Add temporary Rheem EcoNet CA workaround

config/additional_ca/DigiCertGlobalRootCA.crt.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
+CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
+nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
+43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
+T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
+gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
+BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
+TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
+DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
+hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
+06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
+PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
+YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
+CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
+-----END CERTIFICATE-----

config/additional_ca/README.md

@@ -0,0 +1,31 @@
+# Additional CA Certificates
+
+This folder contains certificate authorities loaded by the Additional CA custom
+integration at Home Assistant startup.
+
+The live Additional CA custom component install is intentionally kept out of
+source control. Maintain it through HACS/manual install in the Home Assistant
+environment while this workaround is needed.
+
+## Rheem EcoNet temporary workaround
+
+`DigiCertGlobalRootCA.crt.pem` temporarily restores trust for the Rheem EcoNet
+ClearBlade endpoint while `rheem.clearblade.com` still chains to the legacy
+DigiCert Global Root CA (G1).
+
+Local tracker: https://github.com/CCOSTAN/Home-AssistantConfig/issues/1820
+
+Upstream references:
+- https://github.com/home-assistant/core/issues/172228
+- https://github.com/home-assistant/operating-system/issues/4775
+- https://docs.clearblade.com/iotcore/digicert-g1-root-ca-distrust
+- https://knowledge.digicert.com/alerts/digicert-root-strategy-aligning-with-industry-standards
+
+Verification values for the installed PEM:
+- PEM SHA256: `39FDCF28AEFFE08D03251FCCAF645E3C5DE19FA4EBBAFC89B4EDE2A422148BAB`
+- Certificate DER fingerprint: `4348A0E9444C78CB265E058D5E8944B4D84F9662BD26DB257F8934A443C70161`
+
+Remove this certificate, the `additional_ca` entry in `configuration.yaml`, and
+the Additional CA custom component if it has no other use after the upstream
+Rheem/ClearBlade certificate chain validates with the stock Home Assistant trust
+store.

config/configuration.yaml

@@ -28,6 +28,11 @@ homeassistant:
 
 default_config:
 
+# Temporary Rheem EcoNet/ClearBlade TLS workaround.
+# Remove when https://github.com/CCOSTAN/Home-AssistantConfig/issues/1820 is resolved.
+additional_ca:
+  rheem_econet_digicert_g1: DigiCertGlobalRootCA.crt.pem
+
 frontend:
   extra_module_url:
     - /hacsfiles/custom-sidebar/custom-sidebar-plugin.js

config/packages/rheem_econet.yaml

@@ -5,9 +5,11 @@
 # -------------------------------------------------------------------
 # Rheem EcoNet Water Heater - Monitoring and control
 # Related Issue: 1550
+# Related Issue: 1820
 #  Logs hot-water availability alerts to Activity feed; keeps announcements.
 # -------------------------------------------------------------------
 # Docs: https://www.home-assistant.io/integrations/econet/ | Existing notes: Issue #892
+# Temporary DigiCert G1 CA workaround lives in configuration.yaml/additional_ca.
 # Powerwall outage control for Rheem WH lives in config/packages/powerwall.yaml
 ######################################################################