From 0e3640c303db295596c8b77f70e2a0d660ac5455 Mon Sep 17 00:00:00 2001 From: darylldelfin Date: Fri, 18 Sep 2026 21:34:59 +0800 Subject: [PATCH] Add ECDHE-RSA-AES256 cipher for newer Tapo firmware (#1755) Add ECDHE-RSA-AES256-GCM-SHA384 alongside the existing ECDHE-RSA-AES128-GCM-SHA256 suite for newer Tapo firmware, while keeping all legacy suites for backward compatibility. Tested with Tapo TC70, C530WS, and C210 cameras after firmware updates produced TLS handshake failures. --- kasa/transports/sslaestransport.py | 1 + tests/transports/test_sslaestransport.py | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/kasa/transports/sslaestransport.py b/kasa/transports/sslaestransport.py index 525085b0..a517ca48 100644 --- a/kasa/transports/sslaestransport.py +++ b/kasa/transports/sslaestransport.py @@ -74,6 +74,7 @@ class SslAesTransport(BaseTransport): CIPHERS = ":".join( [ "ECDHE-RSA-AES128-GCM-SHA256", + "ECDHE-RSA-AES256-GCM-SHA384", "AES256-GCM-SHA384", "AES256-SHA256", "AES128-GCM-SHA256", diff --git a/tests/transports/test_sslaestransport.py b/tests/transports/test_sslaestransport.py index fe408195..cc11ccb3 100644 --- a/tests/transports/test_sslaestransport.py +++ b/tests/transports/test_sslaestransport.py @@ -48,6 +48,12 @@ MOCK_STOCK = "abcdefghijklmnopqrstuvwxyz1234)(" MOCK_UNENCRYPTED_PASSTHROUGH_STOK = "32charLowerCaseHexStok" +def test_ssl_ciphers_include_modern_tapo_suites() -> None: + """Keep compatibility with cameras that dropped legacy RSA ciphers.""" + assert "ECDHE-RSA-AES128-GCM-SHA256" in SslAesTransport.CIPHERS + assert "ECDHE-RSA-AES256-GCM-SHA384" in SslAesTransport.CIPHERS + + @pytest.mark.parametrize( ( "status_code",