Hoping someone has this working or can tell me what I'm missing.
Setup
WiCAN PRO, firmware 6.0.0-beta.5 (v6.0.0p-beta.5)
HA OS 2026.10.4 in a Proxmox VM
Most recent ha-wican integration version
HA internal URL is http://<LAN IP>:8123. External URL is https://ha.mydomain.com, served through a Cloudflare Tunnel.
The WiCAN is on a separate IoT VLAN on UniFi. HA is on a different VLAN, and IoT can't initiate connections to it.
What's happening
The device's webhook stats show OK 0 and a growing Fail count. The URL registered on the device is only the external HTTPS one. I expected the local http URL first, since HA has an internal http URL set. Registration from HA to the device works. The pushes fail on the device side.
Log from the device, with the domain and webhook ID redacted:
I (6145) sta ip: 10.0.3.181, gw: 10.0.3.1
I (7677) rtc_manager: SNTP synced via pool.ntp.org
E (17215) esp-x509-crt-bundle: No matching trusted root certificate found
E (17215) esp-x509-crt-bundle: Failed to verify certificate
E (17216) esp-tls-mbedtls: mbedtls_ssl_handshake returned -0x3000
W (17220) ha_webhooks: webhook POST failed: esp_err=ESP_ERR_HTTP_CONNECT
I (34971) ha_webhooks: webhook updated: https://ha.mydomain.com/api/webhook/<id> (enabled=1)
I (102728) esp-x509-crt-bundle: Certificate validated <- fw_update check to GitHub
So DNS, routing and the clock are fine, and the same device validates GitHub's cert. It only fails on my Cloudflare hostname. I suspect the chain Cloudflare serves is rooted at GTS Root R4, which other ESP32 users report failing with this exact error. I haven't confirmed which CA my cert uses.
What I've tried
Removed and reinstalled the integration, and rebooted the WiCAN
Confirmed the firmware is the newest beta the device offers
Questions
Is there a way to give the HA webhook a custom CA or cert set? The docs mention cert sets for MQTT and HTTPS destinations, but I don't see them for the HA webhook.
Why would the integration register only the external HTTPS URL when an internal http URL is set? Do I need 2.0.0-beta0 or newer for v6?
Is anyone running v6 with the external URL behind Cloudflare? Did you do anything special?
Thanks for the help everyone.
Source: r/wican · by /u/awkward_ardvark