get_extra_info(‘peername’)
File “/usr/lib/python3.6/asyncio/sslproto.py”, line 306, in get_extra_info
return self._ssl_protocol._get_extra_info(name, default)
File “/usr/lib/python3.6/asyncio/sslproto.py”, line 547, in _get_extra_info
return self._transport.get_extra_info(name, default)
AttributeError: ‘NoneType’ object has no attribute ‘get_extra_info’

Can anyone figure out what this means?
It shows up when I try to trigger an automation or a script to test TTS on my google home device

1 Like
28

My installation of Home Assistant on HassIO is logging the same error from aiohttp.access but I’m not using TTS thus it should be related with another component. Anyone could help us on this error? Thks

29

I figure out what is wrong… it seems the problem is not with ha or letsencrypt, the problem is my router, its a mapping issue. I turn LetsEncrypt on and left it on for a few days, on the 3rd day Google home starting working out of the blue, then a few days later it stops, and now its working again. its the way the router maps the Ip with ssl

2 Likes
30

I had the same problem. I found the issue is your router. Google “NAT loopback” to find more info about the problem. Basically means that when you are port forwarding to an internal IP, from the Internet you should have no problem going to mydomain.duckdns.org, because it will resolve with your public IP address and the router will NAT it to the local address. BUT… from the LAN side, if you try to access your public IP address the port forwarding will not trigger, so you will end trying to access your public IP, and then nothing happens.

If your router do no support NAT loopback, then… it won’t work.

A solution to your local workstations can be installing up a local DNS and setting the mydomain.duckdns.org domain, using the local IP’s, then setting your DHCP to give your internal DNS to resolve.

And even then google tts will not work, because chromecast has its DNS servers fixed to google public ones (You can not even change the IP address assigned to it, just make DHCP reservations to keep it using the same one every time).

Now, if you use the base url setting with the IP address, there’s another issue with that… this time the certificate will not validate against the IP aaddress, and chromecast will not play the MP3 either.

So… the only real solution is NAT loopback or use plain HTTP.

3 Likes
31

I suppose that there is a solution without local DNS. I used one more additional “hairpin” rule in my router configuration to solve the problem of accessing services from LAN via DNS name. It described at http://wiki.mikrotik.com/wiki/Hairpin_NAT. Thus I’ve got tts working with LetsEncrypt.

32

Yes, that’s what I meant with NAT loopback, the problem is that not all routers support that feature. But that’s the only solution to fix the gcast problem with HTTPS.

2 Likes
33

@Andres_Arenas_Velez Thank you for this! My router not supporting Nat Loopback was breaking both tts and duckdns for hassio. (I’d never heard of Nat Loopback before you mentioned it in this thread) I bought a new router, and everything worked splendidly.

1 Like
34

THANK YOU FOR THIS POST! I am running a PFSense router that I built using a PC. It does not have this feature turned on by default, but it is an option. I switched it on and its now working for me. Switching on this feature is the ONLY change I made and it worked! I can now move on to setting up the advanced Alexa custom voice control that requires you to use SSL for it to work and do away with the Phillips hue emulation. THANK YOU AGAIN!

35

I can also confirm the hairpin NAT solved my problem. Although the mikrotik solution above did not work for me, I found one that did.

https://freek.ws/2016/11/21/mikrotik-hairpin-nat-with-dynamic-wan-ip-for-dummies/