RequestError: unable to verify the first certificate

[Kime203]

Hello I have a problem I always get the error: "RequestError: unable to verify the first certificate" where could the error be?

[mkgeiger]

You must uncheck "Activate secure connection (SSL/TLS)" and also unckeck "Use basic auhentication" in first http request node. Reason: the URL https://... is a TLS connection usually checking the validity of the ceritificate chain (incl. the CA certificate). If the certificate has not been created by the right CA (e.g. also for elf signed certificates) the validation of the certificate will fail. To work around the certificate validation please uncheck the 2 mentioned options.

[Kime203]

Thank you! The 2 options were disabled. I have tried different settings but it doesn't want to work. Do I have to adjust anything on the inverter?

[mkgeiger]

Nothing more needed to be adjusted only the inverter side (at least for me), except activating the Webconnect server. The inverter variant at my side which I could only test is a SMA Sunny Tripower 8.0 Smart Energy (STP8.0-3SE). But the 5 / 6 / 10 kW variants should make no difference. If you are using a different inverter model it may not work.

[Seb-Sch]

I get the same error and I have a a Tripower 5.0. Webconnect is enabled, IP address and password is set, any more hints?

[mkgeiger]

Sorry for the late response. I figured out of some issues with the SMA Sunny Tripower inverter. After automatic SW-update (triggered by SMA) 2 issues occured: 1st: the Webconnect functionality is always switched OFF again, you need to activate it again after each SW-Update with the installer account, which is very unsatisfactory and annoying. 2nd: after the SW-update I encountered massive DNS problems in my setup so that the inverter address "sma0123456789.local" could not be resolved anymore. I replaced the DHCP settings with a fixed IP address (192.168.x.y) in the inverter and changed the 3 HTTP request nodes in the Node-Red flow accordingly by setting the URLs to: https://192.168.x.y/dyn/...
This should work stable now. Maybe you have the same issues.

[enjoi11]

I encounter exactly the same problem. I use a SMA Sunny Tripower 10.0 and get the same error as @Kime203. Webconnect is switched on and IP is set. Any more hints in resolving the issue?

[airborneastro]

Actually, I have checked "Activate secure connection (SSL/TLS)" and unchecked "Use basic authentication" and it works nicely with an SMA Sunny Tripower SE 10.0. My flow has a "tls-config" node which is empty. Interestingly, my SMA webinterface shows "Webconnect OFF".

[airborneastro]

Also, what happens if you address the inverter with curl -X POST https://sma<serialnumber>/dyn/login.json -k -H 'Content-Type: application/json' -d '{"right": "usr", "pass": "<yourpassword>"}' ? This should give a response like {"result":{"sid":"A53TnUC-0MQ-dWCA"}} . Log out afterwards with curl -X POST https://sma<serialnumber>/dyn/logout.json?sid=A53TnUC-0MQ-dWCA -k -H 'Content-Type:application/json' -d '{}'

[enjoi11]

Activating TLS doesn't make any difference - error is the same. But when I use your curl command and run it from the node red terminal I get a response like: {"result":{"sid":"xxxxxx"}}

[enjoi11]

I found the issue. I activated TLS again and in the empty TLS config I had to uncheck "Verify server certificate".

[airborneastro]

Good that you found the issue. Actually, I should have mentioned that my TLS config is "empty".

[taurolapan]

Hello everyone, I have the following problem,

when I use the inverter in the terminal of the RaspberryPi 4b
curl -X POST https://sma<serialnumber>/dyn/login.json -k -H 'Content-Type: application/json' -d '{"right": "usr", "pass": "<yourpassword >"}'?
I get this response {"result":{"sid":"A53TnUC-0MQ-dWCA"}}.
I'll try after that
curl -X POST https://sma123456789/dyn/logout.json?sid=A53TnUC-0MQ-dWCA -k -H 'Content-Type:application/json' -d '{}'
appears {"err":401}

The node "http request" is attached in [*.jpg].
TLS configuration is "empty"
Can someone please help me?

Sincerely
taurolapan

[pddpauw]

I found the issue. I activated TLS again and in the empty TLS config I had to uncheck "Verify server certificate".

thanks a lot. This indeed make it work also for me (Sunny Tripower 10): enabling Webconnect, and having those SSL enable in Node Red with below settings for the tls-config

[taurolapan]

Hello pddpauw,

Thank you for your message! Unfortunately it didn't solve my problem.

when I use the inverter in the terminal of the RaspberryPi 4b
appears {"err":401}

in node red:

Dec 20, 2023, 8:39 p.m. node: session IDfunction: (error)
"TypeError: Cannot read properties of undefined (reading 'sid')"

Sincerely
taurolapan

[pddpauw]

Hello pddpauw,

Thank you for your message! Unfortunately it didn't solve my problem.

when I use the inverter in the terminal of the RaspberryPi 4b appears {"err":401}

in node red:

Dec 20, 2023, 8:39 p.m. node: session IDfunction: (error)
"TypeError: Cannot read properties of undefined (reading 'sid')"

Sincerely taurolapan

I suggest you add a debug node to the first http request, and check if the object has content (click through on the arrows).
In my case, I had to change parameters in the variable as per below (highlighted yellow), in the Messwerte 2 function. The info can be found in the debug node.
Hope this helps!

[jgeraerts1986]

The first HTTP request keeps returning 'UNABLE TO VERIFY LEAF SIGNATURE"

When I connect to the ip adress or SMAID.local with the entered credentials, this works fine.

[Jogi0677]

I have the same Problem, i always get the Message: 'UNABLE TO VERIFY LEAF SIGNATURE"
No matter if i use "smaxxxxxx.local" or the IP-Adress.
SUNNY TRIPOWER 8.0 SE
Firmware-Version: 3.4.16.R
Webconnect is active.

[Denis1983]

I have the same Problem, i always get the Message: 'UNABLE TO VERIFY LEAF SIGNATURE" No matter if i use "smaxxxxxx.local" or the IP-Adress. SUNNY TRIPOWER 8.0 SE Firmware-Version: 3.4.16.R Webconnect is active.

You have to do in each of 3 "http request node":

1. Check "Enable secure (SSL/TLS) connection"
2. Create a new "TLS Configuration" --> then
3. Uncheck "Verify server certificate" inside it.

Additionally check WR hostname, sometimes you just need it without suffix ".local"

That solution worked for me!