[question] Secure Inclusion is successful but Secure shows No?

[sofakng]

I'm trying to use Secure Inclusion to add some Z-Wave devices to my network.

It appears to be successful because the devices are added but on the control panel under the Secure column they are listed as "No".

Am I misunderstanding the Secure column?

For example, one device is a GE Outdoor Smart Switch. It supports S2 Encryption and I believe when I added this using other Z-Wave hubs I needed to enter a number listed on a sticker inside the box?

However I'm also having the same issue with other devices such as Zooz ZEN27 light switches which also support S2.

[robertsLando]

Some devices require a different setup in order to enable secure/non secure inclusion. For example in my aeotec wall plug I had to press the button two times instead of just one in order to secure include it (even if you start a secure inclusion from the UI side). I suggest you to better check the device manual

[robertsLando]

Also S2 isn't supported by zwave-js yet

[smizles]

I've seen the comment that Zwavejs doesn't support S2 yet, but when I added my Zooz ZST10 controller at the beginning of June it said "Yes" under the Secure column. I added my two Yale Assure door locks and Aeotec Gen7 Recessed Door Sensor using the "Secure Inclusion" option, and I got error messages in the controller that said something like ...secure inclusion failed... However, they all said "Yes" under the Secure column. Today I had to recover from a snapshot I took yesterday before upgrading Home Assistant from 2021.6.5 to 2021.6.6, but now my controller says "No" and the locks and door sensor say "Unknown" under the Secure column. Now my automations are broken and I can no longer remotely lock and unlock the door locks.


I have Auto Update turned on for the add-on, so I'm not sure if this was caused by an update or what. Does anyone know what's going on before I open a standalone issue for this?

[robertsLando]

Try to re-interview affected nodes first

[smizles]

Try to re-interview affected nodes first

Already re-interviewed the nodes three different times, including once after restarting Home Assistant and once after rebooting the host. I also tried "healing" the network. None of these options worked.

I also noticed that the advanced configuration options for my door locks and sensor have disappeared. I reviewed their feature list, and it said those advanced configuration options were only available when the device was securely included to the Z-Wave network. I thought that there was a chance these devices were never securely included because of the error I initially got when I first included them, but now I'm second guessing that because I did have access to the "secure" features on those devices for almost a month.

As much as I would prefer to dive down the rabbit hole to figure out the exact cause of this issue, I'm afraid I'm running out of time and I might need to factory reset and build this network again from scratch because these locks control the main points of ingress and egress to my house (a.k.a. the rest of the family is yelling at me).

Does anyone know if this might be an issue with zwave-js 7.7.4 or zwavejs2mqtt 5.0.2?

[robertsLando]

Could someone add zwavejs logs please? Moving this to zwave-js repo but cannot do so much without logs

[AlCalzone]

door sensor say "Unknown" under the Secure column

Please check that the network key is properly configured. This seems to me like it isn't.

And yeah, driver logs please - from both of you :)

[smizles]

Please check that the network key is properly configured. This seems to me like it isn't.

The network key is that same one I initially set up the zwavejs add-on with back on 5/24/21, and it's the same one I backed up and successfully used to migrate to zwavejs2mqtt back on 6/1/21.

Here is the driver log from the last day (6/21/21) my locks responded to remote lock and unlock commands, which is the same day I noticed the "Unknown" status first started appearing later that evening:
zwavejs_2021-06-21.log.gz

Also, I have included a lot more information in this zwavejs2mqtt issue I just opened last night in the Home Assistant Core GitHub project: home-assistant/core#52103

[sofakng]

I'm confused ... @robertsLando said S2 isn't supported but it looks like this issue is being investigated?

[smizles]

I'm confused ... @robertsLando said S2 isn't supported but it looks like this issue is being investigated?

I'm new to Zwave, so I'm not sure if my network was running on S0 or S2. However, I am sure it was running with some sort of security because the secure command classes of my devices were available for almost a month before this issue started three days ago. Now my devices are barely usable without the advanced features that are only available on a secure Zwave network.

EDIT: In fact, I'd go as far as saying my devices actually are unusable (as far as Home Assistant is concerned) because none of the remote functionality is working even the basic lock and unlock functions...

[kpine]

I'm confused ... @robertsLando said S2 isn't supported but it looks like this issue is being investigated?

S2 is not supported, therefore a value of "Yes" for the "Secure" column in zwavejs2mqtt indicates the node was included with Security S0.

Newer devices like this GE and Zen27 only support Security S2, and not S0. Some devices support both S0 and S2, but it isn't mandatory. Locks are an exception, the are required to support S0 (at least until 2020, maybe later) for backwards compatibility with "older" gateways.

The problem with the lock is unrelated to this issue.

[AlCalzone]

@smizles Your log looks relatively normal. Sometimes the devices are a bit overeager in re-requesting a nonce (you're running on S0), which might cause a little bit of delay. To figure out why the nodes's security statuses are shown as "unknown", I'd need to see a log of a startup where it doesn't work anymore.

[sofakng]

I'm confused ... @robertsLando said S2 isn't supported but it looks like this issue is being investigated?

S2 is not supported, therefore a value of "Yes" for the "Secure" column in zwavejs2mqtt indicates the node was included with Security S0.

Newer devices like this GE and Zen27 only support Security S2, and not S0. Some devices support both S0 and S2, but it isn't mandatory. Locks are an exception, the are required to support S0 (at least until 2020, maybe later) for backwards compatibility with "older" gateways.

The problem with the lock is unrelated to this issue.

Thanks very much for the explanation. I believe this explains the behavior I'm seeing.

I've looked at the S2 Support issue on the ZWaveJS issue and the effort is listed as 'huge' so I'm guessing this isn't expected anytime soon?

I understand that most devices (ie. light switches) don't need this, but it would be nice for locks and I also have a pool heater and pool pump that I'd like to have more security on.

[AlCalzone]

I've done a bunch of the S2 work already, but some parts are still missing. There are a couple of issues I'll have to tackle first because they make the experience worse for many.

[NickHerrig]

I also have this behavior with a Direct Wire Indoor/Outdoor smart switch from GE which only supports S2.

@AlCalzone Let me know If I can help at all with testing devices when the Zwavejs PR completed or up for review.

[AlCalzone]

I should have enough S2-compatible devices to test, but you can follow the S2 PR to stay updated #1136. Once it is merged, a couple tests won't hurt.

[zwave-js-assistant]

This issue has not seen any recent activity and was marked as "stale 💤".
Closing for housekeeping purposes... 🧹

Feel free to reopen if the issue persists.