From 58ecbaab4606a700f90b2ccf26831b7f301e01d3 Mon Sep 17 00:00:00 2001 From: Marc Billow Date: Mon, 29 Jun 2026 21:06:12 -0500 Subject: [PATCH] fix: set SECLEVEL=1 to allow SHA-1 signed Samsung OCF Root CA OpenSSL 3.x defaults to SECLEVEL=2, which rejects SHA-1 digests in the certificate chain. Samsung's OCF Root CA is SHA-1 signed, so peer verification failed with "ca md too weak" on every connect attempt. SECLEVEL=1 (80-bit minimum) allows SHA-1 in the CA chain while still enforcing meaningful key-strength and cipher constraints. Not going back to SECLEVEL=0 which removes all restrictions. --- custom_components/localthings/ocf/coap_dtls.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/custom_components/localthings/ocf/coap_dtls.py b/custom_components/localthings/ocf/coap_dtls.py index 09aa37f..8bd16dd 100644 --- a/custom_components/localthings/ocf/coap_dtls.py +++ b/custom_components/localthings/ocf/coap_dtls.py @@ -231,7 +231,10 @@ class DtlsCoapSession: ctx = SSL.Context(SSL.DTLS_METHOD) ctx.load_verify_locations(_OCF_ROOT_CA) ctx.set_verify(SSL.VERIFY_PEER, lambda conn, cert, err, depth, ok: ok) - ctx.set_cipher_list(b'ECDHE-ECDSA-AES128-GCM-SHA256') + # SECLEVEL=1 (80-bit) allows the Samsung OCF Root CA which is SHA-1 + # signed. SECLEVEL=2 (the OpenSSL 3.x default) rejects SHA-1 in the + # cert chain entirely, which kills CA verification on connect. + ctx.set_cipher_list(b'ECDHE-ECDSA-AES128-GCM-SHA256@SECLEVEL=1') ctx.use_certificate_chain_file(self.cert_path) ctx.use_privatekey_file(self.key_path) ctx.check_privatekey()