# Developer builds local control for Coway purifier after finding certificate weakness

_Published Friday, November 13, 2026 at 10:19 AM EST · Security · Latest · Tier 2 — Notable_

![Developer builds local control for Coway purifier after finding certificate weakness — Primary](https://scottjg.com/posts/2026-11-11-reverse-engineering-my-coway-air-purifier-to-ditch-the-cloud/coway-airmega-icons-cover.jpg)

A developer reports building a Home Assistant integration that controls a Coway Airmega IconS directly over Wi-Fi, replacing its normal reliance on Coway's cloud. The developer found that the purifier downloaded its trusted root certificate over unencrypted HTTP, allowing replacement of that certificate and interception of subsequent traffic.

Further investigation showed that Bluetooth setup messages specify the certificate and configuration server addresses. Reimplementing setup allowed the developer to point the purifier directly at a local server without intercepting traffic. The integration uses Web Bluetooth for provisioning and bridges the purifier into Apple Home. The demonstrated device is a discontinued IconS.

## Sources

- [scottjg.com](https://scottjg.com/posts/2026-11-11-reverse-engineering-my-coway-air-purifier-to-ditch-the-cloud/)

---
Canonical: https://techandbusiness.org/newswire/HwI6_6H-oAFxeSdU1yI7PT
Published: 2026-11-13T15:19:14.285Z
Story chronology: 2026-11-11T18:12:34.014Z
Retrieved: 2026-11-13T17:06:02.369Z
Publisher: Tech & Business (techandbusiness.org)