I have been setting up my hassio configuration for about two months now and kept it local on my LAN. The whole certificate security seemed a bit daunting. When the new process of just using the duckdns add-on was presented, I thought now is the time. I thought I did it right but it did not work. If I ping mything.duckdns.org, it resolves to my WAN address correctly. If I enter my WAN address in the browser with default 80 port, it goes to my router. If I try port 443 or 8123, it fails to connect. The home assist log file shown normal operationof home control but no mention of connect errors. I understand this does not require port forwarding (how is that possible?). But I have tried everything I could think of with my TP-Link C7 router port forwarding of 443 to 8123, 8123 to 8123, 80 to 80, 443 to 433, and nothing forwarded. None of that worked. I read one instruction that daid access is not possible on your own network but only from external networks. I did not try it from an external network. But if that is true, how would I access hassio panel at home? As you can see, I sure need some help on this. Any help would be greatly appreciated. 
From my hassio & duckdns setup, I just installed the duckdns add-on and configured it as in the instructions. I didn’t need to add any port forwards to my router.
I was surprised how easy it was. It just worked !
I’m aware some people get caught out by installing both the duckdns and let’s encrypt add-ons, when the second is not required.
If on Hassio, just the duckdns add-on will add encryption.
I just looked at my duckdns add-on log and it shows everything fine and certificate good until June. Still dead in the water. When you log in at home, do you use ‘https://yoursomething.duckdns.org:8123’ ? I really can not see how anything can get through from the WAN without some port forwarding to an internal IP. Do you have any port forwarded to your hassio IP? If someone can explain, I would appreciate that very much.
No I use the http://hassio.local:8123/ URL when at home. You do need to port forward. Try following the second section of these instructions: https://www.reddit.com/r/homeassistant/comments/7f5nhw/newbies_guide_to_configuring_hassio_on_a_pi3_for/
You most definitely do need to port forward or it won’t work for the reason you started.
Internally it will be https://hassio.local:8123 or https:/your-pi’s-ip:8123, now the ‘s’.
How many current posts have we got asking exactly the same question now 
ik this is from forever ago but worth a shot, cannot get this setup either on a tp link archer a7, did you ever get ti figured out?
thanks