# SMLIGHT key connection to Zigbee2Mqtt on Gladys (Full SSL/TLS) (external MQTT and Z2M)

**URL:** <https://community.gladysassistant.com/t/connexion-cle-smlight-a-zigbee2mqtt-sur-gladys-full-ssl-tls-mqtt-et-z2m-externe/10041>\
**Category:** Tutoriels\
**Tags:** zigbee2mqtt\
**Created:** [February 22, 2026, 1:27pm UTC](https://community.gladysassistant.com/t/connexion-cle-smlight-a-zigbee2mqtt-sur-gladys-full-ssl-tls-mqtt-et-z2m-externe/10041 "2026-02-22T13:27:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![prohand](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/prohand/32/15713_2.png) [@prohand](https://community.gladysassistant.com/u/prohand)\
**Post date:** [February 22, 2026, 1:27pm UTC](https://community.gladysassistant.com/t/connexion-cle-smlight-a-zigbee2mqtt-sur-gladys-full-ssl-tls-mqtt-et-z2m-externe/10041/1 "2026-02-22T13:27:40Z")

</div>

Hello,

As promised, here is a tutorial to connect an SMLIGHT key to Gladys via the network and not via USB, otherwise you lose all the interest of this key by plugging it in via USB 😊

Since Gladys only supports USB mode @pierre-gilles stop me if I’m wrong 🙃, I went for an installation with an MQTT and Z2M external to Gladys.  
This could perhaps be the subject of a feature request, what do you think @pierre-gilles ?

Here for z2m in https I use port 443 but to avoid any conflict if you decide to install everything on the same machine you should change it to port 4343 for example 🙂

I had already made a complete tutorial on HAOS at the time when I was using it that you can find here :

> **[\[Tuto\] Installer HAOS sur Proxmox avec Z2M et MQTT (Full SSL/TLS - Lets Encrypt)](https://forum.hacf.fr/t/tuto-installer-haos-sur-proxmox-avec-z2m-et-mqtt-full-ssl-tls-lets-encrypt/24467)**
>
> L’idée de ce tutoriel est de regrouper un peu toutes les infos que j’ai pu trouver pour l’installation de HAOS, Z2M et MQTT sur des VM séparés au sein de Proxmox et le tout en full SSL/TLS (Lets encrypt) sur ce type de machine : ...

**Mosquitto (Mqtt) Installation**

Install a VM under ubuntu 24.04, update it completely and run the following commands :

To install docker :

```auto
curl -sSL https://get.docker.com/ | CHANNEL=stable sh
systemctl enable --now docker

```

Add a docker\_mosquitto user for example :

```auto
adduser docker_mosquitto

```

Get its ID : (Here 1002)

```auto
cat /etc/passwd [ grep docker_mosquitto

```

![image](https://gladys-assistant-community.b-cdn.net/uploads/default/original/3X/9/4/942810aad326887315921dd330e89709bbc9f45a.png)

Create the mosquitto folder in /opt

```auto
mkdir /opt/mosquitto

```

Create the docker-compose.yml file with the following content : (Replace 1002 with the IDs we retrieved just before)

```auto
services:
  mosquitto:
    image: eclipse-mosquitto:2.0.22
    container_name: mosquitto
    restart: unless-stopped
    user: "1002:1002"
    ports:
      - "1883:1883" # MQTT
      - "8883:8883" # MQTTS (secure)
      - "9001:9001" # WebSockets
    volumes:
      - ./mosquitto/config:/mosquitto/config
      - ./mosquitto/data:/mosquitto/data
      - ./mosquitto/log:/mosquitto/log
      - /etc/localtime:/etc/localtime:ro
      - /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem:/etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem:ro
      - /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem:/etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem:ro
      - /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem:/etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem:ro

```

Create a mosquitto folder and subfolders and apply the rights : (This one will contain the configuration, data and logs)

```auto
mkdir /opt/mosquitto/mosquitto
mkdir /opt/mosquitto/mosquitto/data
mkdir /opt/mosquitto/mosquitto/config
mkdir /opt/mosquitto/mosquitto/log
touch mkdir /opt/mosquitto/mosquitto/log/mosquitto.log
chown -R 1002:1002 /opt/mosquitto/mosquitto

```

Create the config file in /opt/mosquitto/mosquitto/config/mosquitto.conf

```auto
persistence true
persistence_location /mosquitto/data/

log_dest file /mosquitto/log/mosquitto.log

listener 1883 localhost
allow_anonymous false
#password_file /mosquitto/config/passwd
tls_version tlsv1.3

listener 8883
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

listener 9001
protocol websockets
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

```

Enable SSL : (To be adapted according to the plugin you use to retrieve the certificate of your domain name) Here it is an example with infomaniak

```auto
apt install certbot
apt install python3-pip

```

```auto
pip install certbot-dns-infomaniak

```

```auto
export INFOMANIAK_API_TOKEN=xxx

```

```auto
certbot certonly \
  --authenticator dns-infomaniak \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos \
  --rsa-key-size 4096 \
  -d 'mqtt.xxx.local.srv-home.fr'

```

By default, certbot installs a service that periodically renews its certificates automatically. For this, the command must know the API key, otherwise it will fail silently.

In order to activate the automatic renewal of your generic certificates, you will have to modify `/lib/systemd/system/certbot.service`. Add the following line in `Service`, replacing Replace your token with the following:

```auto
Environment="INFOMANIAK_API_TOKEN=<YOUR_API_TOKEN>"

```

Then open the config file

```auto
nano /etc/letsencrypt/renewal/xxx.conf

```

Add

```auto
renew_hook = docker restart mosquitto

```

```auto
chmod -R 755 /etc/letsencrypt/live
chmod -R 755 /etc/letsencrypt/archive

```

Launch the container

```auto
cd /opt/mosquitto
docker compose up -d

```

You can view the Docker container logs:

```auto
docker logs mosquitto -f

```

Enable authentication (Replace username with a user, for example «&nbsp;mqttuser&nbsp;»

```auto
docker exec -it mosquitto mosquitto_passwd -c /mosquitto/config/passwd username

```

Uncomment the line «&nbsp;password\_file /mosquitto/config/passwd&nbsp;» in the file «&nbsp;/opt/mosquitto/mosquitto/config/mosquitto.conf&nbsp;» which will now give

```auto
persistence true
persistence_location /mosquitto/data/

log_dest file /mosquitto/log/mosquitto.log

listener 1883 localhost
allow_anonymous false
password_file /mosquitto/config/passwd
tls_version tlsv1.3

listener 8883
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

listener 9001
protocol websockets
certfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/cert.pem
cafile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/chain.pem
keyfile /etc/letsencrypt/live/mqtt.xxx.local.srv-home.fr/privkey.pem

```

Restart the container afterwards:

```auto
docker restart mosquitto

```

You can then enter this login in Gladys and then in zigbee2mqtt 🙂

**Zigbee2mqtt Installation**

Install a VM under Ubuntu 24.04, update it completely and follow the following procedure:

### [Linux Docker | Zigbee2MQTT](https://www.zigbee2mqtt.io/guide/installation/02_docker.html#running-the-container)

To install Docker:

```auto
curl -sSL https://get.docker.com/ | CHANNEL=stable sh
systemctl enable --now docker

```

Here is my docker-compose.yml file:

```auto
services:
  zigbee2mqtt:
    container_name: zigbee2mqtt
    image: koenkk/zigbee2mqtt:2.8.0
    restart: unless-stopped
    volumes:
      - ./data:/app/data
      - /run/udev:/run/udev:ro
      - /etc/localtime:/etc/localtime:ro
      - /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem:/etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem:ro
      - /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem:/etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem:ro
# devices:
# - /dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0:/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0
    ports:
      - "443:443" # External port 443 → internal port 443
    environment:
      - TZ=Europe/Paris
    networks:
      - z2m_net

networks:
  z2m_net:
    driver: bridge

```

Here is my /opt/z2m/data/configuration.yaml file as an example, you need to modify the auth\_token which will allow you to connect to the web interface as well as the password of the z2m user that we set up previously during the MQTT installation

```auto
homeassistant:
  enabled: false
mqtt:
  base_topic: zigbee2mqtt
  server: mqtts://mqtt.xxx.local.srv-home.fr:8883
  user: mqttuser
  password: tochange
  keepalive: 60
  reject_unauthorized: true
  version: 4
  include_device_information: true
serial:
  port: tcp://192.168.xx.xx:7638
  baudrate: 460800
  adapter: zstack
  disable_led: false
advanced:
  pan_id: GENERATE
  network_key: GENERATE
  channel: 25
  homeassistant_legacy_entity_attributes: false
  legacy_api: false
  legacy_availability_payload: false
  log_level: info
  log_syslog:
    app_name: Zigbee2MQTT
    eol: /n
    host: localhost
    localhost: localhost
    path: /dev/log
    pid: process.pid
    port: 514
    protocol: udp4
    type: '5424'
  last_seen: ISO_8601
frontend:
  enabled: true
  package: zigbee2mqtt-windfront
  port: 443
  host: 0.0.0.0
  url: https://z2m.xxx.local.srv-home.fr
  ssl_cert: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem
  ssl_key: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem
  auth_token: tochange

```

Replace this with the IP of your key and don’t forget to change auth\_token and password

```auto
port: tcp://192.168.xx.xx:7638

```

Enable SSL: (To be adapted according to the plugin you use to retrieve the certificate of your domain name) Here is an example with Infomaniak

```auto
apt install certbot
apt install python3-pip

```

```auto
pip install certbot-dns-infomaniak

```

```auto
export INFOMANIAK_API_TOKEN=xxx

```

```auto
certbot certonly \
  --authenticator dns-infomaniak \
  --server https://acme-v02.api.letsencrypt.org/directory \
  --agree-tos \
  --rsa-key-size 4096 \
  -d 'z2m.xxx.local.srv-home.fr'

```

By default, certbot installs a service that periodically renews its certificates automatically. For this to happen, the command must know the API key, otherwise it will fail silently.

To enable automatic renewal of your generic certificates, you will need to modify `/lib/systemd/system/certbot.service`. Add the following line in `Service`, replacing \<YOUR\_API\_TOKEN\> with your token:

```auto
Environment="INFOMANIAK_API_TOKEN=<YOUR_API_TOKEN>"

```

```auto
nano /etc/letsencrypt/renewal/z2m.xxx.local.srv-home.fr

```

Add (If you have a tip for integrating a reload, I’m interested 🙂

```auto
renew_hook = docker restart zigbee2mqtt

```

```auto
chmod -R 755 /etc/letsencrypt/live
chmod -R 755 /etc/letsencrypt/archive

```

In the file /etc/systemd/system/zigbee2mqtt.service I had to replace User=pi with User=root. I haven’t found a way to do otherwise for the moment but if you have an idea to run it with a user with fewer rights, I’m interested as well 😉

Launch the container

```auto
cd /opt/z2m
docker compose up -d

```

Zigbee2mqtt should now be available at the address [https://z2m.xxx.local.srv-home.fr](https://z2m.xxx.local.srv-home.fr/) indicating the password you put in auth\_token

**Do not use SSL/TLS**

You can very well do without the SSL/TLS part and use port 8080 for Z2M and port 1883 with Mqtt by modifying the configuration

**Z2M Configuration:**

docker-compose.yml:

```auto
services:
  zigbee2mqtt:
    container_name: zigbee2mqtt
    image: koenkk/zigbee2mqtt:2.8.0
    restart: unless-stopped
    volumes:
      - ./data:/app/data
      - /run/udev:/run/udev:ro
      - /etc/localtime:/etc/localtime:ro
# devices:
# - /dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0:/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0
    ports:
      - "8080:8080" # External port 8080 → internal port 8080
    environment:
      - TZ=Europe/Paris
    networks:
      - z2m_net

networks:
  z2m_net:
    driver: bridge

```

configuration.yaml:

```auto
homeassistant:
  enabled: false
mqtt:
  base_topic: zigbee2mqtt
  server: mqtt://mqtt.xxx.local.srv-home.fr:1883
  user: mqttuser
  password: tochange
  keepalive: 60
  reject_unauthorized: true
  version: 4
  include_device_information: true
serial:
  port: tcp://192.168.xx.xx:7638
  baudrate: 460800
  adapter: zstack
  disable_led: false
advanced:
  pan_id: GENERATE
  network_key: GENERATE
  channel: 25
  homeassistant_legacy_entity_attributes: false
  legacy_api: false
  legacy_availability_payload: false
  log_level: info
  log_syslog:
    app_name: Zigbee2MQTT
    eol: /n
    host: localhost
    localhost: localhost
    path: /dev/log
    pid: process.pid
    port: 514
    protocol: udp4
    type: '5424'
  last_seen: ISO_8601
frontend:
  enabled: true
  package: zigbee2mqtt-windfront
  port: 8080
  host: 0.0.0.0
  url: http://192.168.xx.xx
 # ssl_cert: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/fullchain.pem
 # ssl_key: /etc/letsencrypt/live/z2m.xxx.local.srv-home.fr/privkey.pem
  auth_token: tochange
**MQTT config:**

```

persistence true  
persistence\_location /mosquitto/data/

log\_dest file /mosquitto/log/mosquitto.log

listener 1883  
allow\_anonymous false  
password\_file /mosquitto/config/passwd

```auto

**Configure Gladys to use the external MQTT broker:**

![image|690x346](upload://89sCSttGIcTvVAX5KPpkoGeYo55.png)

And everything should be okay:

![image|690x186](upload://vtIXMTY5QPHGYzJqxCMQ8mJA7hm.png)

The tutorial may not be perfect but it tries to cover all possible cases and I may have forgotten things, so if you have any comments or questions, feel free to ask :slight_smile:
```

---

<div class="post-metadata">

**Author:** ![pierre-gilles](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/pierre-gilles/32/5886_2.png) [@pierre-gilles](https://community.gladysassistant.com/u/pierre-gilles)\
**Post date:** [February 23, 2026, 8:00am UTC](https://community.gladysassistant.com/t/connexion-cle-smlight-a-zigbee2mqtt-sur-gladys-full-ssl-tls-mqtt-et-z2m-externe/10041/2 "2026-02-23T08:00:52Z")

</div>

Thanks for the tutorial! 🙂

To install Mosquitto, using Docker would be much simpler though ^^

> [@prohand](#):
>
> That could perhaps be the subject of a feature request — what do you think, @pierre-gilles?

Yes, absolutely!

---

<div class="post-metadata">

**Author:** ![prohand](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/prohand/32/15713_2.png) [@prohand](https://community.gladysassistant.com/u/prohand)\
**Post date:** [February 23, 2026, 8:59am UTC](https://community.gladysassistant.com/t/connexion-cle-smlight-a-zigbee2mqtt-sur-gladys-full-ssl-tls-mqtt-et-z2m-externe/10041/3 "2026-02-23T08:59:57Z")

</div>

> [@pierre-gilles](#):
>
> To install Mosquitto, going through Docker would be much simpler anyway ^^

Yes, when I have a bit of time I’ll look at applying it on my setup and modify the tutorial 🙂

> [@pierre-gilles](#):
>
> Yes, absolutely!

It’s done here: [https://community.gladysassistant.com/t/prise-en-charge-des-cles-smlight-via-reseau/](https://community.gladysassistant.com/t/prise-en-charge-des-cles-smlight-via-reseau/)

---

<div class="post-metadata">

**Author:** ![prohand](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/prohand/32/15713_2.png) [@prohand](https://community.gladysassistant.com/u/prohand)\
**Post date:** [February 23, 2026, 2:25pm UTC](https://community.gladysassistant.com/t/connexion-cle-smlight-a-zigbee2mqtt-sur-gladys-full-ssl-tls-mqtt-et-z2m-externe/10041/4 "2026-02-23T14:25:31Z")

</div>

> [@prohand](#):
>
> Yes, when I have a bit of time I’ll see about applying it on my setup and modifying the tutorial 🙂

There, it’s been modified 🙂

---

<div class="post-metadata">

**Author:** ![prohand](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/prohand/32/15713_2.png) [@prohand](https://community.gladysassistant.com/u/prohand)\
**Post date:** [February 23, 2026, 9:20pm UTC](https://community.gladysassistant.com/t/connexion-cle-smlight-a-zigbee2mqtt-sur-gladys-full-ssl-tls-mqtt-et-z2m-externe/10041/5 "2026-02-23T21:20:37Z")

</div>

Following this post:

> [@Zigbee2mqtt non fonctionnel](https://community.gladysassistant.com/t/zigbee2mqtt-non-fonctionnel/10048?u=prohand):
>
> Hello, Je ne sais pas si c’est depuis la mise à jour ou bien depuis ma modification de mqtt que j’ai passé dans docker mais plus aucun appareil zigbee2mqtt n’est controlable dans Gladys. J’ai pas mal de logs comme ceci dans les logs : 2026-02-23T19:05:07+0100 \<error\> handleMqttMessage.js:109 () Failed to convert value for device Prise baie informatique: Error: Zigbee2mqqt expose not found on device "Prise baie informatique" with property "linkquality". at Zigbee2mqttManager.readValue (/sr…

I forced the mosquitto version to 2.0.22