I have my HA implementation chugging along splendidly. I have remote access configured via a NabuCasa subscription however my question was geared toward having local network SSL/TLS.
Searching the internet and the more specifically the forums has left me without a clear answer on how or even if it is possible run local SSL/TLS for my browsers and mobile apps when on my home network.
Is the only real solution to abandon NabuCasa and roll my own remote access to handle the certs that way ?
Any insight you all can provide is greatly appreciated.
The “gotcha” is that the SSL has to be from a legitimate issuer, trusted by all your devices, and has to be for the hostname you’re using to connect to the host with.
There are various ways you can solve this, but if you have any Google Cast devices then you will require your router to support NAT reflection (or you’re going to have to have a setup that allows you block access to Google’s DNS servers at the IP level).
My suggestion would be:
LetsEncrypt or your chosen SSL provider
DuckDNS or any other suitable DNS service
Local DNS server that can also resolve your hostname to the LAN IP
A proxy server to handle the SSL (so that while working on this you don’t break anything)
I think I’m just going to access my HA instance exclusively through NC. My browsers, my mobile apps, etc will just run through NC whether I’m on my local network or not.
Thanks this helped me a lot! I already used LetsEncrypt + DuckDNS + AdGuard Home and the missing piece was local DNS server. I found out about AdGuard Home’s DNS rewrites and it worked perfectly.
Quick question for you - I’m trying to set up local SSL for my Home Assistant server that runs in an IoT VLAN (and 2-way communications to other VLANs on the network isn’t allowed) and I’m trying to determine if I’ll need a proxy manager on each host that needs this solution, a single proxy manager in each VLAN to serve all the hosts on that subnet (in this case, it would be the HomeAssistant server for the IoT VLAN) or a central proxy manager for all VLANs and then I pipe traffic to/from it, accordingly.
I’d also like to enable this local HTTPS/SSL solution for my Unifi management server that sits in another VLAN (and won’t be able to talk to the HA server in the IoT VLAN) so I’m trying to figure out just how many proxy servers I’m going to need and if I need to be prepared to install a proxy server on each and every host needing this functionality or if there is a better way.
At most you need one proxy server (per subnet hosting services you want protected by SSL) - if you want to use proxies. The proxy handles the SSL for the service you’re protecting with SSL, not the clients.
I’m not sure I understand what you’re trying to do though, it sounds like you’ve got an overly complicated setup.
I have a local DNS server, I have the registered domain and I can get the required certificates - I just didn’t understand what the high-level architecture for the Proxy was supposed to look like. Many of the tutorials on YouTube talk about the Proxy like it is locally-installed on the device running the service being proxied for, so I was fearful I’d have to be running proxies everywhere I wanted to utilize this functionality.
My setup isn’t very complex - I run a few different VLANs on my home network (one for security cameras, one for IoT devices, one for sandbox devices) and I firewall them all off from each other. This is my first foray into the Proxy setup (and my first Home Assistant install, as well) so I was getting stumped on an assumption that I didn’t know was valid or not.
That’s typically the case on small setups, just for ease of use. Larger setups and commercial deployments typically run centralised proxy servers.
The flip side is that communication is (usually) only encrypted between the client and the proxy, and not the proxy and the service. There are ways of dealing with that, but running the proxy on the same host as the service is the simplest way.
If the service’s own web server does not allow specifying TLS certificates you can run an additional proxying web server on the host you are running your service. You can run it native or since you probably run your service in an OCI container, just run nginx or caddy along with your service in a compose file with the container orchestration tool of your choice like nerdctl, podman or docker.
That web server you set up to query a certificate authority for a valid certificate so that the traffic on your local network is secured. The CA can be for example Let’s Encrypt, a local Smallstep-CA instance (very neat), or just a long lived certificate issued with a local openssl certificate authority. There is a tool called mkcert to help with this.
To renew the TLS certs I recommend acme.sh as it has few dependencies and easy to manage, and is also in most distro’s repsitories.
After you set up this middle proxy you just point your main reverse proxy to the middle proxy’s exposed port. The middle proxy you point to your service’s web server non-TLS port.
Many self hosted applications can be configured to use custom TLS certificates for the internal web server, so if you issue them with an ACME client or openssl you just point it to the certs using
Hello everyone,
It’s been a long time since anything was posted here, but I still want to try my luck…
I’ve been reading a lot lately because I’d like to have local SSL.
I haven’t found any instructions on how EXACTLY to do this. For example, the most frequently mentioned SSL entry in the configuration.yaml is ‘deprecated’ from version 2027.4 (?)…
My system:
FritzBox 6690 cable (IPv4, which changes and ipv6; has an internal SSL certificate)
Raspberry Pi 4 (HomeAssistant OS Supervisor) → via LAN
Windows 11 PC → via LAN
5-port switch (4 PoL) from tp-link → via LAN
2nd Windows 11 PC → via LAN DuckDNS.org → ID and subdomain ‘paule’ → paule.duckdns.org
HA add-on Let’s Encrypt can be installed if required
Question:
Is there anyone who can explain to me EXACTLY what needs to be done to be able to use SSL locally.