mgth/LittleBigMouse · error · AuthenticationException

VIDAA rejected TLS. Select the PKCS#12 client certificate…

Error message

VIDAA rejected TLS. Select the PKCS#12 client certificate extracted from the official app.

What it means

During ConnectAsync the library performs the TLS handshake against the projector with SslProtocols.Tls12. If the handshake fails with AuthenticationException AND no client certificate was configured (certificates.Count == 0), it rethrows an AuthenticationException explaining that VIDAA requires the PKCS#12 client certificate extracted from the official app. This filter distinguishes 'missing client cert' from other TLS failures.

Solutions

1. Extract the PKCS#12 client certificate from the official Hisense VIDAA mobile app and supply its path (and password) to the connection.
2. Confirm the certificatePath configuration is actually set and non-empty so the certificate collection is populated.
3. Verify the .p12 loads correctly (correct password, PKCS#12 format) — an unloadable cert effectively means no cert is presented.
4. If a certificate IS configured and this still fires, check the exception's inner AuthenticationException for a different TLS cause (protocol mismatch, untrusted server chain).

Example fix

// before
await connection.OpenMqttAsync(certPath: null, password: null); // TLS rejected

// after
await connection.OpenMqttAsync(
    certPath: @"C:\certs\vidaa-client.p12",  // extracted from official VIDAA app
    password: pfxPassword);

if (string.IsNullOrWhiteSpace(certificatePath))
    throw new InvalidOperationException("VIDAA requires the PKCS#12 client certificate extracted from the official app; configure its path before connecting.");

static bool HasClientCertificate(string? path) =>
    !string.IsNullOrWhiteSpace(path) && File.Exists(path);

try
{
    await connection.OpenMqttAsync(certificatePath, password, ct);
}
catch (AuthenticationException ex) when (ex.Message.Contains("VIDAA rejected TLS"))
{
    // instruct the user to extract and select the PKCS#12 client certificate from the official app
}

When it happens

Trigger: Calling OpenMqttAsync/ConnectAsync without a certificatePath (or empty) while the VIDAA projector enforces mutual TLS: the server rejects the anonymous handshake during SslStream.AuthenticateAsClientAsync.

Common situations: First-time setup where the user never extracted the client certificate from the official Hisense app; config field for certificate path left blank; user thought only the server certificate was needed; projector firmware enforcing mTLS on the MQTT (port 36669) channel.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The VIDAA client certificate was not found.
• VIDAA rejected every authentication variant for protocol
• A Wi-Fi MAC address is required for VIDAA authentication.
• Enter the four-digit PIN displayed by the Hisense device.
• Associate a Hisense VIDAA projector first.

AI-assisted analysis of mgth/LittleBigMouse@7a42f01d47 (2026-09-16). Data as JSON: /api/errors/4229b44d426ac0dc. Report an issue: GitHub.

Appendix: source

Thrown at LittleBigMouse.Plugins/LittleBigMouse.Plugin.Vcp.Avalonia/HisenseVidaa/VidaaMqttConnection.cs:69

                X509KeyStorageFlags.EphemeralKeySet | X509KeyStorageFlags.Exportable));
        }

        try
        {
            await ssl.AuthenticateAsClientAsync(new SslClientAuthenticationOptions
            {
                TargetHost = host,
                ClientCertificates = certificates,
                // Several VIDAA U6 brokers advertise newer TLS but abort encrypted
                // application data after negotiating it. The official Android client
                // uses TLS 1.2 for this MQTT channel.
                EnabledSslProtocols = SslProtocols.Tls12,
                CertificateRevocationCheckMode = X509RevocationMode.NoCheck,
            }, cancellationToken).ConfigureAwait(false);
        }
        catch (AuthenticationException e) when (certificates.Count == 0)
        {
            throw new AuthenticationException(
                "VIDAA rejected TLS. Select the PKCS#12 client certificate extracted from the official app.", e);
        }

        _stream = ssl;
        await WritePacketAsync(BuildConnectPacket(clientId, username, password), cancellationToken)
            .ConfigureAwait(false);
        (byte Header, byte[] Payload) connack;
        try
        {
            connack = await ReadPacketAsync(_stream, cancellationToken).ConfigureAwait(false);
        }
        catch (IOException e) when (certificates.Count == 0)
        {
            throw VidaaCertificate.MissingException(e);
        }
        if ((connack.Header >> 4) != 2 || connack.Payload.Length < 2)
            throw new IOException("VIDAA returned an invalid MQTT connection response.");
        if (connack.Payload[1] != 0)

View on GitHub (pinned to 7a42f01d47)