Here is a “solution” that allow you to survive home assistant upgrade, and to avoid any ssh as long as you already have hacs installed.
I made this today to test if this would solve issue with the fullykiosk integration using https.
It didn’t …
Create a python script available as a service
Install pyscript
https://hacs-pyscript.readthedocs.io/en/latest/installation.html
Enable allow_all_imports
In config/integrations, click on the configure button on the pyscript integration and check Allow All Imports
Import the script
Using what ever method you use to add or change file on your home assistant instance, add the following script in your config folder under pyscript/add_custom_ca.py
# ==================================================================================================
# python_scripts/add_custom_ca.py
# ==================================================================================================
# --------------------------------------------------------------------------------------------------
# Add the .pem from the provided path to certifi catalogue
# --------------------------------------------------------------------------------------------------
# from https://community.home-assistant.io/t/let-home-assistant-trust-a-personal-certificate-authority/184917/22?u=vaarlion
import certifi
from os import path as os_path
@service
def add_custom_ca(pem_path):
"""yaml
name: Add Custom ca
description: Add the .pem from the provided path to certifi catalogue.
fields:
pem_path:
name: Pem file(s) path
description: a path or a list of path to .pem file
exemple: ["/ssl/custome_ca.pem", "/config/www/ssl/extra_ca.pem"]
selector:
text:
"""
inputPath = pem_path
listPath = []
if inputPath is None:
log.warning("===== pem_path is required if you want to add something.")
else:
if (
isinstance(inputPath, str)
and inputPath
and task.executor(os_path.isfile, inputPath)
):
listPath.append(inputPath)
elif isinstance(inputPath, list) and inputPath:
for path in inputPath:
if isinstance(path, str) and task.executor(os_path.isfile, path):
listPath.append(path)
else:
log.info(
"===== ignoring '{}' as it's not a path to an existing file".format(
path
)
)
else:
log.warning(
"===== pem_path is required to be a path or a list of path to existing files"
)
cafile = certifi.where()
for pem in listPath:
__append_fileA_to_fileB(pem, cafile)
@pyscript_executor
def __append_fileA_to_fileB(fileA, fileB):
with open(fileA, "rb") as infile:
customca = infile.read()
with open(fileB, "r") as outfile:
cachain = outfile.read()
if customca.decode("utf-8") not in cachain:
with open(fileB, "ab") as outfile:
outfile.write(customca)
Then call the service pyscript.reload
Upload your .pem file
Using the same way you’ve uploaded the script, upload your CA certificate in a .pem format where ever you want. I recommend /ssl/. You can add as many as you want.
Automate it
Testing the service
Try to run the service and make sure there is no error in the log.
in developer-tools/service, run something like
service: pyscript.add_custom_ca
data:
pem_path: /ssl/mycert.pem
or
service: pyscript.add_custom_ca
data:
pem_path:
- /ssl/mycert.pem
- /config/some_other_cert.pem
With your own file obviously.
Now check to see if this solve your issue. It may not as not every automation use that certificate catalogue, and other have some hard-coded port or protocol.
If it does, then we need to have it survive an upgrade.
Create an automation
Now juste make an automation who run that services as soon as home assistant start 
alias: "Add custom cert on boot"
description: ""
trigger:
- platform: homeassistant
event: start
condition: []
action:
- service: pyscript.add_custom_ca
data:
pem_path: /ssl/MainCA.pem
mode: single
No worry, the python script make sure the cert isn’t already present before adding it, so you won’t append it 500 time before the next release.
.