Is it standard behaviour that the MAC address is part of the certificate?

[Galaxy102]

Hello and thank you for your work on androidtvremote2.

When troubleshooting the Android TV Remote integration in my HomeAssistant setup (missing unique_id), I stumbled upon the method AndroidTVRemote#async_get_name_and_mac which extracts the MAC address from the server certificate of the Android TV service.

On my STRONG Leap S3 Pro the certificate does not contain the MAC address, the subject is dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB. Perhaps that is due to the box having two MAC addresses (one for WiFi, one for Ethernet). Is this non-standard behaviour of the STB or rather an edge case?

Either way, I will open another issue and probably a PR on HomeAssistant to improve handling of this case. This question here is more to learn about the protocol.

Best regards,
Konstantin

[tronikos]

That should be the bluetooth mac address. If you run the demo.py in this repo without any arguments what do you get when it lists all devices under _androidtvremote2._tcp.local.?

[Galaxy102]

There it works. The mac address lookup doesn't work only when connecting via hostname; but this is not tested in the demo script.

I can reproduce this using the following MWE:

import asyncio

from androidtvremote2 import AndroidTVRemote

loop = asyncio.new_event_loop()
remote = AndroidTVRemote(client_name="Android TV Remote demo", certfile="cert.pem", keyfile="key.pem", host="<MY_ATV_HOSTNAME>", loop=loop)
name, mac = loop.run_until_complete(remote.async_get_name_and_mac())
loop.close()
print(f"name={name}, mac={mac}")

The output is: name=UHD Google TV STB, mac=

As I've already mentioned in the corresponding HomeAssistant issue, this does not need fixing as it works with zeroconf. In this discussion I only wanted to expand my knowledge on how the certificate SHOULD be.

[tronikos]

Can you run the following from a linux terminal? (You can use the terminal addon in Home Assistant if you don't have linux)

openssl s_client -connect android_tv_ip:6467 -showcerts </dev/null

and post its output after removing identifiers and the actual cert.

[Galaxy102]

Here you go:

~> openssl s_client -connect <MY_HOSTNAME>:6467
Connecting to 192.168.XXX.XXX
CONNECTED(00000003)
depth=0 dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
verify error:num=18:self-signed certificate
verify return:1
depth=0 dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
verify return:1
---
Certificate chain
 0 s:dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
   i:dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Nov 14 04:00:00 2024 GMT; NotAfter: Jan 19 03:14:07 2038 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
<REDACTED>
-----END CERTIFICATE-----
subject=dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
issuer=dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
---
No client certificate CA names sent
Requested Signature Algorithms: ECDSA+SHA256:RSA-PSS+SHA256:RSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA384:RSA+SHA384:RSA-PSS+SHA512:RSA+SHA512:RSA+SHA1
Shared Requested Signature Algorithms: ECDSA+SHA256:RSA-PSS+SHA256:RSA+SHA256:ECDSA+SHA384:RSA-PSS+SHA384:RSA+SHA384:RSA-PSS+SHA512:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: rsa_pss_rsae_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 1353 bytes and written 1673 bytes
Verification error: self-signed certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 18 (self-signed certificate)
---
80AB1C03E97F0000:error:0A00045C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required:ssl/record/rec_layer_s3.c:916:SSL alert number 116

~> openssl x509 -in /tmp/cert.pem -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1731565062nnn (0x19329520xxx)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
        Validity
            Not Before: Nov 14 04:00:00 2024 GMT
            Not After : Jan 19 03:14:07 2038 GMT
        Subject: dnQualifier=HPR302-STRONG/RMQ/UHD Google TV STB
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c9:a6:f7:ff:ef:ee:b5:8a:de:23:20:4d:27:7f:
                    60:fb:b9:dc:80:ce:12:66:0e:18:d8:1b:24:17:c1:
                    37:2a:67:ae:b4:cc:81:d4:6c:87:50:76:85:0f:66:
                    5a:96:30:95:96:33:8b:31:5e:77:ce:c7:67:16:aa:
                    4f:04:73:ea:39:8a:c1:a9:d7:01:da:80:db:81:7c:
                    26:c4:18:3a:cf:07:81:01:cb:d7:64:37:f5:2b:e6:
                    e7:c0:e1:6c:bc:ff:76:38:b9:d0:52:c4:1b:d2:e6:
                    11:2d:39:a2:c0:ce:e6:c4:df:c1:25:c2:0a:51:cd:
                    8e:84:45:43:f8:27:42:16:17:55:65:a8:39:9e:21:
                    37:c6:ad:e1:37:d5:28:b5:9c:6c:6f:60:ba:6e:98:
                    24:f6:82:53:77:33:64:1a:96:9e:44:69:69:03:9c:
                    b0:cf:e1:6f:41:78:5b:e6:3b:a7:04:59:be:69:7c:
                    ef:62:ac:8f:40:84:09:0a:ab:18:0c:94:55:34:75:
                    32:0f:8e:eb:d0:22:40:06:cd:05:74:b8:b2:f2:8d:
                    3a:87:d8:5c:ae:6b:fb:34:d0:e6:e8:d7:aa:66:74:
                    96:f6:de:a0:3a:0c:1c:5a:bd:40:08:ad:ef:c0:18:
                    be:bc:8a:c8:eb:e0:1e:94:23:84:b0:2b:8b:56:ba:
                    08:0b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:TRUE
            X509v3 Subject Key Identifier: 
                0F:F4:2F:EE:D0:A8:E6:59:B4:D6:AE:5C:6F:34:5A:BC:C4:36:17:C6
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Authority Key Identifier: 
                0F:F4:2F:EE:D0:A8:E6:59:B4:D6:AE:5C:6F:34:5A:BC:C4:36:17:C6
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        6f:25:cf:c2:43:b7:85:5b:cc:c6:11:a8:9f:9d:f7:1d:91:8d:
        8c:76:53:2c:a2:36:07:ca:1d:b4:4d:3e:78:31:5b:70:1b:76:
        d1:9c:b7:29:21:2d:76:3e:fa:5f:66:1a:e3:3c:42:01:06:3c:
        cd:cf:95:e5:98:bc:b4:de:36:66:aa:69:84:bf:b2:5d:4b:df:
        17:58:40:84:c2:eb:1a:f6:0b:33:b6:f0:af:ec:7b:c8:4c:79:
        b0:57:99:3a:1b:e7:56:ed:8b:93:5f:af:c2:b7:69:64:9c:de:
        00:99:07:6a:02:35:0f:72:d6:09:39:79:9d:b2:b9:d6:2a:a0:
        65:d2:16:2b:12:1f:df:7d:f7:e9:00:65:ef:fa:8b:80:31:29:
        2a:6a:95:2f:19:55:cb:32:eb:e1:58:da:0d:cb:5e:85:63:61:
        5b:71:57:31:cd:ac:b5:a1:47:f4:a2:83:db:fb:64:77:5e:86:
        ef:c1:d1:74:af:fb:16:51:1b:8a:bf:a2:09:de:d7:87:8a:be:
        f6:71:86:90:f6:56:03:be:1a:ca:59:cc:63:d7:e8:f9:e4:c6:
        9f:e3:7c:1d:99:01:bf:1e:ae:fe:ba:62:90:a8:4d:e1:b2:54:
        f2:c7:d0:7e:57:4c:68:e0:af:e1:5e:c5:49:51:8f:7b:cb:2f:
        de:09:84:64

[tronikos]

It doesn't seem it includes a MAC address. This is the first time I encounter this. Not much we could do then as we have to use the same identifier that is exposed via zeroconf.

[Galaxy102]

Okay, thank you for looking into this with me.