HA Core downgrade how to fix OpenSSL dependency?

Good evening,

Today, I had the brilliant idea of remotely upgrading my HA core from 2025.9.4 to 2025.10.3. Unfortunately, it no longer starts up due to the dependency on OpenSSL 3.2.x, which I was previously unaware of.
The system (Raspbian) is still running 3.0.17, and a build/make of 3.2 from outside is too risky on the Rpi 3.

Unfortunately, I am unable to perform a complete downgrade.
pip3 install --upgrade homeassistant==2025.9.4
and
pip3 install --upgrade --force-reinstall homeassistant==2025.9.4

unfortunately do not resolve the dependency on OpenSSL 3.2. How can I get 2025.9.4 to start again without redoing the entire python venv?
How do I remove the (now incorrect) dependency?

I deeply regret having had the stupid idea of doing a remote upgrade…

Thanks a lot for any help!

(homeassistant) homeassistant@homeassistant:/home/RpiZeroW $ hass
Traceback (most recent call last):
File “/srv/homeassistant/bin/hass”, line 5, in
from homeassistant.main import main
File “/srv/homeassistant/lib/python3.13/site-packages/homeassistant/main.py”, line 12, in
from .backup_restore import restore_backup
File “/srv/homeassistant/lib/python3.13/site-packages/homeassistant/backup_restore.py”, line 16, in
import securetar
File “/srv/homeassistant/lib/python3.13/site-packages/securetar/init.py”, line 17, in
from cryptography.hazmat.primitives import padding
File “/srv/homeassistant/lib/python3.13/site-packages/cryptography/hazmat/primitives/padding.py”, line 10, in
from cryptography.hazmat.bindings._rust import (
…<4 lines>…
)
ImportError: /lib/arm-linux-gnueabihf/libcrypto.so.3: version `OPENSSL_3.2.0’ not found (required by /srv/homeassistant/lib/python3.13/site-packages/cryptography/hazmat/bindings/_rust.abi3.so)

Hello HurrDurr,

Time to use your backup…

I would suggest restoring into a container or HAOS base, but that probably isn’t going to happen.

I understand the idea, but unfortunately it misses the point.
Is it really no longer possible to change the dependencies? 2025.9.4 ran without any problems.

I can only think of three things:

  • Reset dependencies (and the question is how, and why they are now “fixed” differently)
  • Compile Openssl (I already did that yesterday, but the error remained, probably because python venv needs it system-wide(?)
  • Recreate venv and reinstall HA

If I currently had local access, I would simply move to HAOS—unfortunately, that’s not possible at the moment.
Unfortunately, I’ll be away for weeks… and yes, it was stupid. But now I have to find a solution.

Truthfully the team at HA needs to harden the system to check if an update will break your system. Yesterday I was converting all my automations to blueprints and I bricked my home assistant because the yaml was parsed incorrectly while developing the blueprints. Got annoyed but got to learn. Hence why I’m converting every single automation to blue print so can fresh install and ditch my noisy old server

Woho—progress!

First, I built openSSL 3.2.6, but then suddenly I got a message saying I now needed 3.3.0… For whatever reason.
I was actually sure that it was due to something else in the end, but I wanted to try it and… HA seems to be starting up now. Since I completely fried the cache yesterday (without a backup…:-X), it will probably take a while.

However, there is one point I still don’t understand. Does anyone know what I overlooked with user RpiZeroW? He still gets the system version displayed, even though the correct lib is installed.

root@homeassistant:/usr/src/openssl-3.3.5# openssl version
OpenSSL 3.3.5 Sep 30, 2025 (Library: OpenSSL 3.3.5 Sep 30, 2025)
RpiZeroW@homeassistant:/usr/local $ openssl version
OpenSSL 3.0.17 Jul 1, 2025 (Library: OpenSSL 3.3.5 Sep 30, 2025)
RpiZeroW@homeassistant:/usr/local $ sudo -u homeassistant -H -s
[sudo] Password for RpiZeroW:
homeassistant@homeassistant:/usr/local $ openssl version
OpenSSL 3.3.5 30 Sep 2025 (Library: OpenSSL 3.3.5 30 Sep 2025)

EDIT:
Nvm - got it fixed.

cd /usr/lib/ssl
unlink openssl.cnf
ln -s /usr/local/ssl/openssl.cnf openssl.cnf
ldconfig /usr/local/lib

And its back online :slight_smile: