Bump Tesla Auth API to TLS v1.3 to ensure tokens are valid for owner API

[longzheng]

Fixes #5384

Alternative to #5389 that doesn't require bumping the base image which has armv7 implications

[netlify]

✅ Deploy Preview for teslamate ready!

Name	Link
🔨 Latest commit	71fd554
🔍 Latest deploy log	https://app.netlify.com/projects/teslamate/deploys/6a2d2b711c2afa000861a6e8
😎 Deploy Preview	https://deploy-preview-5390--teslamate.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[CLAassistant]

All committers have signed the CLA.

[kolaCZek]

Will this work? By default, env variable TESLA_AUTH_HOST is not set: https://docs.teslamate.org/docs/installation/docker#instructions

docker compose exec teslamate env

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=4a18261c3e4e
TERM=xterm
DATABASE_PASS= redacted
DATABASE_HOST= redacted
DATABASE_NAME= redacted
DATABASE_USER= redacted
ENCRYPTION_KEY= redacted
MQTT_PASSWORD=redacted
MQTT_HOST= redacted
MQTT_USERNAME= redacted
LANG=C.UTF-8
SRTM_CACHE=/opt/app/.srtm_cache
HOME=/opt/app

[longzheng]

Will this work? By default, env variable TESLA_AUTH_HOST is not set: https://docs.teslamate.org/docs/installation/docker#instructions

docker compose exec teslamate env

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=4a18261c3e4e
TERM=xterm
DATABASE_PASS= redacted
DATABASE_HOST= redacted
DATABASE_NAME= redacted
DATABASE_USER= redacted
ENCRYPTION_KEY= redacted
MQTT_PASSWORD=redacted
MQTT_HOST= redacted
MQTT_USERNAME= redacted
LANG=C.UTF-8
SRTM_CACHE=/opt/app/.srtm_cache
HOME=/opt/app

It's my understanding System.get_env("TESLA_AUTH_HOST", "https://auth.tesla.com") is the pattern for "use TESLA_AUTH_HOST if defined, otherwise fallback to https://auth.tesla.com

[kolaCZek]

Will this work? By default, env variable TESLA_AUTH_HOST is not set: https://docs.teslamate.org/docs/installation/docker#instructions

docker compose exec teslamate env

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=4a18261c3e4e
TERM=xterm
DATABASE_PASS= redacted
DATABASE_HOST= redacted
DATABASE_NAME= redacted
DATABASE_USER= redacted
ENCRYPTION_KEY= redacted
MQTT_PASSWORD=redacted
MQTT_HOST= redacted
MQTT_USERNAME= redacted
LANG=C.UTF-8
SRTM_CACHE=/opt/app/.srtm_cache
HOME=/opt/app

It's my understanding System.get_env("TESLA_AUTH_HOST", "https://auth.tesla.com") is the pattern for "use TESLA_AUTH_HOST if defined, otherwise fallback to https://auth.tesla.com

Aaaah... sorry, my bad. It works...

teslamate  | 2026-06-13 10:47:17.258 [info] Migrations already up
teslamate  | 2026-06-13 10:47:18.605 [info] No tzdata release files found in custom data dir. Copying release file from tzdata priv dir.
teslamate  | 2026-06-13 10:47:18.667 [info] System Info: Erlang/OTP 26 (jit)
teslamate  | 2026-06-13 10:47:18.667 [info] Version: 3.2.0-dev
teslamate  | 2026-06-13 10:47:18.694 [info] PostgreSQL version 17.10 is compatible (17.x series).
teslamate  | 2026-06-13 10:47:18.694 [info] [proxy] read NOMINATIM_PROXY=nil
teslamate  | 2026-06-13 10:47:18.694 [info] [proxy] NOMINATIM_PROXY unset -> fallback: no proxy
teslamate  | 2026-06-13 10:47:19.110 [info] POST https://auth.tesla.com/oauth2/v3/token -> 200 (401.615 ms)
teslamate  | 2026-06-13 10:47:19.111 [info] Refreshed api tokens
teslamate  | 2026-06-13 10:47:19.131 [info] Scheduling token refresh in 6 h
teslamate  | 2026-06-13 10:47:19.160 [info] Running TeslaMateWeb.Endpoint with cowboy 2.15.0 at :::4000 (http)
teslamate  | 2026-06-13 10:47:19.164 [info] Access TeslaMateWeb.Endpoint at http://localhost
teslamate  | 2026-06-13 10:47:19.475 [info] Starting logger for 'Model Y'

[JakobLichterfeld]

Ty for your contribution. However, as this has more implications and possible drawbacks, we close this in favor of #5391

[longzheng]

@JakobLichterfeld I think this patch is still necessary #5399

I also ran into the issue after upgrading to 4.0.0, but if I then force TLS v1.3 it works.

[JakobLichterfeld]

@JakobLichterfeld I think this patch is still necessary #5399

Thanks for your investigation!