How can I use a Let's Encrypt certificate for local MQTT TLS in HAOS?

Configuration
1

I have registered a domain name iot.xxx.io.vn (xxx replaced with my actual domain name) and I am running Home Assistant OS (HAOS) in VMware.

I obtained a Let’s Encrypt certificate using the DNS challenge method with the TXT record:

_acme-challenge.iot.xxx.io.vn

After the certificate was issued, I received the following files:

  • fullchain.pem
  • privkey.pem

Using the File Editor add-on, I copied these files into the Home Assistant root directory, so HAOS sees them as:

  • /homeassistant/fullchain.pem
  • /homeassistant/privkey.pem

On my local network, I configured my local DNS server so that iot.xxx.io.vn resolves to the local IP address of my HAOS server. My goal is to allow clients on the LAN to use HTTPS without requiring an Internet connection while still using a certificate issued by Let’s Encrypt.

This works correctly:

https://iot.xxx.io.vn:8123 → 192.168.1.155:8123

However, the Mosquitto MQTT broker cannot start TLS on port 8883.

My understanding is that Mosquitto does not accept the certificate files located at:

  • /homeassistant/fullchain.pem
  • /homeassistant/privkey.pem

because they are not in the location expected by the Mosquitto add-on.

Since I am using Home Assistant OS, I cannot manually copy these files into the Mosquitto add-on’s internal filesystem.

My questions are:

  1. How can I make the Mosquitto broker use my locally stored Let’s Encrypt certificate?
  2. Is there a supported way for the Mosquitto add-on in HAOS to use certificates stored in /homeassistant/?
  3. Is there any recommended method to run MQTT over TLS/SSL on a local network using a Let’s Encrypt certificate in Home Assistant OS?

Any advice would be greatly appreciated.

2

image
image648×106 3.54 KB

image

3

Thank you for your reply.

I understand that the certificate files are supposed to be stored in /ssl/fullchain.pem and /ssl/privkey.pem .

However, I am using Home Assistant OS (HAOS) , not Home Assistant Container or Supervised. In HAOS, the underlying operating system is locked down, and I don’t know how to copy my existing certificate files into the /ssl directory. The File Editor add-on only gives me access to /homeassistant , not the hidden system directories.

Could you please explain the correct way to place an existing Let’s Encrypt certificate into /ssl on HAOS? Is there a supported method to import an externally generated certificate into that directory?

Thank you.

4

As you are using HAOS use the LetsEncrypt app/add-on. It makes it easy:

5

Thank you for the suggestion.

I am already familiar with the Let’s Encrypt add-on and have used it before.

However, that approach requires either:

  • forwarding (NAT) port 80 from the Internet to the HAOS VM, or
  • configuring a reverse proxy to forward the domain to port 80 on the HAOS VM.

My setup is different. I use another Linux virtual machine to obtain the Let’s Encrypt certificate (via the DNS challenge), which gives me fullchain.pem and privkey.pem . Getting the certificate this way is much simpler for my environment.

My question is why I cannot simply copy these valid .pem files into HAOS and have the Mosquitto add-on use them. Is there a supported way to import an existing Let’s Encrypt certificate into the HAOS Mosquitto add-on, instead of generating the certificate directly from the Let’s Encrypt add-on?

That is the part I am trying to understand.

6

Then this part of those instructions is relevant:

You can in addition find the files via the Samba app within the “ssl” share.

Use the Samba app to pur your files there. Or the SSH Web terminal app.

7

You are using the wrong tool, File Editor. You are in the Home Assistant core container and cannot access the host filesystem. The File Editor app only exposes /config and /homeassistant folders because they are inside the core container with File Editor.

Install the Advanced SSH & Web Terminal app. Then from a PC on the local network, SSH into the host. Here you can see the host folders like /ssl, /etc, /mnt.

8

If you setup the SAMBA App, you can access the base folders that rest with the config folder as a network share, including the ssl folder.

networkshareha
networkshareha760×679 39.6 KB

9

Wow there’s a loud echo in here.

10

Thank you all for your help and clear explanations!

I was mistakenly trying to use the File Editor add-on, not realizing that it only has access to the Home Assistant container and not the host filesystem.

Now I understand that I need to use either the Samba add-on to copy the certificate files into the ssl share, or the Advanced SSH & Web Terminal add-on to access the host filesystem directly.

Your explanations helped me understand the difference between the Home Assistant container and the HAOS host filesystem. I really appreciate everyone’s patience and assistance. Thank you!

mqtttls
mqtttls1038×729 52.1 KB

11

For anyone else reading this in the future, this is only true for the default settings of the File Editor app.
There is an option in the App Config tab called enforce_basepath which is enabled by default. Simply switch it off and you’ll have access to all folders, including SSL:
image

image
image503×1103 17.4 KB

Disclaimer: Here be Dragons. Switch the setting back off once you’re done. There are files here which can do some massive damage to your system if they are messed with.

12

:laughing:

13

Note that besides the actual HA ones, “/homeassistant”, “/ssl”, … the rest of the files belong to the File app container, so not that much risks, actually.