Issue while onboarding

[sli-cka]

Hi,

first of all: Great work with this solution!

I am trying to setup my Roborock S5 Max with your local server, but I am stuck during the onboarding. The server (installed inside a Proxmox LXC) is running, showing a Healthy state and accessible from my target VLAN (via NginxProxyManager). Now I am running the onboarding script from my windows laptop.

First I had issues when the onboarding script terminated after sending the cfgwifi with the following error:

Reconnect this machine to your normal Wi-Fi. The script will poll the main server every 5 seconds for up to 5 minutes.
Error: <urlopen error [Errno 11001] getaddrinfo failed>

It seems the script was trying to continue immediately, but my laptop was either still connected to the Roborock wifi or not reconnect to my regular wifi yet.

I solved this by changing

output.write(
    "Reconnect this machine to your normal Wi-Fi. "
    "The script will poll the main server every 5 seconds for up to 5 minutes.\n"
)

result, status = poll_session_until_progress(

to

output.write(
    "Reconnect this machine to your normal Wi-Fi. "
    "After reconnecting, press Enter to begin polling the main server.\n"
)
input("> ")

result, status = poll_session_until_progress(

I tried around 10 cycles but never get any sample. Any idea what could be the issue here?

Output from the onboarding script:

Sending cfgwifi onboarding packet...
HELLO_RESP_CMD=17
HELLO_RESP_JSON={"id":1,"method":"hello","params":{"sdks":{"tuya":"2.0","roborock":"02"},"key":"e38d812829746431"}}
TOKEN_S=S_TOKEN_123456789abc
TOKEN_T=T_TOKEN_123456789abc
WIFI_BODY_SENT={"u":"1234567890","ssid":"XXX","token":{"r":"roborock.XXX.de/","tz":"Europe/Berlin","s":"S_TOKEN_123456789abc","cst":"CET-1CEST,M3.5.0,M10.5.0/3","t":"T_TOKEN_123456789abc"},"passwd":"XXX","country_domain":"de"}
WIFI_RESP_CMD=2
WIFI_RESP_HEX=312e300000000100020000c3222b5f
Reconnect this machine to your normal Wi-Fi. After reconnecting, press Enter to begin polling the main server.
>
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Waiting for the server to observe new onboarding traffic...
Status for S5 Max: samples=0, public_key=False, connected=False, state=missing
Waiting for onboarding traffic from the selected vacuum.
Status for S5 Max: samples=0, public_key=False, connected=False, state=missing
Waiting for onboarding traffic from the selected vacuum.

Information from the admin website:

Health

{
  "generated_at": "2026-04-09T18:29:55.843218+00:00",
  "overall_ok": true,
  "services": [
    {
      "name": "https_server",
      "running": true,
      "required": true,
      "enabled": true,
      "detail": "0.0.0.0:443",
      "updated_at": "2026-04-08T12:39:04.379875+00:00"
    },
    {
      "name": "mqtt_backend_broker",
      "running": true,
      "required": true,
      "enabled": true,
      "detail": "embedded:127.0.0.1:18830",
      "updated_at": "2026-04-08T12:39:04.268351+00:00"
    },
    {
      "name": "mqtt_tls_proxy",
      "running": true,
      "required": true,
      "enabled": true,
      "detail": "0.0.0.0:8883",
      "updated_at": "2026-04-08T12:39:04.380779+00:00"
    },
    {
      "name": "mqtt_topic_bridge",
      "running": true,
      "required": false,
      "enabled": true,
      "detail": "rr/m <-> rr/d",
      "updated_at": "2026-04-08T12:39:04.268533+00:00"
    }
  ],
  "connected_vacuums": [],
  "all_vacuums": [
    {
      "duid": "123456789abc",
      "did": "",
      "id_kind": "duid",
      "name": "S5 Max",
      "local_key": "123456789abc",
      "source": "devices",
      "key_model": "",
      "ips": [],
      "connected": false,
      "last_ip": "",
      "last_http_at": "",
      "last_http_route": "",
      "last_http_path": "",
      "last_http_remote": "",
      "last_http_host": "",
      "last_mqtt_at": "",
      "last_mqtt_topic": "",
      "last_mqtt_direction": "",
      "last_mqtt_payload_preview": "",
      "last_disconnect_at": "",
      "last_message_at": "",
      "last_message_source": "",
      "onboarding_steps": {},
      "onboarding": {
        "required_steps": [
          "region",
          "nc_prepare"
        ],
        "step_labels": {
          "region": "Region",
          "nc_prepare": "NC Prepare",
          "login_key_sign": "Key Sign"
        },
        "missing_steps": [
          "region",
          "nc_prepare"
        ],
        "has_required_messages": false,
        "has_public_key": false,
        "public_key_ready": false,
        "status": "collecting_messages",
        "guidance": "Still waiting for onboarding messages: Region, NC Prepare.",
        "key_state": {}
      },
      "model": "roborock.vacuum.s5e",
      "product_id": "123456789abc",
      "inventory_source": "devices"
    }
  ],
  "active_mqtt_connections": 0,
  "pending_onboarding_ips": [
    "IP_FROM_NGINXPROXYMANAGER"
  ],
  "last_cloud_request": {
    "success": true,
    "step": "inventory_fetched",
    "inventory_path": "/data/runtime/web_api_inventory.json",
    "cloud_snapshot_path": "/data/runtime/web_api_inventory_full_snapshot.json",
    "home_name": "My Home",
    "device_count": 1,
    "shared_device_count": 0,
    "device_names": [
      "S5 Max"
    ],
    "shared_device_names": [],
    "time": "2026-04-09T16:16:41.339020+00:00"
  }
}

Vacuums

[
  {
    "duid": "123456789abc",
    "did": "",
    "id_kind": "duid",
    "name": "S5 Max",
    "local_key": "123456789abc",
    "source": "devices",
    "key_model": "",
    "ips": [],
    "connected": false,
    "last_ip": "",
    "last_http_at": "",
    "last_http_route": "",
    "last_http_path": "",
    "last_http_remote": "",
    "last_http_host": "",
    "last_mqtt_at": "",
    "last_mqtt_topic": "",
    "last_mqtt_direction": "",
    "last_mqtt_payload_preview": "",
    "last_disconnect_at": "",
    "last_message_at": "",
    "last_message_source": "",
    "onboarding_steps": {},
    "onboarding": {
      "required_steps": [
        "region",
        "nc_prepare"
      ],
      "step_labels": {
        "region": "Region",
        "nc_prepare": "NC Prepare",
        "login_key_sign": "Key Sign"
      },
      "missing_steps": [
        "region",
        "nc_prepare"
      ],
      "has_required_messages": false,
      "has_public_key": false,
      "public_key_ready": false,
      "status": "collecting_messages",
      "guidance": "Still waiting for onboarding messages: Region, NC Prepare.",
      "key_state": {}
    },
    "model": "roborock.vacuum.s5e",
    "product_id": "123456789abc",
    "inventory_source": "devices"
  }
]

[DonSidro]

Seems like the server isn't seeing any onboarding traffic from the vacuum at all. Do you have any logs from the docker server running?

[Lash-L]

If you go to https://api-roborock.XXX.de/admin in your browser on the same VLAN, does your browser complain about certificate issues?

[cmckahan]

I'm having the same issue with my Roborock S7. The vacuum says it is trying to connect to WiFi and I can see it connect and then drop off my wifi repeatedly. The wifi light continues to blink on the vacuum and it never says "WiFi connected". I don't get any certificate issues when I access the local server admin page at: https://api-roborock.XXX.com/admin.

[sli-cka]

Same for me. I can open https://api-roborock.XXX.de/admin without any issues. I tried with Cloudflare certificate and also a self issued Let's Encrypt cert. I also moved the setup (server + vacuum) to my main LAN to exclude VLAN issues.

Observed Behavior during onboarding:

• Vacuum connects to WiFi
• Sends request to api-roborock.XXX.de (port 443)
• TLS handshake begins
• Server responds with certificate
• Connection drops immediately after TLS handshake
• No connection attempt to MQTT (:8883)

Certificate Experiments

1. Initial setup (failing)
   Provider: ZeroSSL
   Type: RSA
   Wildcard cert (*.XXX.de)
   Result:
   TLS handshake succeeds
   Vacuum disconnects immediately

2. Let’s Encrypt (ECDSA, correct SANs)
   Provider: Let’s Encrypt
   Type: ECDSA (P-256)
   SAN:
   api-roborock.XXX.de
   mqtt-roborock.XXX.de
   Result:
   Clean chain (ISRG Root X1 → E8)
   TLS 1.3 works
   Still disconnects immediately after handshake

TLS handshake always succeeds
Certificate validation appears OK
Vacuum disconnects immediately after receiving server cert
MQTT (:8883) is never reached

Also seeing wifi drops after the vacuum connected to the network during onboarding

[Lash-L]

Thanks for the debugging! Do you see anything on the docker side?

Can you share the arguments you are running the onboarding script with? You can redact your server and WiFi

[sli-cka]

No, on the docker side I do not see any fresh logs during the onboarding

I was running the onboarding script usually only with uv run start_onboarding.py --server and went through the followup steps.

But now also tried with uv run start_onboarding.py --server api-roborock.XXX.de --ssid "XXX" --password "ABCDEF" --timezone "Europe/Berlin" --cst CET-1CEST,M3.5.0,M10.5.0 --country-domain de

[Lash-L]

Okay my guess is it is a problem with Nginx.

The older vacuums only accept TLS 1.0 and use OpenSSL 1.0.x

If you can get Nginx to support that it may work? You also may need to check your cert

[Lash-L]

Okay I had codex do an analysis of the firmware (S7) to confirm that I was right about TLS 1.0

"the real issue is the CA bundle. The firmware (OpenSSL 1.0.1f, Ubuntu 14.04) is
missing the root CAs for modern certificate authorities:

CA	Root needed	In firmware bundle?
Let's Encrypt	ISRG Root X1	NO
Let's Encrypt (legacy)	DST Root CA X3	Yes but expired Sep 2021
ZeroSSL/Sectigo	USERTrust RSA CA	NO
ZeroSSL/Sectigo (legacy)	AddTrust External Root	Yes but expired May 2020
DigiCert	DigiCert Global Root G2	Yes, valid until 2038
Sectigo (alt chain)	Comodo AAA Services	Yes, valid until 2028

"

This is an older download of the firmware though so it could be wrong, but I'd bet that the issue surrounds nginx