Bridges and fabric administration2050 — TLS Client Management

Matter Cluster 2050 — TLS Client Management

Matter Cluster 2050 (0x0802) TLS Client Management: attributes, commands, events, data types, shadow paths and bridge payload examples.

Matter Cluster 2050 — TLS Client Management Cluster

Matter Cluster 2050, also written as 0x0802, is the TLS Client Management Cluster. This Cluster is used to provision TLS Endpoints with enough information to facilitate subsequent connection. Commands in this cluster uniformly use the Large Message qualifier, even when the command doesn't require it, to reduce the testing matrix. This cluster is present on the root node endpoint when required by a device type, may be present on that endpoint otherwise, and must NOT be present on any other Endpoint of any Node.

Cluster Identity

FieldValue
Cluster ID decimal2050
Cluster ID hex0x0802
Cluster nameTLS Client Management
Cluster revision (Matter 1.6.1)1
Roleutility
ScopeNode
PICS codeTLSCLIENT
Typical endpoint0

Revision history

RevisionChange
1Initial Release

Shadow Path Format

Cluster 2050 values in the device shadow use this format:

endpoint_id / 2050 / attribute_id

Example:

{
  "0/2050/0": 5
}
PartMeaning
0Endpoint ID
2050TLS Client Management cluster
0MaxProvisioned attribute

Data Types

StatusCodeEnum

ValueNameConformanceMeaning
2EndpointAlreadyInstalledMThe endpoint is already installed.
3RootCertificateNotFoundMNo root certificate exists for this CAID.
4ClientCertificateNotFoundMNo client certificate exists for this CCDID.
5EndpointInUseMThe endpoint is in use and cannot be removed.
6InvalidTimeMTime sync has not yet occurred.

TLSEndpointStruct (struct) — fabric-scoped

This struct encodes details about a TLS Endpoint.

FieldNameTypeConformanceConstraintMeaning
0EndpointIDTLSEndpointIDM0 to 65534—
1HostnameoctstrMlength 4 to 253This field represents a TLS Hostname.
2Portuint16M1 to 65535This field represents a TLS Port Number.
3CAIDTLSCAIDM0 to 65534—
4CCDIDTLSCCDID (nullable)M——
5ReferenceCountuint8M—Indicates a reference count of the number of entities currently using this TLS Endpoint.

Cluster 2050 Attributes

Cluster 2050 defines 2 attributes plus the global attributes. Conformance: M mandatory, O optional, a feature code means "mandatory when that feature is present", square brackets mean "optional when …".

IDHexAttributeTypeConformanceAccessQualitiesDefault
00x0000MaxProvisioneduint8MR (read: view)——
10x0001ProvisionedEndpointslist of TLSEndpointStructMR (read: view, fabric-sensitive)persisted—

Global attributes

IDHexAttributeMeaning
655280xFFF8GeneratedCommandListResponse command IDs this server generates.
655290xFFF9AcceptedCommandListCommand IDs this server accepts.
655310xFFFBAttributeListAttribute IDs implemented.
655320xFFFCFeatureMapImplemented optional features (see above).
655330xFFFDClusterRevisionCluster revision implemented; 1 for a Matter 1.6.1 device.

Attribute Details

Attribute 0 / 0x0000 — MaxProvisioned

Path example:

0/2050/0

Indicates the maximum number of per fabric TLSEndpoints that can be installed on this Node.

PropertyValue
Typeuint8
ConformanceM
AccessR (read: view)
Constraint5 to 254

Example:

{
  "0/2050/0": 5
}

Attribute 1 / 0x0001 — ProvisionedEndpoints

Path example:

0/2050/1

Indicates a list of currently provisioned TLS Endpoints on this Node. The maximum length of this list when read will be the value of MaxProvisioned.

PropertyValue
Typelist of TLSEndpointStruct
ConformanceM
AccessR (read: view, fabric-sensitive)
Qualitiespersisted
Constraintdesc

Each entry is a TLSEndpointStruct (see Data Types).

Example:

{
  "0/2050/1": []
}

Cluster 2050 Commands

Cluster 2050 has 3 client-to-server commands and 2 responses.

IDHexCommandDirectionConformanceResponseDescription
00x00ProvisionEndpointclient → serverMProvisionEndpointResponseThis command is used to provision a TLS Endpoint for the provided Hostname / Port combination.
10x01ProvisionEndpointResponseserver → clientM—This command is used to report the result of the ProvisionEndpoint command.
20x02FindEndpointclient → serverMFindEndpointResponseThis command is used to find a TLS Endpoint by its ID.
30x03FindEndpointResponseserver → clientM—This command is used to report the result of the FindEndpoint command.
40x04RemoveEndpointclient → serverM—This command is used to remove a TLS Endpoint by its ID.

AcceptedCommandList

The AcceptedCommandList attribute lists the command IDs the endpoint actually implements:

endpoint_id / 2050 / 65529
{
  "0/2050/65529": [
    0,
    2,
    4
  ]
}

Before sending a Cluster 2050 command, check that the command ID exists in endpoint/2050/65529. Optional commands are only present when the matching feature is set in FeatureMap.


Bridge Command Payload Format

The bridge accepts Matter commands in this structure:

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 2050,
    "command_name": "ProvisionEndpoint",
    "payload": {},
    "timed_request_timeout_ms": 1000
  }
}

For Cluster 2050, always use "cluster_id": 2050. Payload keys are the command field names in lowerCamelCase. Octet-string fields are base64-encoded. timed_request_timeout_ms is required for timed commands and ignored otherwise.


Command: ProvisionEndpoint

Purpose

This command is used to provision a TLS Endpoint for the provided Hostname / Port combination.

Command Identity

FieldValue
Command ID0
Command hex0x00
Command nameProvisionEndpoint
Directionclient → server
ConformanceM
ResponseProvisionEndpointResponse
Access(invoke: admin, fabric-scoped)

Payload Fields

IDFieldPayload keyTypeConformanceConstraintMeaning
0HostnamehostnameoctstrMlength 4 to 253This field represents a TLS Hostname.
1Portportuint16M1 to 65535This field represents a TLS Port Number.
2CAIDcaidTLSCAIDM0 to 65534—
3CCDIDccdidTLSCCDID (nullable)M——
4EndpointIDendpointIDTLSEndpointID (nullable)M——

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 2050,
    "command_name": "ProvisionEndpoint",
    "payload": {
      "hostname": "AQID",
      "port": 1,
      "caid": 0,
      "ccdid": 0,
      "endpointID": 0
    }
  }
}

The device answers with ProvisionEndpointResponse (see below).


Command: ProvisionEndpointResponse

Purpose

This command is used to report the result of the ProvisionEndpoint command.

Command Identity

FieldValue
Command ID1
Command hex0x01
Command nameProvisionEndpointResponse
Directionserver → client (response)
ConformanceM

Response Fields

IDFieldPayload keyTypeConformanceConstraintMeaning
0EndpointIDendpointIDTLSEndpointIDM0 to 65534—

Command: FindEndpoint

Purpose

This command is used to find a TLS Endpoint by its ID. This command returns the TLSEndpointStruct for the passed in EndpointID.

Command Identity

FieldValue
Command ID2
Command hex0x02
Command nameFindEndpoint
Directionclient → server
ConformanceM
ResponseFindEndpointResponse
Access(invoke: operate, fabric-scoped)

Payload Fields

IDFieldPayload keyTypeConformanceConstraintMeaning
0EndpointIDendpointIDTLSEndpointIDM0 to 65534—

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 2050,
    "command_name": "FindEndpoint",
    "payload": {
      "endpointID": 0
    }
  }
}

The device answers with FindEndpointResponse (see below).


Command: FindEndpointResponse

Purpose

This command is used to report the result of the FindEndpoint command.

Command Identity

FieldValue
Command ID3
Command hex0x03
Command nameFindEndpointResponse
Directionserver → client (response)
ConformanceM

Response Fields

IDFieldPayload keyTypeConformanceConstraintMeaning
0EndpointendpointTLSEndpointStructM0 to 65534The field is a TLSEndpointStruct containing the requested entry.

Command: RemoveEndpoint

Purpose

This command is used to remove a TLS Endpoint by its ID. This command is generated to request the Node remove any TLS Endpoint.

Command Identity

FieldValue
Command ID4
Command hex0x04
Command nameRemoveEndpoint
Directionclient → server
ConformanceM
Responsestatus only
Access(invoke: admin, fabric-scoped)

Payload Fields

IDFieldPayload keyTypeConformanceConstraintMeaning
0EndpointIDendpointIDTLSEndpointIDM0 to 65534—

Bridge Command Example

{
  "message_id": "1",
  "command": "device_command",
  "args": {
    "endpoint_id": 0,
    "cluster_id": 2050,
    "command_name": "RemoveEndpoint",
    "payload": {
      "endpointID": 0
    }
  }
}

Cluster 2050 Events

Cluster 2050 defines no events.


SmartphoneKey Notes

  • Cluster 2050 is not currently exposed by SmartphoneKey devices. This page documents the Matter 1.6.1 specification so that future devices can be interpreted without changes to the backend.
  • Shadow paths follow endpoint/2050/attribute; attribute values that the device reports as unreadable are written as n/a.
  • Attribute IDs, command IDs and enum values on this page come from the CSA Matter 1.6.1 data model; descriptions are condensed from the specification text.