Mercedes integration fails with x509: certificate signed by unknown authority (Home Assistant Add-on)

[atursch]

Describe the bug

Environment
evcc version: 0.312.1
Installation: Home Assistant Add-on
Home Assistant Core: 2026.7.3
Home Assistant OS: 18.1
Supervisor: 2026.07.3

Problem

Adding a Mercedes vehicle fails during vehicle creation.

OAuth authentication succeeds and the access/refresh tokens are stored successfully. The failure occurs when evcc tries to retrieve the vehicle list from the Mercedes API.

The following error is logged:

cannot create vehicle type 'mercedes':
cannot get vehicles:
Get "https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles":
tls: failed to verify certificate:
x509: certificate signed by unknown authority
What I tested
Home Assistant Terminal

curl fails with a certificate validation error:

curl -Iv https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles

Result:

SSL certificate verify result:
unable to get local issuer certificate (20)

wget also fails:

wget -S https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles

Result:

ssl_client: SSL_connect
certificate verify failed
DNS / Connectivity

DNS resolution works correctly:

bff.emea-prod.mobilesdk.mercedes-benz.com
108.142.113.26

Network connectivity is working and the server is reachable.

Windows comparison

Running the same curl command from a Windows PC on the same network works without any TLS/certificate errors:

curl -Iv https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles

Result:

HTTP/1.1 405 Method Not Allowed

This is expected because curl sends a HEAD request. The important part is that Windows establishes the TLS connection successfully.

Additional information
Home Assistant OS is fully up to date.
evcc is running the latest stable version (0.312.1).
The CA bundle exists:
/etc/ssl/certs/ca-certificates.crt
System date and time are correct.
The problem is reproducible after restarting Home Assistant.
Expected behavior

The Mercedes vehicle should be detected and added successfully.

Actual behavior

TLS verification fails before evcc can retrieve the vehicle list from the Mercedes API.

Steps to reproduce

1. Install the latest stable evcc Home Assistant add-on (v0.312.1).
2. Open the evcc UI.
3. Add a new vehicle.
4. Select "Mercedes".
5. Enter the Mercedes account credentials / OAuth tokens.
6. Save the vehicle configuration.
7. evcc tries to retrieve the vehicle list from https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles.
8. Vehicle creation fails with:

tls: failed to verify certificate:
x509: certificate signed by unknown authority

Configuration details

Installation:
- Home Assistant OS
- evcc Home Assistant Add-on v0.312.1

Home Assistant:
- Core 2026.7.3
- Supervisor 2026.07.3
- Home Assistant OS 18.1

Vehicle:
- Mercedes EQV 300

Other configured devices:
- Fronius GEN24 inverter
- Fronius Smart Meter
- 2x Fronius Wattpilot (OCPP)

Network:
- Internet connectivity working
- DNS resolution working
- No proxy configured

Additional observations:
- Volvo Connected API works without issues.
- Only the Mercedes integration fails.
- curl and wget executed inside the Home Assistant terminal both fail with certificate verification errors.
- The same curl request from a Windows PC on the same network succeeds without TLS errors.

Log details

[mercedes] DEBUG identity.NewIdentity - database token found

[main] ERROR creating vehicle db:10 failed:
cannot create vehicle type 'template':
cannot create vehicle type 'mercedes':
cannot get vehicles:
Get "https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles":
tls: failed to verify certificate:
x509: certificate signed by unknown authority

Additional verification:

Home Assistant Terminal:

curl -Iv https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles

Result:
SSL certificate verify result:
unable to get local issuer certificate (20)

wget -S https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles

Result:
ssl_client: SSL_connect
certificate verify failed

Windows (same network):

curl -Iv https://bff.emea-prod.mobilesdk.mercedes-benz.com/v2/vehicles

Result:
HTTP/1.1 405 Method Not Allowed

(no TLS/certificate errors)

What type of operating system or environment does evcc run on?

HomeAssistant Add-on

External automation

• I have made sure that no external automation like HomeAssistant or Node-RED is active or accessing any of the mentioned devices when this issue occurs.

Nightly build

• I have verified that the issue is reproducible with the latest nightly build

Version

evcc v0.312.1 (stable)

[github-actions]

Thanks for the very detailed report and testing.

evcc's Mercedes integration (vehicle/mercedes/identity.go, vehicle/mercedes/api.go) uses a plain Go HTTP client with the system's default TLS trust store — there's no custom cert pinning or TLS configuration involved for this API call.

Since curl and wget in the same Home Assistant terminal fail with the exact same x509: certificate signed by unknown authority / unable to get local issuer certificate error, this confirms the problem is not specific to evcc — the underlying system's CA trust store (inside the Home Assistant OS / Add-on container) is missing an intermediate CA certificate needed to validate bff.emea-prod.mobilesdk.mercedes-benz.com's certificate chain. That's why Volvo (different issuing chain) works while Mercedes doesn't, and why the same request succeeds from Windows (which has a more complete/updated root store).

This looks like a container/OS-level certificate trust issue rather than an evcc code defect, so I won't label it bug. Possible next steps on your side:

• Check whether the Home Assistant OS ca-certificates package is up to date (update-ca-certificates or equivalent inside the add-on).
• Verify with openssl s_client -connect bff.emea-prod.mobilesdk.mercedes-benz.com:443 -showcerts which intermediate is being served/missing.
• If the add-on's base image is missing/stale certs, this may need to be raised with the evcc Home Assistant Add-on maintainers (separate repo) rather than here.

If you find that a newer/different intermediate CA is required and it's genuinely missing from common trust stores (not just this container), please share the full certificate chain (openssl s_client ... -showcerts output) so we can take another look.

🤖 Generated with Claude Code

[LeonSol]

I have a native Linux Installation v0.312.1 and can confirm the error. There might be no problem with HA or container. Please check if mercedes did some changes on the login side.

[ReneNulschDE]

I'm working on a fix. Its a problem of the certificate chain on the MB server side. See here for an explanation: ReneNulschDE/mbapi2020#422

[ReneNulschDE]

This should be solved. MB fixed it on the server side.

[LeonSol]

I can confirm this - everything is working fine.

[atursch]

thanks everyone, it is working now.