I want to be able to use the Android HA app (vs. having to use a web browser to access HA). However, I currently can’t use the App because I don’t have a “real certificate” installed. So because I want to maintain some basic security and I want encryption on all connections to my local networks (HA …

setup your router to ‘spoof’ your domain name, and use let’s encrypt to generate your domain certificate… [image] HTTPS inside LAN | New Version of HA iOS App Installation Yeah, you are right… what I did: added a domain name in my router f.e. assistant.url [image] ad…

What aceindy showed works great, I’ve done it before. That being said it does involve running your own DNS server and using it for every device on your network that needs to talk to HA. Or having a router with a built-in DNS server and the ability to add custom routes. If you don’t have that and do…

I used to use CertBot on windows, and then have any new certificate copied to samba share (task scheduler) worked great. Just don’t need it anymore, as i use the let’sencrypt addon with hairpin now… PS, i also have my own domain, recently moved it to TransIP, as my previous provider wasn’t support…

You don’t need a certificate to use the companion app.

@nickrout We know, but that is what he asked for… [image] slatevt: and I want encryption on all connections to my local networks

If it’s on a local network, what would encryption do?

Since I’m dealing with a IOT Vlan… With a ton of devices from many different sources… An encrypted connection IS important. I personally don’t trust devices to not “phone home” any information it might see on that network. I block them from my main network but they need access to the HA instance. As…

AFAIK WiFi is encrypted if you have a password already. [image] slatevt: I personally don’t trust devices to not “phone home” any information it might see on that network. From a quick search, it sounds like you can’t easily snoop on other devices’ traffic without doing something like arp po…

[image] KTibow: From a quick search, it sounds like you can’t easily snoop on other devices’ traffic without doing something like arp poisoning. Search more. And if that fails then search specifically for wireshark and give it a try.

On the same Vlan there are ways to see the traffic. And again, if you can encrypt you should.

Method to add a real certificate when you don't want your HA instance exposed to the internet?

Configuration

aceindy (Aceindy) July 22, 2022, 7:17pm 2

setup your router to ‘spoof’ your domain name, and use let’s encrypt to generate your domain certificate…

maybe hairpin nat would also work (just bot sure if you need outside port forwarded for the hairpin to work)