What the heck?! Certificate renewal should be completely transparent to Home Assistant users. Let’s Encrypt already provides the automated renewal infrastructure, so why should we have to build our own monitoring, reminders, restart procedures and recovery automations just to keep HTTPS working?
Home Assistant should ideally handle the entire certificate lifecycle: renewal, installation, reloading and validation — and notify us only when something goes wrong. Users shouldn’t have to become certificate administrators just to run a reliable smart home.
If you aren’t using HA Cloud/Link then how could HA do this? You would need your own domain for LE to validate against, which you’d need to handle yourself including DNS setup for validation of the domain for LE.
If you’re not using your own domain, then HA could only do a self-signed certificate, which is just going to cause warnings and alerts in your browser because self-signed certs aren’t from a trusted CA.
If you’re using HA Cloud/Link, then you shouldn’t need to do anything to handle SSL.
I think I can chip in here.
Yes you would need a custom domain.
There is a mechanism called: DNS-01 challenge, part of the ACME (Automatic Certificate Management Environment) protocol.
This is completely rest API automated.
Then (if implemented) your HA install has its cert renewed automatically every 90 days.
You get a proper cert your browser approves of, not agreeing to the security challenges of HTTP or self signed cert.
Much cleaner, and I was surprised that it wasn’t in the core software, nor that anyone had made a HACS add on or put it together.
Its something I was going to look into, but was put off because HA doesn’t support it out of the box.
Then (if implemented) your HA install has its cert renewed automatically every 90 days.
You get a proper cert your browser approves of, not agreeing to the security challenges of HTTP or self signed cert.
To be able to do this, Home Assistant needs to be able to update your DNS records. Is this basically a request to integrate something like LEGO where you add an API key for your DNS provider so HA can make the required changes?
So, HA could only remove the need for Let’s Encrypt add-on (app) and its associated automation, right? However, neither the DNS settings in the router nor an external DNS provider can be replaced by HA in this context, right? In that case, I still think it’s worth it!
For me, this was a major discovery: that the same domain can be both public and private (in terms of certificates). Very useful. My domain on Cloudflare functions as a public one for my sister’s Home Assistant instance - where things need to be as simple as possible (random_host_name.my-domain.com) - and as a private one for my own installation, using the DNS-01 mechanism.
I used to have https within my LAN using Letsencypt certificates, offered by my Tailscale agent. It was not really ment to encrypt communications, because when a hacker is inside my home network then it is game over anyway.
But it was very convenient because modern browsers require https for a lot of fun stuff: microphone access, camera access, service workers, PWA install, WebRTC,…
It was really useful, e.g. to have a dual-way audio/video call with my doorbell. But I had to ditch Tailscale after all, because it was too complex for my familly to understand. If I would not be around here anymore, they would never be able to keep such a setup up and running. So I switched to a paid Nabu Casa account, which offers https out of the box without any complexity. Works great!!
However when I am at home, I would like my Android companion app to access my HA instance directly via wifi instead of via Nabu Casa cloud/link. Just in case my internet connection would be down, that I at least can keep using HA. Because let’s be honest: HA is all about local usage . But if I do it like that, I end up with a plain old http connection again. So I now always go via Nabu Casa, and when my internet is down I start swearing like a sailor…
So yes it would be nice to have https within the home network, to switch locally and keep everything running.
The IETF seems to recognize this as a legitimate issue for local networks, has a detailed working document covering all the issues on, and is still not to the point of even having an RFC after more than a year.
How would this differ from something like NPM? I haven’t used that app, but I thought the purpose of NPM was to manage updating the certificates in the background.
FWIW, I set this up just now. Well, I set up NPM in a container not as the app. Pretty slick actually. Single click and it fetched the Let’s Encrypt certificate. I used a sub-domain and my DNS returns the local IP and otherwise it goes over the internet – i.e. same URL local or remote.
. But if I do it like that, I end up with a plain old http connection again. So I now always go via Nabu Casa, and when my internet is down I start swearing like a sailor…