From 6218df3acbfd0f68829221301329b2b055b33c69 Mon Sep 17 00:00:00 2001 From: Philip Abbey Date: Fri, 21 Aug 2026 14:54:12 +0100 Subject: [PATCH] Review comments Thanks @xhemart. --- README.md | 2 +- TroubleShooting.md | 2 +- Wi-Fi.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 2cc9560..a0e72af 100644 --- a/README.md +++ b/README.md @@ -465,7 +465,7 @@ Check the latest unresolved [issues](https://github.com/house-of-abbey/GarminHom - [Garmin Express - Wrong Language](https://forums.garmin.com/developer/connect-iq/i/bug-reports/garmin-express---wrong-language) - [Incorrect language displayed for custom data fields](https://forums.garmin.com/developer/connect-iq/f/discussion/388137/incorrect-language-displayed-for-custom-data-fields) -9. Wi-Fi may refuse to work at all for some infrastructures or devices. This problem relates to the implementation of TLS in the Garmin SDK and is beyond our control to fix. See [Wi-Fi "limits of use"](Wi-Fi.md#limits-of-use) for details. +9. Wi-Fi may refuse to work at all for some infrastructures or devices. This problem relates to the implementation of [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) in the Garmin SDK and is beyond our control to fix. See [Wi-Fi "limits of use"](Wi-Fi.md#limits-of-use) for details. 10. When using Wi-Fi or LTE to toggle a light, the `toggle` will fail when the default or current state of the application's menu does not match the state of the light. The same applies to a cover or other thing that can be toggled. This is because the application is unable to initialise the menu with the current state without Bluetooth. Hence the Wi-Fi/LTE functionality is best used with `tap` items only. diff --git a/TroubleShooting.md b/TroubleShooting.md index 068f799..1b44eae 100644 --- a/TroubleShooting.md +++ b/TroubleShooting.md @@ -152,7 +152,7 @@ To verify if you have this issue you can use a tool like [SSL Shoppers's SSL Che ## Wi-Fi Not Working -This is probably a TLS issue on your Home Assistant server. Please see [Wi-Fi "limits of use"](Wi-Fi.md#limits-of-use) section. You may be able to amend your server's TLS settings. As the application is dependent on the Garmin SDK, there is no application code that can be changed to fix the TLS version. The problem is external to this application and specific to your IT setup, therefore you are supporting yourself to resolve it. +This is probably a TLS issue associated with HTTPS. Please see [Wi-Fi "limits of use"](Wi-Fi.md#limits-of-use) section. You may be able to amend your server's TLS settings. As the application is dependent on the Garmin SDK, there is no application code that can be changed to fix the TLS version. The problem is external to this application and specific to your IT setup, therefore you are supporting yourself to resolve it. ## Online Web-based Editor diff --git a/Wi-Fi.md b/Wi-Fi.md index 05100fe..8d3dd26 100644 --- a/Wi-Fi.md +++ b/Wi-Fi.md @@ -54,7 +54,7 @@ With version 3.0 onwards the application now includes the ability to temporarily This lines up with a bug Garmin itself has acknowledged for the Epix (Gen 2) / Fenix 7: [TLS Certificate issue with Fenix 7 and Epix (Gen 2)](https://forums.garmin.com/developer/connect-iq/i/bug-reports/tls-certificate-issue-with-fenix-7-and-epix-gen-2). Per that thread, when these watches negotiate TLS directly over Wi-Fi (i.e. without the phone relaying via Bluetooth), they only offer legacy RSA-key-exchange cipher suites with no forward secrecy — exactly the class of suite my server rejects. Over Bluetooth the phone performs the TLS handshake instead, which explains why it always works there. Garmin marked that report "Complete," but the thread has follow-up comments disputing that, and no new cipher suites appear to have shown up on affected devices since. - So, it's a Garmin device side limitation (in some models) of the Connect IQ TLS stack when negotiating directly over Wi-Fi, that might be fixed by amending the TSL settings on the server if you are fortunate. Some Garmin devices only speak cipher suites without forward secrecy, which most modern TLS termination (Nabu Casa, Cloudflare, current nginx/Apache defaults, etc.) rejects by design for good security reasons. There's no app-side workaround available; it would need a firmware fix from Garmin. By "some models" its appears to include Epix (Gen 2), Fenix 7 Pro, Forerunners 265 & 970. + So, it's a Garmin device side limitation (in some models) of the Connect IQ TLS stack when negotiating directly over Wi-Fi, that might be fixed by amending the TLS settings on the server if you are fortunate. Some Garmin devices only speak cipher suites without forward secrecy, which most modern TLS termination (Nabu Casa, Cloudflare, current nginx/Apache defaults, etc.) rejects by design for good security reasons. There's no app-side workaround available; it would need a firmware fix from Garmin. By "some models" we mean it is confirmed on Epix (Gen 2); likely related on Fenix 7 Pro and Forerunner 265; possibly related on Forerunner 970 (unconfirmed). For anyone on the same models looking for a local-network route, of the options in the [README, only #2](https://github.com/house-of-abbey/GarminHomeAssistant#no-https) (local DNS override to `garmincdn.com` serving plain HTTP) sidesteps the cipher-suite issue entirely, since it avoids TLS altogether. You will still need to verify whether these watches actually honour a local DHCP-provided DNS server for that override, or alternatively hard code public resolvers.