Having always run Home Assistant within my home network, and never really needing to access it from outside of that, I have always run it as HTTP rather than HTTPS, and never had any issues. On the very odd occasion where I have needed to access it from outside of my network, I have simply used a VPN to my router to gain access, which has worked fine.
A while ago I noticed issues with trying to set up my ESP32 devices, and now think this is due to the HTTPS requirement, so my question is, do I really need to set up as HTTPS to achieve everything gong forward?
I don’t really understand the setting up of the certificates etc., so any basic help / explanation of doing this would be very helpful. I do have some domain names registered that I can use, and guess that I would need to assign a sub-domain for use with Home Assistant, then set-up firewall rules to allow certain traffic through to my Home Assistant instance that runs on an Intel NUC.
I have done some searches regarding all of the above, but am still confused with regards to my particular setup / situation, which I thought was fairly typical. I have installed, but not configured Let’s Encrypt, as I do not fully understand the configuration, so maybe need a real idiots guide.
If you were trying to flash firmware to an ESP device using the ESPHome app, with the device plugged into a different computer than the server, that does require a secure connection. But that requirement is coming from the the Webserial protocol, not HA. (brdraco gave an explanation of this in a previous thread)
There are a number of other options to flash ESPHome devices…
Plug the device into the server instead.
Install the ESPHome desktop app on the computer you will be using to flash devices.
Prep the device for first use using ESPHome Web, then use OTA after that.
Thank you very much for your suggestions - I hadn’t though about simply plugging the ESP device into my HA Server - I will certainly give that a go to see if it gets me around my current issues.
While not a ‘requirement’ if you are exposing to the internet, those connections really need to be secured to/from the world at large or expect peril.
Within your home, whatever level of complexity you would like is up to you.
Just to put it in perspective how important SSL is should you expose your HA (or any service for the matter) to the internet - Without it, nefarious actors (nowadays the bots they deploy) will snoop your data during transmission. It protects you from MITM (man-in-the-middle) attacks that would steal things like your passwords, form contents, credit card numbers, and messages.
It is probably very confusing for people that doesn’t work in it this http/https question on local network.
Do you need https on local network ?
No. But this comes with a big maybe. If you set up your local network like a fort knox that you do not need it. And that is probably not the case.
Why would or should you need it?
Well because if anyone access your local network it/he/she can see everything travelling your network including usernames and passwords because all data is sent unencrypted. Including devices that we all put in our local network that works over cloud.
And this is big reason why people should use https over local network.
Do not assume that your network is bullet proof because it probably isn’t.
Https will just add one layer of security but definitely it isn’t all around solution for local network security.
That’s a fair point, but adding HTTPS (and associated real SSL certs vs self-signed) is a very low return investment compared to proper use of your firewall, VPN’s, etc.
I think OHF has done a horrible job of the companion (at least android) and how the whole home vs. away works, since it wrecks havoc with many aspects of people who want to legitimately use a VPN, and shifts people more to non-VPN access. I would argue that a properly secured VPN gains you a LOT more than the nabu casa route - secure access to things NOT in HA for example, like NVR’s, or anything else local to your home. No possibility that someone hacks Nabu Casa and gains access to everyone’s system remotely. There’s a lot of hubris with OHF in assuming everyone wants HA to work in the same fashion, on a single LAN for example, and making it overly complicated for people to break out of those molds.
Thank you very much for everyone’s time and thoughts above to reply to my issues.
So, I guess what I should do is to use https on my local network, just to be on the safe side. I have looked briefly into this, but I will admit that I haven’t fully understood the setup of this, which is why I haven’t done it as yet. If anyone has any links to a very basic guide for setting it up, with explanations of how and why things are done, would again be very much appreciated.
Well if you plan to use your own certs there is a good gui for that including some basic info.
You can check this here.
I’m using ha in docker compose and all addons are different docker containers.
In brief I set up nginx, create my certs for my containers and told my router to resolve that domain back to my local comp.
But as others pointed out there is a lot more to it then just adding https to your local services or routers on your local network. This is just one layer but there are others that are probably more important like having a good firewall that is properly configured etc no to go any deeper.
Thank you for your insight - I will take a look at creating certificates.
Out of interest, what would you deem as being a good firewall? I currently have a Draytek Vigor 2860 router, but was thinking about replacing this with a Bananapi device running OpenWrt, but don’t know if this is the best way forward, or if it is just opening up a whole new can of worms?
I understand that everyone’s situations are different, but getting an idea of what others do helps to decide how to move forward.
After a lot of thinking and checking things out I went with following config.
Opnsense as a gateway, firewall, dhcp, intrusion detection etc.
For local network I went with Openwrt routers running batman-adv in hybrid mode. I use flint 2 as server node connected with linksys mx4300 over moca adapters. Linksys mx4300 is then spreading wifi mesh network to other routers in and outside house.
I even run outdoor reolink 830A ip camera over mesh wifi.
As banana goes, I have it, but it is a bit expensive and you have to assemble it by yourself. Maybe better is to use flint 2. If you gonna use routers for mesh wifi you will need 3 band router like linksys mx4300 that have enough memory and power to do so. Avoid linksys mx4200 with 512mb of ram. They are good but will struggle if using all 3 radios.
This config is not for everyone. It has obvious disadvantages. You will have to put a lot of work and a time in it.
But it also has some major advantages that you can’t just go and buy in local it store.
It is completely local, no cloud needed for anything, it is running on opensource software and imho it is much more powerful than anything you can buy except maybe professional equipment that is out of this scope.