makeWebRequest for internal networks

Hi all,

I want to share with you my experience, that I made with "Communications.makeWebRequest", especially in my internal network.
Maybe it can help one, to avoid the difficulties that I had.
Before I read a few threads here, where people having problems with this.

First I wrote a very simple Widget, which grabs some stocks from Stockdio.com and calculate the losses in my stocks-depot.
This was more or less very easy and works fine.

Then I started to develop a Widget, which connects to my smarthome, it's a Homematic (exactly a piVCCU).
To show the temperature and the humidity for some rooms on my watch and also to switch on/off some lights.
The smarthome server provides a REST and a plain text API (as an Addon).

In the simulator, it was no problem to read for example the temperature.
But on the real watch (Fenix 7s), it never worked. I got different errors, mainly -400 (Response body data is invalid for the request type). I'm using GCM on an iPhone11.
It costs me many hours to find the root cause of the problem.

The first mistake that I made, I used HTTP. It will not work with HTTP, only with HTTPS.
I think, the reason is, that Apple allows Apps to communicate with TLS only. So this is also for GCM.

Ok, then I used a self certificate for my smarthome server, to have HTTPS.
Unfortunately the same effect, GCM cannot communicate with servers, without a valid trusted certificate.

The solution that I found is, create a root CA, install it on the iPhone.
Don't forget to fully trust this certificate in "general/settings/info/certificate trust settings"

Create a certificate for the server to which you want to connect to, derived from that root CA.
Be careful when you create the cerificates, Apple put a lot of restrictions for valid certificates.
For example: RSA key >= 2048, only SHA2 (SHA1 is not valid anymore), validity for max. 825 days, ExtendedKeyUsage=id-kp-serverAuth...

If someone is interested, I can post a step by step guide, how to create the certificates. Is not that complicated, as it sounds. There a lot of such guides to find.

You can test it very easy with the safari browser on the iPhone. If you connect to the server with the browser and it still brings a warning, that it doesn't trust the certificate, it will not work.
If you can connect with the browser to your server, without adding an exception, then it will also work with GCM and your "Communications.makeWebRequest".

Finally you can do things like this. Sure, nobody really needs this, but it makes fun to develop it.


regards