From 959dda471731f5ea063ac412b505adc03028fcef Mon Sep 17 00:00:00 2001 From: Carlo Costanzo Date: Mon, 6 Jul 2026 17:04:02 -0400 Subject: [PATCH] Add temporary Rheem EcoNet CA workaround --- .../DigiCertGlobalRootCA.crt.pem | 22 +++++++++++++ config/additional_ca/README.md | 31 +++++++++++++++++++ config/configuration.yaml | 5 +++ config/packages/rheem_econet.yaml | 2 ++ 4 files changed, 60 insertions(+) create mode 100644 config/additional_ca/DigiCertGlobalRootCA.crt.pem create mode 100644 config/additional_ca/README.md diff --git a/config/additional_ca/DigiCertGlobalRootCA.crt.pem b/config/additional_ca/DigiCertGlobalRootCA.crt.pem new file mode 100644 index 00000000..fd4341df --- /dev/null +++ b/config/additional_ca/DigiCertGlobalRootCA.crt.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD +QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB +CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97 +nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt +43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P +T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4 +gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO +BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR +TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw +DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr +hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg +06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF +PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls +YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk +CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= +-----END CERTIFICATE----- diff --git a/config/additional_ca/README.md b/config/additional_ca/README.md new file mode 100644 index 00000000..50bccfc9 --- /dev/null +++ b/config/additional_ca/README.md @@ -0,0 +1,31 @@ +# Additional CA Certificates + +This folder contains certificate authorities loaded by the Additional CA custom +integration at Home Assistant startup. + +The live Additional CA custom component install is intentionally kept out of +source control. Maintain it through HACS/manual install in the Home Assistant +environment while this workaround is needed. + +## Rheem EcoNet temporary workaround + +`DigiCertGlobalRootCA.crt.pem` temporarily restores trust for the Rheem EcoNet +ClearBlade endpoint while `rheem.clearblade.com` still chains to the legacy +DigiCert Global Root CA (G1). + +Local tracker: https://github.com/CCOSTAN/Home-AssistantConfig/issues/1820 + +Upstream references: +- https://github.com/home-assistant/core/issues/172228 +- https://github.com/home-assistant/operating-system/issues/4775 +- https://docs.clearblade.com/iotcore/digicert-g1-root-ca-distrust +- https://knowledge.digicert.com/alerts/digicert-root-strategy-aligning-with-industry-standards + +Verification values for the installed PEM: +- PEM SHA256: `39FDCF28AEFFE08D03251FCCAF645E3C5DE19FA4EBBAFC89B4EDE2A422148BAB` +- Certificate DER fingerprint: `4348A0E9444C78CB265E058D5E8944B4D84F9662BD26DB257F8934A443C70161` + +Remove this certificate, the `additional_ca` entry in `configuration.yaml`, and +the Additional CA custom component if it has no other use after the upstream +Rheem/ClearBlade certificate chain validates with the stock Home Assistant trust +store. diff --git a/config/configuration.yaml b/config/configuration.yaml index 28f19287..9bad6e4d 100755 --- a/config/configuration.yaml +++ b/config/configuration.yaml @@ -28,6 +28,11 @@ homeassistant: default_config: +# Temporary Rheem EcoNet/ClearBlade TLS workaround. +# Remove when https://github.com/CCOSTAN/Home-AssistantConfig/issues/1820 is resolved. +additional_ca: + rheem_econet_digicert_g1: DigiCertGlobalRootCA.crt.pem + frontend: extra_module_url: - /hacsfiles/custom-sidebar/custom-sidebar-plugin.js diff --git a/config/packages/rheem_econet.yaml b/config/packages/rheem_econet.yaml index 05431302..862636f8 100755 --- a/config/packages/rheem_econet.yaml +++ b/config/packages/rheem_econet.yaml @@ -5,9 +5,11 @@ # ------------------------------------------------------------------- # Rheem EcoNet Water Heater - Monitoring and control # Related Issue: 1550 +# Related Issue: 1820 # Logs hot-water availability alerts to Activity feed; keeps announcements. # ------------------------------------------------------------------- # Docs: https://www.home-assistant.io/integrations/econet/ | Existing notes: Issue #892 +# Temporary DigiCert G1 CA workaround lives in configuration.yaml/additional_ca. # Powerwall outage control for Rheem WH lives in config/packages/powerwall.yaml ######################################################################