I had been using Spotcast for a few years with very few issues. About a year ago, it just stopped working. I have been trying to get Spotcast (and more recently, SpotifyPlus) to authenticate ever since.
The developer of SpotifyPlus has been incredibly helpful in trying to get this over the line with me, but we have hit a brick wall. The issue appears to be a core network/SSL handshake failure occurring within Home Assistant’s Python environment when it tries to reach the Spotify API to exchange the token.
System Details:
- Installation: Home Assistant OS on an Intel NUC (HAOS 16.3, Core 2025.12.5, Supervisor 2026.02.2)
- External Access: Nabu Casa
- Internal URL:
http://192.168.1.10:8123 - Router: BT Smart Hub 2 (UK)
When adding the integration, the initial Spotify login page loads, but when returning to Home Assistant to finalise the OAuth linking, it immediately fails with a certificate verify failed error.
Here is the traceback from the logs:
This error originated from a custom integration.
Logger: custom_components.spotifyplus.config_flow
Source: custom_components/spotifyplus/config_flow.py:168
integration: SpotifyPlus (documentation, issues)
First occurred: 16 February 2026 at 16:16:32 (3 occurrences)
Last logged: 09:32:21
SpotifyApiError: SAM0001E - An unhandled exception occured while processing method "MakeRequest". HTTPSConnectionPool(host='api.spotify.com', port=443): Max retries exceeded with url: /v1/me (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', '', 'certificate verify failed')])")))
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/urllib3/contrib/pyopenssl.py", line 520, in wrap_socket
cnx.do_handshake()
~~~~~~~~~~~~~~~~^^
File "/usr/local/lib/python3.13/site-packages/OpenSSL/SSL.py", line 2432, in do_handshake
self._raise_ssl_error(self._ssl, result)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/OpenSSL/SSL.py", line 2048, in _raise_ssl_error
_openssl_assert(
~~~~~~~~~~~~~~~^
reason == _lib.SSL_R_UNEXPECTED_EOF_WHILE_READING
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/usr/local/lib/python3.13/site-packages/OpenSSL/_util.py", line 76, in openssl_assert
exception_from_error_queue(error)
~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^
File "/usr/local/lib/python3.13/site-packages/OpenSSL/_util.py", line 62, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', '', 'certificate verify failed')]
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 464, in _make_request
self._validate_conn(conn)
~~~~~~~~~~~~~~~~~~~^^^^^^
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 1093, in _validate_conn
conn.connect()
~~~~~~~~~~~~^^
File "/usr/local/lib/python3.13/site-packages/urllib3/connection.py", line 796, in connect
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
sock=sock,
...<14 lines>...
assert_fingerprint=self.assert_fingerprint,
)
File "/usr/local/lib/python3.13/site-packages/urllib3/connection.py", line 975, in _ssl_wrap_socket_and_match_hostname
ssl_sock = ssl_wrap_socket(
sock=sock,
...<8 lines>...
tls_in_tls=tls_in_tls,
)
File "/usr/local/lib/python3.13/site-packages/urllib3/util/ssl_.py", line 483, in ssl_wrap_socket
ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
File "/usr/local/lib/python3.13/site-packages/urllib3/util/ssl_.py", line 527, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/urllib3/contrib/pyopenssl.py", line 526, in wrap_socket
raise ssl.SSLError(f"bad handshake: {e!r}") from e
ssl.SSLError: ("bad handshake: Error([('SSL routines', '', 'certificate verify failed')])",)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 787, in urlopen
response = self._make_request(
conn,
...<10 lines>...
**response_kw,
)
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 488, in _make_request
raise new_e
urllib3.exceptions.SSLError: ("bad handshake: Error([('SSL routines', '', 'certificate verify failed')])",)
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/spotifywebapipython/spotifyclient.py", line 1400, in MakeRequest
response = self._Manager.request(method, url, headers=msg.RequestHeaders)
File "/usr/local/lib/python3.13/site-packages/urllib3/_request_methods.py", line 135, in request
return self.request_encode_url(
~~~~~~~~~~~~~~~~~~~~~~~^
method,
^^^^^^^
...<3 lines>...
**urlopen_kw,
^^^^^^^^^^^^^
)
^
File "/usr/local/lib/python3.13/site-packages/urllib3/_request_methods.py", line 182, in request_encode_url
return self.urlopen(method, url, **extra_kw)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/urllib3/poolmanager.py", line 457, in urlopen
response = conn.urlopen(method, u.request_uri, **kw)
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 871, in urlopen
return self.urlopen(
~~~~~~~~~~~~^
method,
^^^^^^^
...<13 lines>...
**response_kw,
^^^^^^^^^^^^^^
)
^
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 871, in urlopen
return self.urlopen(
~~~~~~~~~~~~^
method,
^^^^^^^
...<13 lines>...
**response_kw,
^^^^^^^^^^^^^^
)
^
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 871, in urlopen
return self.urlopen(
~~~~~~~~~~~~^
method,
^^^^^^^
...<13 lines>...
**response_kw,
^^^^^^^^^^^^^^
)
^
File "/usr/local/lib/python3.13/site-packages/urllib3/connectionpool.py", line 841, in urlopen
retries = retries.increment(
method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
)
File "/usr/local/lib/python3.13/site-packages/urllib3/util/retry.py", line 535, in increment
raise MaxRetryError(_pool, url, reason) from reason # type: ignore[arg-type]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.spotify.com', port=443): Max retries exceeded with url: /v1/me (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', '', 'certificate verify failed')])")))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/config/custom_components/spotifyplus/config_flow.py", line 168, in async_oauth_create_entry
await self.hass.async_add_executor_job(
spotifyClient.SetAuthTokenFromToken, clientId, data["token"], tokenProfileId
)
File "/usr/local/lib/python3.13/concurrent/futures/thread.py", line 59, in run
result = self.fn(*self.args, **self.kwargs)
File "/usr/local/lib/python3.13/site-packages/spotifywebapipython/spotifyclient.py", line 17931, in SetAuthTokenFromToken
self.MakeRequest('GET', msg)
~~~~~~~~~~~~~~~~^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/spotifywebapipython/spotifyclient.py", line 1458, in MakeRequest
raise SpotifyApiError(SAAppMessages.UNHANDLED_EXCEPTION.format(apiMethodName, str(ex)), ex, logsi=_logsi)
spotifywebapipython.spotifyapierror.SpotifyApiError: SpotifyApiError: SAM0001E - An unhandled exception occured while processing method "MakeRequest".
HTTPSConnectionPool(host='api.spotify.com', port=443): Max retries exceeded with url: /v1/me (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', '', 'certificate verify failed')])")))
What we have already tried: We strongly suspected a Man-in-the-Middle (MITM) SSL interception or a DNS issue, but I have systematically disabled everything on my network to isolate it, and the error persists.
- System Time is Correct: Checked via the template editor (
{{ now() }}); the year and time are perfectly synced, so it is not rejecting an “expired” cert due to a bad clock. - Nginx Proxy Manager (NPM): I run NPM for a separate container (Mealie), but my HA instance is NOT behind it. I completely stopped the NPM add-on anyway, restarted HA Core, and the handshake still failed.
- AdGuard Home: Completely disabled the AdGuard add-on to rule out DNS filtering or blocklists. Still failed.
- BT Smart Hub 2 Interception: Disabled the “Web Protect” and “Smart Setup” features on the BT router, which are known to act as transparent proxies. Still failed.
- IPv6 Disabled: Disabled IPv6 entirely within the HA Network settings to force an IPv4 handshake, bypassing any weird BT Hub IPv6 routing issues. Still failed.
- URLs Configured Correctly: My
internal_urlis correctly set tohttp://192.168.1.10:8123(no.localmisconfigurations). - Fresh Credentials: Deleted and regenerated the Spotify Application Credentials multiple times.
Since I am on HAOS, I shouldn’t have missing CA certificates. If HA is not behind NPM, AdGuard is off, and my router’s security features are disabled, what else could be breaking the outbound TLS trust chain specifically for Spotify?
Is there a specific SSH command I can run in the HA terminal to expose exactly which certificate the system is receiving so I can see who is faking the signature?
Any advanced networking advice would be massively appreciated, I am at an absolute loss and losing the will to live fixing this! I would even be willing to pay!
