Bonjour,
Bonjour,
Impeccable , toujours aussi réactif.
Ludo79
Décembre 13, 2024, 7:44
4
Hello,
Suite à une maintenance chez Honneywell, il y a un souci.
Potentielle solution trouvée ici:
ouvert 01:33PM - 12 Dec 24 UTC
fermé 09:33PM - 12 Dec 24 UTC
I am using the evohome-async package from the evohome homeassistant integration.…
Since yesterday (?) I see a lot of ssl errors in my logs:
`[2024-12-12 13:45:43.385 WARNING (MainThread) [homeassistant.components.evohome] Unable to obtain the latest high-precision temperatures. Check your network and the vendor's service status page. Proceeding without high-precision temperatures for now. Message is: Cannot connect to host tccna.honeywell.com:443 ssl:True [SSLCertVerificationError: (1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'tccna.honeywell.com'. (_ssl.c:1020)")]` (among others)
and the integration no longer works.
I looked up the certificate for tccna.honeywell.com, and it's not valid for that hostname, but it _is_ valid for tccna.resideo.com.
```
☁ ~ seecert tccna.honeywell.com
Server: 100.100.100.100
Address: 100.100.100.100#53
Non-authoritative answer:
Name: tccna.honeywell.com
Address: 20.62.73.190
Connecting to 20.62.73.190
depth=2 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
verify return:1
depth=1 C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 C=US, ST=Arizona, L=Scottsdale, O=Resideo Technologies, Inc., CN=TCCNA.resideo.com
verify return:1
DONE
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
0c:90:b5:65:10:e4:a7:be:d3:52:c8:5b:e8:ba:ba:b0
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
Validity
Not Before: Nov 20 00:00:00 2024 GMT
Not After : Dec 21 23:59:59 2025 GMT
Subject: C=US, ST=Arizona, L=Scottsdale, O=Resideo Technologies, Inc., CN=TCCNA.resideo.com
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:TCCNA.resideo.com, DNS:TCCEU.resideo.com, DNS:TCCAP.resideo.com, DNS:TCCNAS.resideo.com, DNS:TCCEUS.resideo.com, DNS:TCCAPS.resideo.com
```
(snipped some irrelevant parts from output for readability)
Weirdly enough, the two hosts don't share their IP-address:
```
☁ ~ host tccna.honeywell.com
tccna.honeywell.com has address 20.62.73.190
tccna.honeywell.com mail is handled by 10 m01.honeywell.com.
☁ ~ host tccna.resideo.com
tccna.resideo.com has address 135.224.164.118
☁ ~
```
The hostname is hardcoded in `evohomeasync2/const.py` and in `evohomeasync/broker.py`.
If I change the hostname from `tccna.honeywell.com` to `tccna.resideo.com` _directly in the homeassistant container_ in those files (found at `/usr/local/lib/python3.13/site-packages/evohomeasync2/const.py` and in `/usr/local/lib/python3.13/site-packages/evohomeasync/broker.py` in 2024.12) and restart homeassistant, the integration works.
(As an aside, I was surprised the change survived a container restart, but that's a whole different story)
I am more than happy to raise this with Resideo customer service myself of course. But someone might find this hacky stopgap useful while Resideo fix their certs.
(edited to clarify you have to update both evohome-async and evohome-async2 packages)
edit2: I had not foreseen this would gain so much traction in just an hour :)
For all of you coming here and wondering how to apply the stopgap: if you want to change the files, you have to do it in the running container. This means first getting access to the host that runs the docker daemon (i.e. the machine that runs HAOS), en then exec into the container. AFAIK, using the standard ssh integration from inside homeassistant _does not work_, you really have to log on to the OS that runs the docker daemon.
@leen67 posted a step by step in the HA Core issue that also deals with this: https://github.com/home-assistant/core/issues/132366#issuecomment-2539283798
Ludo
