fix: set SECLEVEL=1 to allow SHA-1 signed Samsung OCF Root CA

OpenSSL 3.x defaults to SECLEVEL=2, which rejects SHA-1 digests in the
certificate chain. Samsung's OCF Root CA is SHA-1 signed, so peer
verification failed with "ca md too weak" on every connect attempt.

SECLEVEL=1 (80-bit minimum) allows SHA-1 in the CA chain while still
enforcing meaningful key-strength and cipher constraints. Not going back
to SECLEVEL=0 which removes all restrictions.

custom_components/localthings/ocf/coap_dtls.py

@@ -231,7 +231,10 @@ class DtlsCoapSession:
         ctx = SSL.Context(SSL.DTLS_METHOD)
         ctx.load_verify_locations(_OCF_ROOT_CA)
         ctx.set_verify(SSL.VERIFY_PEER, lambda conn, cert, err, depth, ok: ok)
-        ctx.set_cipher_list(b'ECDHE-ECDSA-AES128-GCM-SHA256')
+        # SECLEVEL=1 (80-bit) allows the Samsung OCF Root CA which is SHA-1
+        # signed. SECLEVEL=2 (the OpenSSL 3.x default) rejects SHA-1 in the
+        # cert chain entirely, which kills CA verification on connect.
+        ctx.set_cipher_list(b'ECDHE-ECDSA-AES128-GCM-SHA256@SECLEVEL=1')
         ctx.use_certificate_chain_file(self.cert_path)
         ctx.use_privatekey_file(self.key_path)
         ctx.check_privatekey()