[Bug]: SB8200 authencation and HTTPS

[travismolick]

Integration Version

3.10.2

Home Assistant Version

2025.12.4

Modem Model

ARRIS SB8200

Modem Model Selection in Config

Manually selected my specific model

Bug Description

I am getting this error when attempting to add a ARRIS SB8200

Cannot reach modem - network connectivity issue. Please check: 1. Network connection - Are you on the correct WiFi network? 2. Guest WiFi - Guest networks often block access to local devices 3. VPN - Disconnect any active VPN connections 4. IP address - Verify the modem's IP (typically 192.168.100.1) 5. Modem web interface - Ensure it's enabled and accessible Try accessing the modem directly in your browser to verify connectivity.

It uses a login page and HTTPS self signed cert

Expected Behavior

add to HA?

Steps to Reproduce

attempt to add SB8200 in devices and services but get error instead when selecting auto or SB8200

Relevant Log Output

2025-12-23 14:05:18.808 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Performing quick connectivity check to 192.168.100.1
2025-12-23 14:05:18.849 WARNING (SyncWorker_3) [custom_components.cable_modem_monitor.config_flow] https://192.168.100.1: HTTPS HEAD request connection error after 0.04s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-23 14:05:18.849 WARNING (SyncWorker_3) [custom_components.cable_modem_monitor.config_flow] Retrying https://192.168.100.1 with GET request as fallback...
2025-12-23 14:05:18.897 WARNING (SyncWorker_3) [custom_components.cable_modem_monitor.config_flow] https://192.168.100.1: HTTPS GET fallback failed after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-23 14:05:18.944 WARNING (SyncWorker_3) [custom_components.cable_modem_monitor.config_flow] http://192.168.100.1: HTTP HEAD request connection error after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-23 14:05:18.944 WARNING (SyncWorker_3) [custom_components.cable_modem_monitor.config_flow] Retrying http://192.168.100.1 with GET request as fallback...
2025-12-23 14:05:18.995 WARNING (SyncWorker_3) [custom_components.cable_modem_monitor.config_flow] http://192.168.100.1: HTTP GET fallback failed after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-23 14:05:18.995 ERROR (SyncWorker_3) [custom_components.cable_modem_monitor.config_flow] ✗ Connectivity check FAILED for 192.168.100.1. Diagnostic details: HTTPS HEAD request connection error after 0.04s: SSLError | HTTPS GET fallback failed after 0.05s: SSLError | HTTP HEAD request connection error after 0.05s: SSLError | HTTP GET fallback failed after 0.05s: SSLError
2025-12-23 14:05:18.996 ERROR (MainThread) [custom_components.cable_modem_monitor.config_flow] Quick connectivity check failed: Cannot reach modem at 192.168.100.1. Please check: (1) Network connection - ensure you're on the correct network, not on guest WiFi or VPN. (2) Modem IP address is correct. (3) Modem web interface is enabled.

Configuration

- URL: https://192.168.100.1
- Authentication: Basic Auth
- Modem Model: ARRIS SB8200 (or auto)

Installation Method

HACS

Diagnostics Download

No response

Additional Context

No response

Pre-submission Checklist

• I have searched for similar issues and found none
• I have reviewed the troubleshooting guide
• I have provided all requested information
• I have removed any sensitive information (passwords, IP addresses if private)

[kwschulz]

Hi Travis, thanks for the detailed report - those logs were really helpful.

I dug into the handshake error. It looks like your SB8200 and Home Assistant can't agree on a cipher suite for the encrypted connection. Python 3.10 tightened its SSL defaults to exclude legacy ciphers, and cable modem firmware often doesn't keep up with these changes. I suspect that's what's happening here, but I'm not certain until someone with an SB8200 can test the fix.

Running on this assumption, I added a LegacySSLAdapter that lowers OpenSSL's security level to allow older ciphers. During setup, it tries modern SSL first and falls back to legacy mode if it detects a handshake failure (specifically looking for errors containing "handshake" or "sslv3" like yours).

If you want to try it, the fix is on feature/v3.12.0. Since you're already using HACS, you can install it using the Testing Unreleased Versions instructions in the README.

Let me know if it works (or doesn't). No pressure to test if you'd rather wait for the official release (targeting the first week of January).

[travismolick]

I pushed up to the newer version feature/v3.12.0 and im still getting the same error
attempted with 192.168.100.1 and 192.168.0.1 (modem responds to both)
logs are below

2025-12-29 11:41:14.922 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Performing quick connectivity check to 192.168.100.1
2025-12-29 11:41:14.953 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] https://192.168.100.1: HTTPS HEAD request connection error after 0.03s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:14.954 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] Retrying https://192.168.100.1 with GET request as fallback...
2025-12-29 11:41:15.010 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] https://192.168.100.1: HTTPS GET fallback failed after 0.06s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:15.060 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] http://192.168.100.1: HTTP HEAD request connection error after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:15.061 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] Retrying http://192.168.100.1 with GET request as fallback...
2025-12-29 11:41:15.107 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] http://192.168.100.1: HTTP GET fallback failed after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:15.107 ERROR (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] ✗ Connectivity check FAILED for 192.168.100.1. Diagnostic details: HTTPS HEAD request connection error after 0.03s: SSLError | HTTPS GET fallback failed after 0.06s: SSLError | HTTP HEAD request connection error after 0.05s: SSLError | HTTP GET fallback failed after 0.05s: SSLError
2025-12-29 11:41:15.108 ERROR (MainThread) [custom_components.cable_modem_monitor.config_flow] Quick connectivity check failed: Cannot reach modem at 192.168.100.1. Please check: (1) Network connection - ensure you're on the correct network, not on guest WiFi or VPN. (2) Modem IP address is correct. (3) Modem web interface is enabled. (4) If your modem is slow to respond, try submitting again.

Diagnostic details: HTTPS HEAD request connection error after 0.03s: SSLError | HTTPS GET fallback failed after 0.06s: SSLError | HTTP HEAD request connection error after 0.05s: SSLError | HTTP GET fallback failed after 0.05s: SSLError
2025-12-29 11:41:21.295 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Performing quick connectivity check to 192.168.0.1
2025-12-29 11:41:21.326 WARNING (SyncWorker_1) [custom_components.cable_modem_monitor.config_flow] https://192.168.0.1: HTTPS HEAD request connection error after 0.03s: SSLError - HTTPSConnectionPool(host='192.168.0.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:21.326 WARNING (SyncWorker_1) [custom_components.cable_modem_monitor.config_flow] Retrying https://192.168.0.1 with GET request as fallback...
2025-12-29 11:41:21.376 WARNING (SyncWorker_1) [custom_components.cable_modem_monitor.config_flow] https://192.168.0.1: HTTPS GET fallback failed after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.0.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:21.426 WARNING (SyncWorker_1) [custom_components.cable_modem_monitor.config_flow] http://192.168.0.1: HTTP HEAD request connection error after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.0.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:21.426 WARNING (SyncWorker_1) [custom_components.cable_modem_monitor.config_flow] Retrying http://192.168.0.1 with GET request as fallback...
2025-12-29 11:41:21.475 WARNING (SyncWorker_1) [custom_components.cable_modem_monitor.config_flow] http://192.168.0.1: HTTP GET fallback failed after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.0.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 11:41:21.475 ERROR (SyncWorker_1) [custom_components.cable_modem_monitor.config_flow] ✗ Connectivity check FAILED for 192.168.0.1. Diagnostic details: HTTPS HEAD request connection error after 0.03s: SSLError | HTTPS GET fallback failed after 0.05s: SSLError | HTTP HEAD request connection error after 0.05s: SSLError | HTTP GET fallback failed after 0.05s: SSLError
2025-12-29 11:41:21.476 ERROR (MainThread) [custom_components.cable_modem_monitor.config_flow] Quick connectivity check failed: Cannot reach modem at 192.168.0.1. Please check: (1) Network connection - ensure you're on the correct network, not on guest WiFi or VPN. (2) Modem IP address is correct. (3) Modem web interface is enabled. (4) If your modem is slow to respond, try submitting again.

Diagnostic details: HTTPS HEAD request connection error after 0.03s: SSLError | HTTPS GET fallback failed after 0.05s: SSLError | HTTP HEAD request connection error after 0.05s: SSLError | HTTP GET fallback failed after 0.05s: SSLError

I have uploaded the certificate from the modem as a zip file (pem not allowed directly)
0000BB25A860.pem.zip

I also ran testssl.sh to provide information on the ssl connection ciphers (removed some info not needed)

$ testssl.sh https://192.168.100.1/
  testssl.sh version 3.2.2 from https://testssl.sh/

  Using OpenSSL 3.6.0 (Oct 1 2025)  [~96 ciphers]

 Testing protocols via sockets except NPN+ALPN

 SSLv2      not offered (OK)
 SSLv3      not offered (OK)
 TLS 1      offered (deprecated)
 TLS 1.1    offered (deprecated)
 TLS 1.2    offered (OK)
 TLS 1.3    not offered and downgraded to a weaker protocol
 NPN/SPDY   not offered
 ALPN/HTTP2 not offered

 Testing cipher categories

 NULL ciphers (no encryption)                      not offered (OK)
 Anonymous NULL Ciphers (no authentication)        not offered (OK)
 Export ciphers (w/o ADH+NULL)                     not offered (OK)
 LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export)      offered (NOT ok)
 Triple DES Ciphers / IDEA                         offered
 Obsoleted CBC ciphers (AES, ARIA etc.)            offered
 Strong encryption (AEAD ciphers) with no FS       offered (OK)
 Forward Secrecy strong encryption (AEAD ciphers)  not offered


 Testing server's cipher preferences

Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
-----------------------------------------------------------------------------------------------------------------------------
SSLv2
 -
SSLv3
 -
TLSv1 (no server order, thus listed by strength)
 x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA
 x84     CAMELLIA256-SHA                   RSA        Camellia    256      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
 x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA
 x96     SEED-SHA                          RSA        SEED        128      TLS_RSA_WITH_SEED_CBC_SHA
 x41     CAMELLIA128-SHA                   RSA        Camellia    128      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
 x07     IDEA-CBC-SHA                      RSA        IDEA        128      TLS_RSA_WITH_IDEA_CBC_SHA
 x05     RC4-SHA                           RSA        RC4         128      TLS_RSA_WITH_RC4_128_SHA
 x04     RC4-MD5                           RSA        RC4         128      TLS_RSA_WITH_RC4_128_MD5
 x0a     DES-CBC3-SHA                      RSA        3DES        168      TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLSv1.1 (no server order, thus listed by strength)
 x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA
 x84     CAMELLIA256-SHA                   RSA        Camellia    256      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
 x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA
 x96     SEED-SHA                          RSA        SEED        128      TLS_RSA_WITH_SEED_CBC_SHA
 x41     CAMELLIA128-SHA                   RSA        Camellia    128      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
 x07     IDEA-CBC-SHA                      RSA        IDEA        128      TLS_RSA_WITH_IDEA_CBC_SHA
 x05     RC4-SHA                           RSA        RC4         128      TLS_RSA_WITH_RC4_128_SHA
 x04     RC4-MD5                           RSA        RC4         128      TLS_RSA_WITH_RC4_128_MD5
 x0a     DES-CBC3-SHA                      RSA        3DES        168      TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLSv1.2 (no server order, thus listed by strength)
 x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384
 x3d     AES256-SHA256                     RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA256
 x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA
 x84     CAMELLIA256-SHA                   RSA        Camellia    256      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
 x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256
 x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256
 x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA
 x96     SEED-SHA                          RSA        SEED        128      TLS_RSA_WITH_SEED_CBC_SHA
 x41     CAMELLIA128-SHA                   RSA        Camellia    128      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
 x07     IDEA-CBC-SHA                      RSA        IDEA        128      TLS_RSA_WITH_IDEA_CBC_SHA
 x05     RC4-SHA                           RSA        RC4         128      TLS_RSA_WITH_RC4_128_SHA
 x04     RC4-MD5                           RSA        RC4         128      TLS_RSA_WITH_RC4_128_MD5
 x0a     DES-CBC3-SHA                      RSA        3DES        168      TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLSv1.3
 -

 Has server cipher order?     no (NOT ok)
 -- inconclusive test, matching cipher in list missing, better see above

 Testing server defaults (Server Hello)

 TLS extensions (standard)    "heartbeat/#15" "session ticket/#35" "renegotiation info/#65281"
 Session Ticket RFC 5077 hint 300 seconds, session tickets keys seems to be rotated < daily
 SSL Session ID support       yes
 Session Resumption           Tickets: yes, ID: no
 TLS clock skew               Random values, no fingerprinting possible
 Client Authentication        none
 Signature Algorithm          SHA256 with RSA
 Server key size              RSA 2048 bits (exponent is 65537)
 Server key usage             Digital Signature, Key Encipherment
 Server extended key usage    Any Extended Key Usage, TLS Web Client Authentication, TLS Web Server Authentication
 Serial                       5FE3A3CDEA2605E340C88AFD28A16E67 (OK: length 16)
 Fingerprints                 SHA1 E6B123AEDBA493E9F4C38FFCFB0D328BC3B24F27
                              SHA256 DB59FE023E5C5AFF67D37C7BE5A9ADD50AC42208FFBFB72C8F05D41AF376E488
 Common Name (CN)             0000BB25A860
 subjectAltName (SAN)         missing (NOT ok) -- Browsers are complaining
 Trust (hostname)             certificate does not match supplied URI
 Chain of trust               NOT ok (chain incomplete)
 EV cert (experimental)       no
 Certificate Validity (UTC)   5473 >= 60 days (2020-12-23 20:08 --> 2040-12-23 20:08)
                              >= 10 years is way too long
 ETS/"eTLS", visibility info  not present
 Certificate Revocation List  --
 OCSP URI                     --
                              NOT ok -- neither CRL nor OCSP URI provided
 OCSP stapling                not offered
 OCSP must staple extension   --
 DNS CAA RR (experimental)    not offered
 Certificate Transparency     --
 Certificates provided        1
 Issuer                       SWROB Device Sub-CA 2 (ARRIS Group, Inc. from US)
 Intermediate Bad OCSP (exp.) Ok

[kwschulz]

Good thinking running testssl.sh - that output helped.

Looking at your logs again, I noticed there's no "Trying with legacy SSL ciphers..." line. The fallback code existed but the connectivity check was failing before it ever ran. Missed that on the first pass.

Pushed an update (75f466a) that should address this. If you pull the latest feature/v3.12.0 and try again, hopefully you'll see:

Trying https://192.168.100.1 with legacy SSL ciphers...
✓ Connectivity check PASSED (legacy SSL)

If not, the new logs should at least tell us what to try next.

[travismolick]

That worked
I have attached logs just in case

2025-12-29 21:15:51.312 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Performing quick connectivity check to 192.168.100.1
2025-12-29 21:15:51.351 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] https://192.168.100.1: HTTPS HEAD request connection error after 0.04s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 21:15:51.352 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] Retrying https://192.168.100.1 with GET request as fallback...
2025-12-29 21:15:51.406 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] https://192.168.100.1: HTTPS GET fallback failed after 0.05s: SSLError - HTTPSConnectionPool(host='192.168.100.1', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:1032)')))
2025-12-29 21:15:51.406 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] Trying https://192.168.100.1 with legacy SSL ciphers...
2025-12-29 21:15:51.738 WARNING (SyncWorker_2) [custom_components.cable_modem_monitor.config_flow] ✓ Connectivity check PASSED (legacy SSL): https://192.168.100.1 returned HTTP 200
2025-12-29 21:15:51.739 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Quick connectivity check PASSED for 192.168.100.1 (legacy_ssl=True)
2025-12-29 21:15:51.740 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Creating scraper for 192.168.100.1 (legacy_ssl=True)
2025-12-29 21:15:51.741 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Attempting to connect to modem at 192.168.100.1
2025-12-29 21:15:52.498 WARNING (MainThread) [custom_components.cable_modem_monitor.config_flow] Detection successful: {'modem_name': 'ARRIS SB8200', 'manufacturer': 'ARRIS', 'successful_url': 'https://192.168.100.1/', 'release_date': '2016', 'docsis_version': '3.1', 'fixtures_path': 'tests/parsers/arris/fixtures/sb8200', 'fixtures_url': 'https://github.com/solentlabs/cable_modem_monitor/tree/main/tests/parsers/arris/fixtures/sb8200', 'verified': True, 'supports_icmp': True, 'logout_endpoint': None, 'capabilities': ['ofdm_upstream', 'software_version', 'hardware_version', 'current_time', 'downstream_channels', 'system_uptime', 'ofdm_downstream', 'upstream_channels'], 'actual_model': 'SB8200'}