[Feature] Nuki Smart Lock Ultra support

[iranl]

We are looking for owners of the new Nuki Smart Lock Ultra
that can confirm if NukiHub works with the new device as expected.

Testing will include confirming:

• NukiHub pairs with the device correctly
• NukiHub can query the correct device lock state
• NukiHub can query additional parameters of the device state (auth log, etc.)
• NukiHub can change the lock state as expected
• NukiHub can query and change all supported device settings
• NukiHub can query and change keypad settings and codes for keypads connected through the device
• NukiHub can query and change authorization settings
• NukiHub can query and change time control settings

If you use NukiHub with the Nuki Smart Lock Ultra please let us know if any or all of the above works as expected or not in this issue.

[HolgerHees]

I ordered it right now.

And my M5Stack Atom POE (ESP32-S3 Version) is already flashed with nuki hub and ready to be used :-)

[Mincka]

@HolgerHees Did you order it from their website? It says "This product variant is currently not available" for me.
Do we know how many keys are provided with the universal cylinder? I did not find this information.

[HolgerHees]

@HolgerHees Did you order it from their website? It says "This product variant is currently not available" for me. Do we know how many keys are provided with the universal cylinder? I did not find this information.

yes, its available since today. And you get 3 keys, but you can order additional keys later with the security card.

[reznikov]

just installed Nuki Ultra and it doesn't automatically pair with nukihub 😔
could be that i've missed something something.

Nuki Ultra works with the Nuki App, no NukiBridge installed.
latest version of nukihub installed on a https://shop.m5stack.com/products/m5stamp-c3u-mate-with-pin-headers, connected to wifi & mqtt

[iranl]

@reznikov: If I am correct the Nuki Ultra doesn't support the Nuki bridge. This might mean it also will not support using NukiHub in bridge mode with the Ultra (which is the default).

Have you enabled Hybrid mode under Advanced MQTT Configuration (recommended if official MQTT is setup) and/or enabled Lock: Nuki Bridge is running alongside Nuki Hub under Advanced Nuki Configuration?

And tried pairing with the Ultra again after changing these settings

[reznikov]

I'm not running a Nuki Bridge.

Lock: Nuki Bridge is running alongside Nuki Hub was disabled
Enable hybrid official MQTT and Nuki Hub setup was also disabled.

tried enabling them both and holding the button on the lock - no luck, didn't pair.

I've enabled MQTT logging and I see it alternative between the following messages:

Pairing as bridge
Nuki lock start pairing
Pairing as bridge
Nuki lock start pairing
...

[iranl]

If you have enabled these options correctly (and rebooted NukiHub) you should see the message Pairing as app in the MQTT logs instead of Pairing as bridge

[reznikov]

I’ve tried both, and had both messages appear. Still doesn’t pair

[technyon]

@iranl There's a chance that that UUID used for the services are different for the ultra locks, so that the app can detect that an ultra lock is being paired. If that's the case I'd expect changes to the API. With some luck it's still compatible and they just added functionality. It's a shame they don't document anything anymore.

[iranl]

That would be my guess as well. I'll try to do some debugging, but it is possible I'll need to get my hands on one to properly add support.

[mallorca2288]

I've got mine today and I can confirm it's not possible to pair it with Nuki Hub. Also tried enabling and disabling hybrid mode but it didn't work.

Please let me know if there is any kind of logs that I can send to help debug.

Thanks for your work!

[iranl]

I am pretty certain the new UUID's are:

keyturnerPairingServiceUUID = "A92EE300-5501-11E4-916C-0800200C9A66"
keyturnerGdioUUID = "A92EE301-5501-11E4-916C-0800200C9A66"
keyturnerServiceUUID = "A92EE200-5501-11E4-916C-0800200C9A66" (Looks like it is unchanged from regular lock)
keyturnerUserDataUUID = "A92EE202-5501-11E4-916C-0800200C9A66" (Looks like it is unchanged from regular lock)

It also seems to implement secure pairing, but I am not sure if this is mandatory.

This combination probably makes this too hard to work on without:

• Having an updated Bluetooth API by Nuki
  AND/OR
• Owning the device myself

Having the keyturnerServiceUUID unchanged does probably make the process pretty straightforward after the pairing is sorted.

I might be able to get my hands on one of these devices when it goes back on sale again.

I have updated the README to show the Ultra is unsupported at this time.

I am doing a one-time only (without owning the device myself) test build which you can find at: https://github.com/iranl/nuki_hub/actions/runs/12473517959.

You will need to manually flash the binary using esptool. This test build will not work with the regular lock.

If pairing starts but fails and usefull information is provided using serial logging I might consider a follow-up build.
Before logging make sure to enable all Nuki debug logging functions from the /get?page=advanced page and rebooting.
And make sure Lock: Nuki Bridge is running alongside Nuki Hub is enabled on the Nuki configuration page

[mallorca2288]

I've flashed the binary you provided. Still unable to pair with nuki hub.

<LOGS CUT (iranl)>

I am pretty certain the new UUID's are:

keyturnerPairingServiceUUID = "A92EE300-5501-11E4-916C-0800200C9A66"
keyturnerGdioUUID = "A92EE301-5501-11E4-916C-0800200C9A66"
keyturnerServiceUUID = "A92EE200-5501-11E4-916C-0800200C9A66" (Looks like it is unchanged from regular lock)
keyturnerUserDataUUID = "A92EE202-5501-11E4-916C-0800200C9A66" (Looks like it is unchanged from regular lock)

I used this app to scan for bluetooth devices and my nuki appears to have the following UUID: "a92ee200-5501-11e4-916c-0800200c9a66". I can also see UUIDs 0x1801, 0x1800, 0x180A, 0xFFF6 listed but I don't really know what that means.

If pairing starts but fails and usefull information is provided using serial logging I might consider a follow-up build. Before logging make sure to enable all Nuki debug logging functions from the /get?page=advanced page and rebooting. And make sure Lock: Nuki Bridge is running alongside Nuki Hub is enabled on the Nuki configuration page

I didn't find any logging options in the advanced settings, this is what the page looks like:

[iranl]

@mallorca2288: Test build was made not against the latest master by my mistake. Sorry for that. That is why you didn't find the Nuki debug logging functions at the bottom of the advanced page.

Your logs did provide some usefull insights. It seems the pairing process starts and gets pretty far along.

I also believe I have found how Nuki has made pairing secure on https://help.nuki.io/hc/en-001/articles/4407702320017-Security-code

The Ultra requires you to set a 6-digit PIN code which is needed as part of any bluetooth pairing operation.

Can you try with this build: https://github.com/iranl/nuki_hub/actions/runs/12482870076

Steps:
-Flash a release build
-Enable all Nuki debug logging functions from the /get?page=advanced page and Save
-Enter the Nuki Smart Lock Ultra 6-digit PIN on the /get?page=advanced page and Save
-Make sure Lock: Nuki Bridge is running alongside Nuki Hub is enabled on the Nuki configuration page and Save
-Reboot NukiHub
-Put Smart Lock Ultra in pairing mode
-Log result over serial
-Please check your logs for data you might not want to share online (BLE address, IP address etc.) before posting it.

Note that it is possible that your ESP was banned (temporarily) from connecting/pairing looking at your second log (for trying repeatedly with the default PIN of 123456). Usually easiest fix would be to restart the Nuki device by removing the batteries from the Nuki device, but I am not sure if that is even possible with the Ultra.

[mallorca2288]

I've tried pairing it two times with the new build, here are the logs:

<LOGS CUT (iranl)>

Thanks for your time!

[iranl]

Try number 3: https://github.com/iranl/nuki_hub/actions/runs/12483995128 (still building, should be up by 16:30 UTC)

Same steps.

This version will try to force a secure connection from the client as your logs show the passkey is never used.
It will also publish hex data of the unknown return command (which I guess is an error log of the failed pairing)

[mallorca2288]

Logs with last build:

<LOGS CUT (iranl)>

I'm using a temporary pin code so no problem if it shows in the logs, I'll change it later.

[iranl]

Try 3 still didn't secure the connection using the PIN. Turns out I didn't add it in the right place.

Try 4: https://github.com/iranl/nuki_hub/actions/runs/12484546616

We are looking for the messages Securing Connection, Passkey Entry and Done securing Connection

[mallorca2288]

Logs with this build:

<LOGS CUT (iranl)>

Debug with this build:

<LOGS CUT (iranl)>

[iranl]

Ok. So now it tries to create a secureConnection but the correct PIN/passkey is still not used/requested.

I'll think on this over the holidays and maybe try testing this with a custom BLE server mimicking a SmartLock Ultra before creating a new build.

@mallorca2288 Thanks for all the work up to this point. Your input makes this work possible at all without help from Nuki and/or owning a device myself.

Happy holidays

[iranl]

I have another build up at: https://github.com/iranl/nuki_hub/actions/runs/12509007186

I changed a few things that might (emphasis on might) help.

[mallorca2288]

Logs with the latest build 😉

<LOGS CUT (iranl)>

[iranl]

So trying to force the secure connection probably fails and it actually gets less far than on the unsecured connection.
I'll try to make a build with much more bluetooth logging to really see what is going on on a lower level

[mallorca2288]

Also tried setting the PIN code of the lock in the Credentials page but it doesn't work with my password.

[iranl]

Slowly getting there.

Please unpair again as there is still an issue with saving the authorization ID (this is what probably causes the failure of all commands after pairing).

Test 13: https://github.com/iranl/nuki_hub/actions/runs/12756923186

Also tried setting the PIN code of the lock in the Credentials page but it doesn't work with my password.

The credentials page is not used for the Ultra yet.

[mallorca2288]

Test 13 logs after unpairing:

<LOGS CUT (iranl)>

Showing as paired on the info page.

[iranl]

The last log is not from test 13.

Build ID is 12756923186 for test 13.
Your logs show Build ID 12756562753 (which is test 12)

[mallorca2288]

Sorry, I forgot to unzip the latest build. Now it pairs and it also shows the state of the lock!

<LOGS CUT (iranl)>

[iranl]

Awesome. This should basically be it for changes to the BLE communication library in regards to the Ultra.

Will need to make a couple(/many) changes to NukiHub to add proper support before this can be merged for 9.08, but this was the hard part.

@mallorca2288: Your help has been invaluable. Couldn't have been done without your excellent support.

Shall I add you as co-author on the final PR?

[mallorca2288]

Many thanks to you @iranl ! You did all the work.
I didn't really do much, I just copied and pasted what appeared in the console.

I'll be happy to test all the changes in the code and will report back on things that don't work as expected.

Thanks again, I appreciate you taking the time to do this.

[iranl]

@mallorca2288: Can you test: https://github.com/iranl/nuki_hub/actions/runs/12776839680

And report on each of the following:

• Understandability of the README: https://github.com/iranl/nuki_hub/tree/api-2.3#pairing-with-a-nuki-lock-ultra
• NukiHub pairs with the device correctly (Please follow the steps in the README, these have changed from before)
• NukiHub can query the correct device lock state
• NukiHub can query additional parameters of the device state (auth log, etc.)
• NukiHub can change the lock state as expected
• NukiHub can query and change all supported device settings (including motor speed)

Optional:

• NukiHub can query and change keypad settings and codes for keypads connected through the device
• NukiHub can query and change authorization settings
• NukiHub can query and change time control settings

[mallorca2288]

* Understandability of the README: https://github.com/iranl/nuki_hub/tree/api-2.3#pairing-with-a-nuki-lock-ultra

I think it's very clear!

* NukiHub pairs with the device correctly **(Please follow the steps in the README, these have changed from before)**

It paired without any issue following the instructions in the README section.

* NukiHub can query the correct device lock state

It shows the corrrect state of the lock.
Manually locking/unlocking the lock didn't update the state.
Locking/unlocking through the Nuki App, state was correctly updated.

* NukiHub can query additional parameters of the device state (auth log, etc.)

All parameters appear to be correct. Auth log is updating. Keypad entries information is correct.

Keypad status is blank. On the last build it switched between success and blank status. Don't know the meaning of this.

* NukiHub can change the lock state as expected

It does lock and unlock.

* NukiHub can query and change all supported device settings (including motor speed)

Didn't try changing all of the settings, but the ones I tried seem to be working.

Tried changing LED state, LED brightness, auto-update enabled, Single button press action and a few more. All worked.

On the MQTT log I can see this message updated every second or less:

disconnecting BLE on timeout

Nuki hub shows that hybrid mode is not connected:


However I can see on the nuki app that nuki ultra is correctly connected to MQTT server. I've enabled all the hybrid settings on nuki hub.

I will continue to test everything and report back on any bugs I might find. Will also test changing keypad/authorizations/time controls.

[mallorca2288]

Forgot to say, unfortunately the motor speed setting is not showing in my Home Assistant. Also I can't find the state of the speed setting using MQTT explorer.

EDIT:
Nevermind, I forgot to enable it in the Access Level configuration page.

[iranl]

On the MQTT log I can see this message updated every second or less:

disconnecting BLE on timeout

~~ Thats fine, it's supposed to do that. ~~ But not every second. Please get me a serial log.

Forgot to say, unfortunately the motor speed setting is not showing in my Home Assistant. Also I can't find the state of the speed setting using MQTT explorer.

The motor speed state should be in the MQTT topic nukihub/lock/configuration/advancedJson

Nuki hub shows that hybrid mode is not connected

Can you connect to serial logging and then reboot NukiHub (using reboot button on the webconfigurator) and get me the logs from boot all the way to it getting all the configuration settings (and also showing the BLE disconnects).

Note that you need to refresh the WebConfigurator to get the current Hybrid connected state (it doesn't update on the background as the other settings)

[mallorca2288]

• Motor speed status is correct and I'm able to change it.
• Battery type is blank.
• Tried updating the WebConfigurator page multiple times with CONTROL+F5, still shows hybrid mode disconnected.
• I have enabled "New Nuki Bluetooth connection mode (disable if there are connection issues)", but on the info page it shows: "Bluetooth connection mode: Old". Is this right?
• Enabling/disabling keypad entries doesn't work.
• Disabled and then re-enabled MQTT in the NUKI app and now it shows hybrid mode connected. So it might have been a problem with the lock itself. Will keep an eye on the state.
• Serial logs while restarting through web:
  <LOGS CUT (iranl)>

After this it keeps flooding the console with the disconnecting BLE on timeout message a couple of times per second.

[mallorca2288]

Just FYI to anyone interested, the Ultra is back in stock in Nuki's website.

[iranl]

• I have enabled "New Nuki Bluetooth connection mode (disable if there are connection issues)", but on the info page it shows: "Bluetooth connection mode: Old". Is this right?

Info page is wrong. Will be fixed in next build

• Battery type is blank.

Battery type is not supported by the Ultra, as it doesn't support the battery pack and only has the option of the internal battery.
I'll remove it for the ultra

• Enabling/disabling keypad entries doesn't work.

What does the MQTT topic nukihub/lock/keypad/commandResultJson show? Have you enabled keypad control on the access level configuration page?

After this it keeps flooding the console with the disconnecting BLE on timeout message a couple of times per second.

BLE disconnecting flooding should stop in latest build.

@mallorca2288: You can (should) now disable Nuki debug logging (at least hex and readable data) to prevent leaking possibly private information.

New build: https://github.com/iranl/nuki_hub/actions/runs/12791586801

[iranl]

Ultra support has been merged in master and is available in 9.08-master2.
Anyone with a Ultra lock can flash 9.08-master2 using OTA (Flash 9.07 using Webflash/esptool and than update to 9.08-master2 from the firmware update page by selecting development version)

I will keep this topic open for now to get further feedback from @mallorca2288 and other users with an Ultra.

[B-Hartley]

Hi,
As a new user.
I've installed the latest dev version from webupdate.
Connected Ultra lock sucessfully.
Seems to work well.

Will experiement with it over the next few days.
I have it in hybrid mode, so just need to fully understand what that means, but I'll get there.

Thanks for your work on this. I'm unsure how stable the matter (thread) mqtt comms are from the lock, so having a backup plan is great.

A curiosity question....

I don't have a nuki door sensor, but I do have a door sensor as part of my alarm system that is available in home assistant.
Could I somehow use the updates from that sensor to update the state of the door within the nuki system, so the lock would know that the door was open ?

[mallorca2288]

I've been testing the latest binary and everything seems to be working ok.

Tried enabling and disabling keypad entries again and it worked as expected.

Hybrid connection to the lock has been stable without any issues.

The "BLE disconnecting" message flooding the logs has disappeared but now a new message keeps flooding the mqtt log (updated multiple times per second):
iBeacon ID: 004C Major: 17162 Minor: 46463 UUID: a92ee200-5501-11e4-916c-0800200c9a66 Power: -56

I'll keep testing and report back if I find any issues. Right now I feel like this build is very stable for releasing.

Thanks again!

[iranl]

Disable all Nuki debug logging to stop logging the iBeacons

[iranl]

A curiosity question....

I don't have a nuki door sensor, but I do have a door sensor as part of my alarm system that is available in home assistant. Could I somehow use the updates from that sensor to update the state of the door within the nuki system, so the lock would know that the door was open ?

You are asking for emulation of Nuki accessories. The communication between a Nuki lock/opener and it's accessories is completely undocumented by Nuki and thus emulation is no easy task.
Altough trying to implement a function like this has been on my backlog for a long time, this will not be worked on any time soon.

[B-Hartley]

I noticed you mention an advanced setting of force look door sensor connected?
What does that do?
Could I combine that with writing to the doorsensor topic.
Or will that have no effect ?

I think there is a typo in the below....

Advanced Configuration
The advanced configuration menu is not reachable from the main menu of the web configurator by default.
You can reach the menu directly by browsing to http://nukihubip/?get=advanced or enable showing it in the main menu by browsing to http://nukihubip/?get=debugon once (http://nukihubip/?get=debugoff to disable).

should say get?page=advanced ?

Thanks,
Bruce.

[iranl]

should say get?page=advanced

Correct, tnx for the report, fixed.

I noticed you mention an advanced setting of force look door sensor connected?
What does that do?
Could I combine that with writing to the doorsensor topic.
Or will that have no effect ?

This only has an effect when you have a Nuki door sensor

[iranl]

Closing this issue for now, please open a separate issue if any specific issues with the Ultra pop up.