{"record":{"id":"831a50575530113f","repo":"home-assistant/core","slug":"configentryauthfailed-831a50","errorCode":null,"errorMessage":"ConfigEntryAuthFailed","messagePattern":"ConfigEntryAuthFailed","errorType":"exception","errorClass":"ConfigEntryAuthFailed","httpStatus":null,"severity":"error","filePath":"homeassistant/components/bosch_shc/__init__.py","lineNumber":46,"sourceCode":"type BoschConfigEntry = ConfigEntry[SHCSession]\n\n\nasync def async_setup_entry(hass: HomeAssistant, entry: BoschConfigEntry) -> bool:\n    \"\"\"Set up Bosch SHC from a config entry.\"\"\"\n    data = entry.data\n\n    zeroconf = await async_get_instance(hass)\n    try:\n        session = await hass.async_add_executor_job(\n            SHCSession,\n            data[CONF_HOST],\n            data[CONF_SSL_CERTIFICATE],\n            data[CONF_SSL_KEY],\n            False,\n            zeroconf,\n        )\n    except SHCAuthenticationError as err:\n        raise ConfigEntryAuthFailed from err\n    except SHCConnectionError as err:\n        raise ConfigEntryNotReady from err\n\n    shc_info = session.information\n    if TYPE_CHECKING:\n        assert shc_info is not None and shc_info.unique_id is not None\n    if shc_info.updateState.name == \"UPDATE_AVAILABLE\":\n        _LOGGER.warning(\"Please check for software updates in the Bosch Smart Home App\")\n\n    entry.runtime_data = session\n\n    device_registry = dr.async_get(hass)\n    device_registry.async_get_or_create(\n        config_entry_id=entry.entry_id,\n        connections={(dr.CONNECTION_NETWORK_MAC, shc_info.unique_id)},\n        identifiers={(DOMAIN, shc_info.unique_id)},\n        manufacturer=\"Bosch\",\n        name=entry.title,","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/components/bosch_shc/__init__.py#L28-L64","documentation":"ConfigEntryAuthFailed is raised by the bosch_shc integration when constructing the SHCSession ( Bosch Smart Home Controller session) in an executor job raises SHCAuthenticationError — the controller rejected the client certificate/key pair or the pairing is not valid. HA stops retrying and requires the user to re-establish credentials (re-perform pairing) via the reauth flow.","triggerScenarios":"`SHCSession(data[CONF_HOST], data[CONF_SSL_CERTIFICATE], data[CONF_SSL_KEY], False, zeroconf)` fails because the SSL client certificate cannot authenticate against the SHC's TLS endpoint: expired/mismatched cert-key pair, certificate from a different controller, or the pairing was removed on the controller.","commonSituations":"Controller factory reset wiping pairings, certificate files replaced with ones from another SHC, expired self-signed cert, wrong host pointing at a different SHC unit, certificate/key paths in the entry pointing to missing files after HA restore.","solutions":["Confirm the host in the entry is the intended Smart Home Controller (not a second controller or changed IP).","Re-run the integration's pairing/reauth flow to generate and register a fresh client certificate for this controller.","Verify the SSL cert/key referenced by the entry exist and match each other (`openssl x509 -noout -modulus` vs key).","After a controller factory reset, all old pairings are gone — re-pair every client including HA."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"from pathlib import Path\n\ndef cert_pair_plausible(cert_path: str, key_path: str) -> bool:\n    \"\"\"Cheap pre-check that the pairing files exist and match.\"\"\"\n    cert, key = Path(cert_path), Path(key_path)\n    if not (cert.is_file() and key.is_file()):\n        return False\n    import subprocess\n    out = subprocess.run(\n        [\"openssl\", \"x509\", \"-in\", str(cert), \"-noout\", \"-modulus\"],\n        capture_output=True,\n    )\n    return out.returncode == 0","typeGuard":null,"tryCatchPattern":"try:\n    session = await hass.async_add_executor_job(SHCSession, host, cert, key, False, zeroconf)\nexcept SHCAuthenticationError as err:\n    raise ConfigEntryAuthFailed from err\nexcept SHCConnectionError as err:\n    raise ConfigEntryNotReady from err","preventionTips":["Re-pair HA immediately after any SHC factory reset — old certificates are invalidated.","Keep one cert/key pair per controller and label the files; never mix controllers.","Confirm the host points at the intended SHC before assuming the certificate is bad."],"tags":["home-assistant","bosch-shc","authentication","tls","pairing"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}