Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)

Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)

105 Reply
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
Wednesday

Hi  @mbentley 

 

Thank you for sharing.

We had located the root cause and have fixed it in the subsequent release. Please stay tuned.

 

mbentley wrote

  @Vincent-TP 

 

I found out what is going on with random people seeing SSL cert errors.  Here is a summary that hopefully someone from the development team can help address as while it can be worked around, it could be a problem for random people:

 

The Problem

Three JARs contain tpKeyStore:

  • cloudsdk-1.2.3.jar (934 bytes) - NEW certificate (Feb 2025)
  • device-gateway-core-6.0.0.23.jar (846 bytes) - OLD certificate (2018)
  • omada-datatrack-6.0.0.23.jar (846 bytes) - OLD certificate (2018)

 

Non-deterministic JAR loading order: When using -cp /opt/tplink/EAPController/lib/*, the JVM loads JARs in filesystem order, which varies by:

  • Docker filesystem driver (overlay2, aufs, etc.)
  • Kernel version
  • Filesystem type
  • Whether files were extracted, copied, or created fresh

 

Wrong keystore loaded randomly: ClassLoader.getSystemResourceAsStream("tpKeyStore") returns the FIRST tpKeyStore it finds in the classpath:

  • If cloudsdk-1.2.3.jar loads first → Gets NEW cert (Feb 2025) → WORKS!
  • If device-gateway-core-6.0.0.23.jar or omada-datatrack-6.0.0.23.jar loads first → Gets OLD cert (2018) → FAILS!

 

TP-Link rotated their CA in February 2025: Their cloud servers now present certificates signed by the NEW CA, but some users get the OLD CA from the wrong JAR!

 

Why It's Machine-Specific

  • Same Docker image, but filesystem ordering varies
  • Persistent data doesn't matter (it's not stored there)
  • Copying to a new machine might change the JAR loading order

 

The Fix

TP-Link needs to:

  • Remove duplicate tpKeyStore files from device-gateway-core and omada-datatrack JARs
  • OR update all three keystores to contain the same certificate
  • OR change code to use CustomSSLContext.class.getResourceAsStream("/tpKeyStore") instead of ClassLoader.getSystemResourceAsStream()

 

User Workaround

Users can force the correct JAR order by modifying the startup command:

java -server -Xms128m -Xmx1024m ... \
  -cp /opt/tplink/EAPController/lib/cloudsdk-1.2.3.jar:/opt/tplink/EAPController/lib/*:/opt/tplink/EAPController/properties: \
  com.tplink.smb.omada.starter.OmadaLinuxMain
 
 

 

  0  
  0  
#104
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
Wednesday

  @mackworth Yes. It is.

  0  
  0  
#105
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
19 hours ago

  @Vincent-TP 

 

Failing when configuring a 4-Port Active or Passive LAG on POE Switch TL-SG3428MP.

Tried with regular ethernet ports. Also tried SFP ethernet modules. Tried forgetting/resetting/re-adopting switch. No luck no matter what.


No issues setting up LAG on SG3428 however.

 

 

Succeeded

CONNECTED

SG3428 v2.30

2.30.9

 

Failed

CONNECTED

TL-SG3428MP v1.0

1.1.13

 

 

 

Device Name

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Device Management Hostname/IP

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Daylight Saving Time

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

IP Group (1)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

IPv6 Group (1)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Jumbo

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

LED

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Loopback Detection

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Management VLAN

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

LAN Networks (5)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Port/LAG Name

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

SNMP

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

SSH

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Spanning Tree

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

IP Settings

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Time Zone

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Device Account

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

VLAN Interface (1)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

 

 

 

 

 

  0  
  0  
#106
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
19 hours ago - last edited 19 hours ago

  @iansj7 

 

Interesting, i havent seen this at all on my SG3428X either Static or LACP LAGs, in fact it has 2 of them configured and have been running without issue.

 

What happens if you click "Apply Again" in the config failures ?

 

I get lots of Gateway config failures, generally hitting Apply Again sorts them out, sometimes i have to force provision the device.  Havent seen any failures on any of my switches at all though

  0  
  0  
#107
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
18 hours ago

  @GRL 

 

Unfortunately tried that multiple times. I've actually been troubleshooting this on my own for 1+ week now. Tried literally everything. Commands in Omada LXC console on Proxmox. ChatGPT/Gemini. SSH into switch (although limited when adopted). No matter what I do results in "Failed" until I delete the LAG config. Tried 1 port, 2 ports, 4 ports. SFP, non-SFP. Tried Auto Speed, 1000mbps speed, Full Duplex. Tried reducing settings in Site settings, Port Profile settings, switch settings. Enable POE, disable POE. Settings in Auto, Spanning Tree enabled/disabled. Tried Trunk, Admin, other VLANS. Tried force provisioning, re-apply settings. Tried bare minimum settings. Nothing I do seems to do the trick unfortunately. With my other regular switch no issues though - although some settings will throw an "incompatible" result but after doing some settings tweaks and a force provision, the regular switch is back to "succeeded". I even tried ways to get the regular switch to say "Failed" with no luck haha. Something buggy is hapenning with just the POE switch :(

  0  
  0  
#108
Options