Connecting to HA locally using HTTPS

Benjammin · November 30, 2024, 6:44am

This works great! But now I cannot access via my cloudflare tunnel is there a way to overcome this?

petkov_d · December 12, 2024, 7:42am

@kgolding Thanks for the guide. I used it to configure HTTPS in Home Assistant. But I decided to make the setup a little bit more flexible by using root CA which could only be used to sign certificates with permitted DNS names. Here is the guide for anyone who wants to replicate my setup: Creating root CA and enabling HTTPS in HomeAssistant · petkov/homeassistant Wiki · GitHub

galgub · January 31, 2025, 6:03pm

Looking at this long thread, seems that some of us are here due to the need for microphone access. I bypassed the limitation by allowing the browser to access the microphone for my HA only. while some of you will not like it, it does get things up and running.

I’m using Chrome / Brave, so just go here:

brave://flags/#unsafely-treat-insecure-origin-as-secure
or
chrome://flags/#unsafely-treat-insecure-origin-as-secure

write down your IP/local address and refresh HA page and change it to “Enabled”:

now, your microphone can be used:

hope it helps.
Goodluck

Protoncek · January 31, 2025, 7:22pm

Sad thing about enabling this is that each time you open browser shows annoying warning message… (at least in crhrome and edge)

mterry63 · January 31, 2025, 7:39pm

This should be added to the cookbook. Much easier for some people.

pampu · July 8, 2025, 7:43am

Could you explain what kind of configuration the HA appliance is needed the set the certificate and the IP/FQDN for the HTTPS access, please?

retorquere · July 10, 2025, 1:56am

You can set up HA with a proper letsencrypt cert (so no warnings) ~~if your ISP offers you IPv6:~~

ugh that was not smart, works just fine on IPv4, it’s just the rebinding exception that’s needed. You still need to either pin your IP in your modem (plenty modems allow for this), or you can still use this addon for dynamic IPs.

github.com/retorquere/hass_addons

cloudflare_private_ddns_updater/DOCS.md

d5c1f21b4

## DDNS Updater

This addon is used to update a DDNS record pointing inside your home network. You can use this to set up SSL inside your home network:

* Make sure your modem does not expose your internal IPv6 addresses. They will be routable but should be blocked by the firewall of your router.
* Add an AAAA record in your cloudflare DNS config (ag `hass.your.domain`). **DO NOT** enter an A record for this hostname. Set it to non-proxied.
* Install this add-on and configure it (see below).
* Set up letsencrypt for cloudflare in home assistant for `hass.your.domain`
* Add the certs to your `configuration.yaml` (see below)
* Add `hass.your.domain` to your modem DNS rebinding exceptions
* Set `https://hass.your.domain:8123` as your home assistant URL in the network settings

and you now have a proper SSL certificate, no self-sign warnings, no need to install trusted certs

## Configuration

```yaml
config:
  - zone: example.com
    token: <token from cloudflare>

This file has been truncated. show original

slimak · July 19, 2025, 11:08pm

I just set mine up, and it wasn’t too bad. Key elements of my setup:

cheap domain transferred to a free Cloudflare account
Ubiquiti ER-X router
remote access via Wireguard configured as an interface on the router (this is not required in any way - I just use Wireguard and wanted local SSL to work through it as well).

So, I followed this guide, which was fast&easy because I already had a CF account. After completing it, I was able to connect to https://homeassistant (using just the host name). But it didn’t work with full domain, e.g. https://homeassistant.mydomain.com.

So then, I think, there are 2 ways of making the FQDN work.

create a DNS override:

set service dns forwarding options address=/homeassistant.mydomain.com/192.168.X.Y

OR

configure mydomain.com as the local domain for your LAN(s):

set service dhcp-server shared-network-name LAN subnet 192.168.X.0/24 domain-name mydomain.com
set system domain-name mydomain.com
set service dhcp-server use-dnsmasq enable
(enabling dnsmasq seems mandatory, didn't work with default setting)

So DNS override is easier but if you don’t have a domain set up for your LAN (like me), you can choose the second option.

The final step was to enable local SSL through Wireguard on my phone. To do this, I edited the profile using the Wireguard app on my phone and set the address of my router’s Wireguard interface as the DNS server. Also, make sure this IP address is within the range of allowedIPs. The router should also be listening for DNS requests on the Wireguard interface:

set service dns forwarding listen-on wg0

Fuffsucker · August 6, 2025, 12:02am

I followed the instructions here and it seems to have worked just fine. Good luck!

github.com/ouaibe/howto

HomeAssistant/HomeAssistantTrustedSelfSigned.md

master


# HomeAssistant: Trusted Self-Signed Certificates (HA Mobile App + Browser)

#### This is a quick guide on creating self-signed IP-backed certificates for your local HomeAssistant server that are validated by the HA Mobile App and can also be added to browsers.

##### Note that the general guidance is to generate valid domain-backed certificates and regularly update them using Let's Encrypt so use this guide as a last resort.

----


1) Create your own CA
---

On your PC use your already-installed OpenSSL (if not, install it using your preferred distro's package manager).

This will create your root key, so make sure the directory you're working in is not world readable and the PC you're using is somewhat trustworthy.

You will need to chose a CN/Organization Name for your Root CA and for your subsequent certificates.

First, generate key curve parameters, as a curve reference for later OpenSSL commands:

This file has been truncated. show original

Morphy · August 25, 2025, 2:38pm

Hi thanks for your guide!
I was following it ok until I got to the end where it refers to Kevin’s guide on how to install them to HA. The files he’s referred to are .pem however these don’t exist with your guide? Which files am I copying to the certs dir and which are the correct cert and key files? I’m guessing these ones?

http:
  server_port: 443
  ssl_certificate: /config/certs/homeassistant.crt
  ssl_key: /config/certs/homeassistant.key

Also, when I come to install home-network-root-ca.crt on Android it says private key required?

WernerM · August 27, 2025, 3:47pm

Also, Firefox has the option of allowing media access for certain IPs on non ssl connections.
Unfortunately, the popup is hard coded into the UI which is definitely not the right place to do so.

jennib · September 1, 2025, 3:37pm

Thank you. Worked for me.

csnoopy35 · February 21, 2026, 11:13am

Here are the general steps I used to enable HTTPS with a self‑signed certificate:

Generate a Self‑Signed SSL Certificate

I created a directory for storing certificate files, moved into it,
and generated a self‑signed certificate using OpenSSL. The certificate
included the appropriate hostnames or IP addresses for my setup.

Example commands:

sudo mkdir -p /path/to/cert-directory
cd /path/to/cert-directory
sudo openssl req -sha256
-addext ‘subjectAltName = IP:, DNS:’
-newkey rsa:4096 -nodes
-keyout privkey.pem
-x509 -days 365
-out fullchain.pem
-subj ‘/C=/ST=/L=/O=/CN=’

This produced:
- fullchain.pem (certificate)
- privkey.pem (private key)
Add SSL Configuration to Home Assistant

I updated the Home Assistant configuration file to reference the
certificate and key. The SSL settings were added under the HTTP section.

Example command:

sudo sed -i ‘/^http:/a\ ssl_certificate: /fullchain.pem\n ssl_key: /privkey.pem’ /path/to/configuration.yaml

Resulting structure:

http:
ssl_certificate: /fullchain.pem
ssl_key: /privkey.pem
Restart Home Assistant

I restarted Home Assistant through its normal restart option in the
web interface so it would load the updated configuration.

dasku11 · May 2, 2026, 7:08pm

I’ve spent the whole day trying to make this work and I’ve hit a wall. This issue is driving me insane, for now I’m giving up and sticking with unsafe HTTP, which is crazy.

I’m describing the issues below, maybe someone can think of a solution or at least they will be useful to someone one day.

Requirements:

I want to connect to HA via local network, not via the internet. (both client and HA have internet access though, so DNS resolution via the internet would not be a problem in principle)
I need something that works on web (desktop), Android (app), Wear OS (app)

Option 1: Generate self-signed certificate and trust it within the app

This is possible on web but is not possible in the Android app. I could use HA as a PWA but then I would lose Android native features (e.g. widgets) and in any case it would not be an option for Wear OS.

Option 2: Generate self-signed certificate and install it on Android and Wear OS

This option has at least two issues:

It does not work on Wear OS. Wear OS (unlike Android) does not support the installation of user certificates (Wear OS 3 HA companion: private CA is not supported · Issue #3739 · home-assistant/android · GitHub). Apparently there’s no workaround for this (without forking the app).
Installing the self-signed certificate on Android is possible, but has non-trivial security/privacy implications. For example, if the private key is compromised, the attacker could do MitM attacks for any domain. It might be possible to restrict the private key to a specific domain (limiting the MitM risk to that domain), but I haven’t tried if this works and in any case it is complex and not the default OpenSSL behavior when generating the key.

Option 3: Use DuckDNS + Let’s Encrypt, pointing to the local IP

The Duck DNS app does allow to specify a local IP (optional configuration option). And the solution works perfectly on desktop (Linux, any browser).

The problem is that it doesn’t work at all on Android (neither app nor any browser). Most likely Android does something weird when the DNS tries to resolve mydoman.duckdns.org to my local IP. In Chrome I get a DNS_PROBE_FINISHED_NXDOMAIN error, while in the app I get a DNS resolve error. I’ve tried to disable Private DNS Mode in Android settings and in Chrome settings, still nothing (and in any case that would have been an unacceptable tradeoff). I have no idea what the issue is, even Claude is out of solutions at this point.

None of this would be necessary if the Android app and Wear OS app could simply support custom certificates within the app itself, or simply allow the user to manually trust a certificate like any browser does (including on Android).

ddaniel · May 2, 2026, 7:14pm

Option xy:
Use nginx proxy. Create your local domain and issue cert for it. Use it in nginx for ha. Resolve your made_in_home domain back to your own ip using adguard or router dns settings or local dns or server what ever serves you the best.
Volla.

dasku11 · May 3, 2026, 11:06am

Solved it! (via OpenWRT settings)

Master_of_Mouse · May 9, 2026, 1:33pm

Hi, I run Home Assistant OS as a VM in Proxmox.
I also have OPNsense, which manages a wildcard certificate for my lab. The OPNsense acme plugin allows you to upload certificates to a folder via SFTP.

I've been using this successfully for ADGuard, which runs as a container in Proxmox.

What's the cleanest way to add an SFTP server to HA to copy certificates to it for HA access with https?
Only "Home Assistant Community App: Advanced SSH & Web Terminal"?

mterry63 · May 9, 2026, 4:35pm

I would recommend following the "Enable SSH access to the Host" instructions in the Developer docs:

I use the same process to update my Home Assistant certificates under NGINX.

For the "dead simple" version of the same, you can use the Add-on (App) that automates the process described above: 🆕[add-on] HassOS SSH port 22222 Configurator

I find this more useful than the Community App you mentioned as it gives you Host access as well as any docker container running on the host which can be occasionally useful in troubleshooting.