node-red-contrib-velux-klf200 1.0.1
Node-RED nodes for the Velux KLF-200 io-homecontrol gateway. Maintained fork of PLCHome/node-red-contrib-velux with vendored velux-klf200 + velux-klf200-api, TLS fingerprint pinning (survives the 2026-07-12 factory cert expiry) and crash fixes.
node-red-contrib-velux-klf200
Node-RED nodes for the Velux KLF-200 io-homecontrol® gateway.
A drop-in, maintained fork of PLCHome/node-red-contrib-velux
(unmaintained since 2021), published under a new npm name because the original name is
taken. The transport libraries velux-klf200 and velux-klf200-api are vendored
into lib/ — one self-contained package instead of a three-package dependency chain.
The node types are identical to upstream (velux-connection, Velux Nodes,
Velux Api, Velux Scenes), so existing flows keep working without any change after
migrating.
⚠️ If you use the KLF-200 nodes, read this
The Velux factory TLS certificate bundled in the upstream package expires on
2026-07-12 09:38 UTC. The upstream code validates the certificate chain, so after that date every (re)connect to your KLF-200 fails withCERT_HAS_EXPIRED— blinds stop responding, and a Node-RED restart won't bring them back. Your currently-open connection keeps working only until the next disconnect (reboot, network blip, deploy).This fork fixes it by pinning the gateway's certificate fingerprint instead of validating its expiry. Install it before your next reconnect.
Am I affected? Check the bundled cert's expiry on your host:
find / -path '*velux-klf200-api/cert/velux-cert.pem' 2>/dev/null \ -exec openssl x509 -in {} -noout -enddate \; # notAfter=Jul 12 09:38:26 2026 GMT -> affected
What this fork fixes
| # | Fix | Upstream problem |
|---|---|---|
| 1 | TLS fingerprint pinning — lib/velux-klf200-api/lib/net.js |
Bundled factory cert expires 2026-07-12; upstream does chain validation (rejectUnauthorized: true + bundled CA) so every reconnect afterwards throws CERT_HAS_EXPIRED. Now the gateway is authenticated by the SHA-1 fingerprint of its factory cert — independent of validity dates. Override with options.fingerprint if your device presents a different cert; the upstream options.old (accept-any) path is preserved. |
| 2 | Process-crash fix — lib/velux-klf200/nodes.js |
sendValue discarded the command promise. A 5 s command-confirm timeout (device offline, deleted node index) became an unhandled promise rejection that killed the entire Node-RED process on Node ≥ 15. Now caught and surfaced on the connection's error channel. |
| 3 | Catchable connection errors — velux-connection.js |
Connection errors used single-argument node.error() (log only, invisible to flows). Now two-argument — a catch node (and thus a dashboard toast / notification) can react to a lost gateway. |
| 4 | Listener-leak fix — lib/velux-klf200/klf.js |
Every reconnect attempt registered ~14 listeners on the module-global event emitter and never removed them. During a gateway outage the built-in 5 s reconnect loop grew them without bound (memory + CPU per incoming frame). getVelux now clears stale listeners on each attempt. |
| 5 | No password in debug log — lib/velux-klf200-api/lib/net.js |
Upstream logged the KLF-200 password in clear text when DEBUG=velux-klf200-api:* was set (which its own README recommends). Redacted. |
Install
From npm — Manage palette → Install → search velux-klf200, or:
npm install node-red-contrib-velux-klf200 # in your Node-RED user directory
# then restart Node-RED
Offline / from the release tarball (bundles its dependencies, no registry access needed):
npm install https://github.com/tix0815/node-red-contrib-velux/releases/latest/download/node-red-contrib-velux-klf200-1.0.1.tgz
Migrating from the original node-red-contrib-velux
Both packages register the same node types, and Node-RED won't load two modules that provide the same type — so remove the old one first, then add this one. Your flows are untouched (they reference the type names, which are identical):
npm remove node-red-contrib-velux
npm install node-red-contrib-velux-klf200
# then restart Node-RED
Compatibility
Tested on Node-RED 5.0.1 / Node.js 24 (and the 4.x line). Requires Node ≥ 18.
Configuration
Node configuration is identical to upstream — see the original
documentation. The only new,
optional knob is passing options.fingerprint (an AA:BB:… SHA-1 string) through
the connection config if your gateway serves a certificate other than the standard
Velux factory one.
Credits & license
Original work © Chris Traeger (PLCHome) — node-red-contrib-velux, velux-klf200,
velux-klf200-api, all MIT. This fork preserves every upstream copyright notice.
Maintained by tix0815. MIT — see LICENSE.
