From e472955f71283ced7aa0febb8a0c5f8669a07012 Mon Sep 17 00:00:00 2001 From: Alexander Gottweis Date: Fri, 7 Aug 2026 23:57:58 +0200 Subject: [PATCH 1/3] Revert "fixed/simplified default ssl context" This reverts commit 5aca08834bf47189944bb06e1c22e242dce24c07. --- appdaemon/plugins/hass/hassplugin.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/appdaemon/plugins/hass/hassplugin.py b/appdaemon/plugins/hass/hassplugin.py index d495b4d2f..af4778cf2 100644 --- a/appdaemon/plugins/hass/hassplugin.py +++ b/appdaemon/plugins/hass/hassplugin.py @@ -128,8 +128,11 @@ def create_session(self) -> aiohttp.ClientSession: """Handles creating an :py:class:`~aiohttp.ClientSession` with the cert information from the plugin config and the authorization headers for the `REST API `_. """ - ssl_context = ssl.create_default_context(capath=self.config.cert_path) - conn = aiohttp.TCPConnector(ssl_context=ssl_context) + if self.config.cert_path is not None: + ssl_context = ssl.create_default_context(capath=self.config.cert_path) + conn = aiohttp.TCPConnector(ssl_context=ssl_context, verify_ssl=self.config.cert_verify) + else: + conn = aiohttp.TCPConnector(ssl=False) connect_timeout_secs = self.config.connect_timeout.total_seconds() return aiohttp.ClientSession( From ed8fcca4e408e5024b104d7e916566533d50ca50 Mon Sep 17 00:00:00 2001 From: Alexander Gottweis Date: Sat, 8 Aug 2026 01:50:34 +0200 Subject: [PATCH 2/3] Make HA `cert_verify` not require `cert_path` to be set The following applies to the SSL certificatie validation of HA connections: This fix makes `cert_verify` independent from `cert_path`, now `cert_verify` can be set to `False` without `cert_path` needed to be set `cert_verify: False` is used to allow self-signed certificates, and needing to specify a `cert_path` did not make sense as the certificate validation/verification is skipped anyways Fixes #2532 --- appdaemon/plugins/hass/hassplugin.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/appdaemon/plugins/hass/hassplugin.py b/appdaemon/plugins/hass/hassplugin.py index af4778cf2..40dd0f8a8 100644 --- a/appdaemon/plugins/hass/hassplugin.py +++ b/appdaemon/plugins/hass/hassplugin.py @@ -128,9 +128,9 @@ def create_session(self) -> aiohttp.ClientSession: """Handles creating an :py:class:`~aiohttp.ClientSession` with the cert information from the plugin config and the authorization headers for the `REST API `_. """ - if self.config.cert_path is not None: + if self.config.cert_path is not None or self.config.cert_verify is not False: ssl_context = ssl.create_default_context(capath=self.config.cert_path) - conn = aiohttp.TCPConnector(ssl_context=ssl_context, verify_ssl=self.config.cert_verify) + conn = aiohttp.TCPConnector(ssl_context=ssl_context, ssl=True) else: conn = aiohttp.TCPConnector(ssl=False) From 9ad7710c42d485412165dbde235bd62085e93c17 Mon Sep 17 00:00:00 2001 From: Alexander Gottweis Date: Sat, 8 Aug 2026 02:15:35 +0200 Subject: [PATCH 3/3] Update docs regarding `cert_path` deprecation `cert_path` has been long time ago deprecated, this commit removes confusing/deprecated example configuration of `cert_path` Usability of `cert_path` is still working, however it is now not documents to avoid new users from using it --- docs/CONFIGURE.rst | 2 -- docs/HASS_API_REFERENCE.rst | 3 --- 2 files changed, 5 deletions(-) diff --git a/docs/CONFIGURE.rst b/docs/CONFIGURE.rst index baaf5c6e4..2fa51854a 100644 --- a/docs/CONFIGURE.rst +++ b/docs/CONFIGURE.rst @@ -554,7 +554,6 @@ An example of the HASS plugin configured with YAML could look like the following type: hass ha_url: token: - cert_path: cert_verify: True namespace: default @@ -583,7 +582,6 @@ Or in TOML: type = "hass" ha_url = "" token = "" - cert_path = "" cert_verify = true namespace = "default" diff --git a/docs/HASS_API_REFERENCE.rst b/docs/HASS_API_REFERENCE.rst index 38221e6b9..d4a7767e0 100644 --- a/docs/HASS_API_REFERENCE.rst +++ b/docs/HASS_API_REFERENCE.rst @@ -73,9 +73,6 @@ This is the full list of configuration options available for the `Hass` plugin. * - ``cert_verify`` - optional - Flag for adding an SSL context around the ``aiohttp.ClientSession``. Set to ``False`` to disable (e.g., with internal IPs) - * - ``cert_path`` - - optional - - Path to the SSL certificate file. This is only used if ``cert_verify`` is set to ``True``. * - ``api_port`` - optional - Port the AppDaemon RESTful API will listen on. If not specified, API is disabled