[BUG] Unable to load certificates for ha_carrier extension, works in official HA container

[Bad-Magic]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Logs fill up with error that look like this when variosu components attempt to validate SSL certificates.

http.client_exceptions.ClientConnectorCertificateError: Cannot connect to host sso.carrier.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)')]

Expected Behavior

No response

Steps To Reproduce

I was able to reproduce this reliably using the ha_carrier extension. Each time it attempts to poll for new data, an error is generated instead.

Originally filed here - dahlb/ha_carrier#263

Running 'pip install pip-system-certs' and restarting the container temporarily resolves the issue.

Environment

- OS:
- How docker service was installed:

CPU architecture

x86-64

Docker creation

homeassistant:
    image: linuxserver/homeassistant:latest
    restart: always
    network_mode: host
    environment:
      PUID: 1024
      PGID: 100
      TZ: America/Los_Angeles
      PATH: /usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/scripts:/opt/photoprism/bin
    volumes:
      - HomeAssistantConfig:/config

Container logs

Logspew in description.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[aptalca]

Your overwriting of PATH may be the culprit

The image includes all the same deps HA's official implementation does, including certifi

[Bad-Magic]

Interestingly, I recreated the image using the same configuration and I'm not seeing this issue repeat.

Closing this out. If it reoccurs, I'll head back. Let me know if there is any other info that might be helpful to gather.

[Bad-Magic]

Well, it's back. Full error here:

This error originated from a custom integration.

Logger: custom_components.ha_carrier
Source: custom_components/ha_carrier/carrier_data_update_coordinator.py:59
integration: Carrier Infinity (documentation, issues)
First occurred: 10:09:47 AM (2826 occurrences)
Last logged: 7:04:19 PM

Cannot connect to host sso.carrier.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)')]
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/aiohttp/connector.py", line 1283, in _wrap_create_connection
return await self._loop.create_connection(*args, **kwargs, sock=sock)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/asyncio/base_events.py", line 1187, in create_connection
transport, protocol = await self._create_connection_transport(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...<2 lines>...
ssl_shutdown_timeout=ssl_shutdown_timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/asyncio/base_events.py", line 1220, in _create_connection_transport
await waiter
File "/usr/local/lib/python3.13/asyncio/sslproto.py", line 581, in _on_handshake_complete
raise handshake_exc
File "/usr/local/lib/python3.13/asyncio/sslproto.py", line 563, in _do_handshake
self._sslobj.do_handshake()
~~~~~~~~~~~~~~~~~~~~~~~~~^^
File "/usr/local/lib/python3.13/ssl.py", line 951, in do_handshake
self._sslobj.do_handshake()
~~~~~~~~~~~~~~~~~~~~~~~~~^^
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/config/custom_components/ha_carrier/carrier_data_update_coordinator.py", line 59, in _async_update_data
fresh_systems: list[System] = await self.api_connection.load_data()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/carrier_api/api_connection_graphql.py", line 380, in load_data
system_response = await self.get_systems()
^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/carrier_api/api_connection_graphql.py", line 317, in get_systems
return await self.authed_query(operation_name=operation_name, query=query, variable_values=variable_values)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/carrier_api/api_connection_graphql.py", line 112, in authed_query
await self.check_auth_expiration()
File "/usr/local/lib/python3.13/site-packages/carrier_api/api_connection_graphql.py", line 93, in check_auth_expiration
await self.refresh_auth_token()
File "/usr/local/lib/python3.13/site-packages/carrier_api/api_connection_graphql.py", line 103, in refresh_auth_token
response = await self.api_session.post(url=url, data=json_body)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/client.py", line 770, in _request
resp = await handler(req)
^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/client.py", line 725, in _connect_and_send_request
conn = await self._connector.connect(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
req, traces=traces, timeout=real_timeout
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/usr/local/lib/python3.13/site-packages/aiohttp/connector.py", line 642, in connect
proto = await self._create_connection(req, traces, timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/connector.py", line 1209, in _create_connection
_, proto = await self._create_direct_connection(req, traces, timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/connector.py", line 1581, in _create_direct_connection
raise last_exc
File "/usr/local/lib/python3.13/site-packages/aiohttp/connector.py", line 1550, in _create_direct_connection
transp, proto = await self._wrap_create_connection(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...<7 lines>...
)
^
File "/usr/local/lib/python3.13/site-packages/aiohttp/connector.py", line 1285, in _wrap_create_connection
raise ClientConnectorCertificateError(req.connection_key, exc) from exc
aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host sso.carrier.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)')]

Removing the path override and restarting the container seems to be working. I'll keep this open for another day or two to see if fails again.

FWIW - I think it was silent failing until some automation triggered and then it started to show up in the log. Manually triggering the automation succeeded post-reboot.

[Bad-Magic]

Nope. Started seeing errors again overnight.

I've rerun 'pip install pip-system-certs' and restarted the container. Will report back.

[aptalca]

It really sounds like you're just having intermittent issues where a restart fixes it for a time. Could they be related to your time drifting and resulting in cert errors? Cryptography requires the local time to be in sync.

[Bad-Magic]

Verified, I'm getting cert errors again after 3-4 hours. :\

Seems OK? Only difference is that the host is reporting in UTC?

[Container]:/# date
Wed Aug 13 13:26:27 PDT 2025

[Host]:~$ date
Wed Aug 13 08:26:28 PM UTC 2025

[Bad-Magic]

I've also verified that restarting the integration via the HA UI doesn't resolve the issue.

Restarting home assistant from the UI (w/o restarting the container) does seem to be sufficient.

I'll keep an eye on it for a few hours again...

[Bad-Magic]

Failed again after about 30 minutes. Any ideas?