Developer Cuts Coway Airmega Purifier Off From Company Cloud After Finding Certificate Sent Over Plain HTTP

SEOUL, South Korea - November 15, 2026

A software developer has published a method for cutting a Coway Airmega IconS air purifier off from Coway's IoCare+ cloud service and running it entirely from a home server, after finding that the device downloads the security certificate it relies on over plain, unencrypted HTTP.

Developer Scott J. Goldman released the project, called Coway Local, as free open-source code on GitHub under the MIT license. It works as a custom integration for the Home Assistant smart-home platform and was tested on one model, the AP-1022K version of the Airmega IconS, which Coway has since discontinued. The code was first posted on November 11, with release 0.5.2 following on November 12, and the project's own documentation calls it experimental.

According to the developer's write-up, the purifier has no root certificates built in. During setup it sends a plain HTTP request for a public Amazon root certificate stored on Amazon Web Services servers in the Seoul region, then uses that certificate to trust the encrypted connections that follow. By intercepting that unencrypted request on a test network and substituting a certificate of his own, Goldman found the fan would accept his server as genuine. The device then connected to Coway's certificate server and downloaded its own device certificate and private key, which he was also able to swap out. From there he could see the MQTT messaging traffic, secured with TLS and routed through AWS IoT, that carries commands such as fan speed, mode, timer and lighting between Coway's cloud and the purifier.

Goldman wrote that the fan "was always MitM-able," meaning its traffic could always be intercepted by a man-in-the-middle. He said he had first considered a more complicated route that relied on a separate certificate authority whose private keys were recently shown to be weak, but the plain-HTTP download made that unnecessary.

His motivation was reliability. The IconS has no official Home Assistant support, and the community integration that owners used logs into Coway's cloud. Goldman said that integration broke at least once or twice a year, that Coway's servers went offline from time to time, and that Coway once banned his account for weeks. Coway had originally banned the community integration for overloading its servers before allowing it after a dispute with users, and the company's switch from IoCare to IoCare+ forced the integration to be rewritten.

The developer also credited AI tools with much of the work. He wrote that one AI chatbot refused to help him set up traffic interception, even for testing, while another wrote the firewall rules, and that an AI later worked out the fan's Bluetooth setup protocol in about 20 minutes.

Coway Local trades the company's app for local control. Once a fan is set up this way, the Coway mobile app no longer controls it. Home Assistant runs its own MQTT broker that the fan connects to instead of Coway's, and setup is done over Web Bluetooth from Chrome on a Mac or Android device. The code supports power, three manual speeds, smart and sleep modes, lighting, timer and filter sensors, but not firmware updates or some air-quality readings. Coway's cloud service for the model continues to run.

Coway sells and rents water and air purifiers and other home appliances through a rental and membership model. On November 6 the company reported third-quarter revenue of 1.4261 trillion won, up 13.7 percent, with its United States subsidiary up 45.8 percent to 83.9 billion won. The developer's write-up does not include any response from Coway.