As DNS-Sec is used by home-assistant.io domain. Its important that the time on the Yellow is correct, otherwise the install will not work, and you will see the following like errors if you access the yellow’s console:
# ping version.home-assistant.io
ping: bad address 'version.home-assistant.io'
# curl --no-progress-meter -L https://version.home-assistant.io/stable.json
curl: (6) Could not resolve host: version.home-assistant.io
# systemd-resolve version.home-assistant.io
version.home-assistant.io: resolve call failed: DNSSEC validation failed: signature-expired
The above message is misleading, as the signature start time is in the future.
How to confirm its a time error:
- The TZ is optional, check the year and month
# TZ=Australia/Melbourne date
Tue Dec 20 20:09:05 AEDT 2022
I suspect this is the date it was tested, it took 18 months for my CM4 to arrive.
- See what Time Server your using
# networkctl stats
State: routable
Online state: online
Address: 192.168.0.10 on end0
2001:4479:6903:7a00:da2a:ddff:fecd:18ab on end0
fe80::da3a:ddff:fecd:18ab on end0
Gateway: 192.168.0.254 on end0
fe80::c225:6ff:fedc:adfc on end0
DNS: 192.168.0.254
8.4.4.4
NTP: 192.168.0.250
# timedatectl show-timesync --all
LinkNTPServers=192.168.0.250
SystemNTPServers=
RuntimeNTPServers=
FallbackNTPServers=time.cloudflare.com
ServerName=192.168.0.10
ServerAddress=192.168.0.10
RootDistanceMaxUSec=5s
PollIntervalMinUSec=32s
PollIntervalMaxUSec=34min 8s
PollIntervalUSec=34min 8s
Frequency=0
The NTP (Time Server information comes from your DHCP server), check IP address indicated is infact running a time service, link ntpd, or chrony or its the same IP address as your modem/router as most run a time service.
Fix your DHCP server so it responds with a valid time server IP address. And then reboot or run the following:
# networkctl forcerenew end0
# systemctl restart systemd-networkd.service
# TZ=Australia/Melbourne date
It would be nice if the yellow installer had a python web server which ran the install, instead of
/usr/bin/haos-flash which is called by systemd service install-autostart
The issue can also happen if you are using https and the date on the system is earlier than the start date of the SSL/TSL certificate.
The cost me a fair about of time to determine the cause was the NTP setting sent by the DHCP server was invalid. I hope posting here saves others some time. You can access the console by plugging a cable into the USB-C, see use-serial-console-windows or use-serial-console-linux-macos for more details.