Secure remote access with Cloudflare Tunnel and mTLS

Community Guides
1

This guide explains how to make Home Assistant accessible remotely using a Cloudflare Tunnel and then secure it using mTLS. With this setup, Home Assistant is not simply exposed to the entire internet. Only devices that have a valid client certificate installed can access it.

1. Create a Cloudflare Account

Create a free Cloudflare account.

After creating your account, open Cloudflare Dashboard

2. Buy a Class 1.111B domain

The .xyz Class 1.111B domains ar low-cost numeric domains. They consist of 6- to 9-digit numbers, ranging from 000000.xyz to 999999999.xyz, and were designed to provide affordable and memorable domain names. They cost around $0.85 per year, depending on the current pricing.

In the Cloudflare Dashboard:

  1. Go to Domains.

  2. Click Overview.

  3. Click Add domain.

  4. Select Buy a domain.

  5. Search for a Class 1.111B Domain

    For example:

    123456.xyz

  6. Make sure the domain is available.

  7. Purchase the domain

3. Configure SSL/TLS

Cloudflare’s SSL/TLS settings ensure that connections to your Home Assistant domain are encrypted and always use HTTPS.

1. Configure SSL/TLS

  1. In the Cloudflare Dashboard, select your domain
  2. Got o SSL/TLS → Overview
  3. Click Configure and select: Automatic SSL/TLS (Recommended)
  4. Then click Save.

2. Enable Always Use HTTPS

  1. Go to SSL/TLS → Edge Certificates
  2. Scroll down and enable Always Use HTTPS

4. Install Cloudflared in Home Assistant

We will use the Cloudflared Add-on for Home Assistant to create the Cloudflare Tunnel.

Installation

  1. Open Home Assistant.
  2. Go to Settings → Add-ons → Add-on Store.
  3. Add the Cloudflared repository.
  4. Install the Cloudflared Add-on.
  5. Open the add-on configuration.
  6. Enter the Domain you just bought.
  7. Start the add-on.
  8. After starting the add-on, open its Log.
  9. The log will provide a URL that you need to open in your browser.
  10. Follow the instructions to authenticate with Cloudflare.
  11. The add-on will then create the Cloudflare Tunnel for you.

5. Configure Home Assistant for the Cloudflare Proxy

Home Assistant needs to trust the proxy used by the Cloudflared add-on.

  1. Open: Settings → System → Network

  2. Under HTTP Server, enable: Use X-Forwarded-For

  3. Then add the following network to Trusted Proxies:

    172.30.33.0/24

  4. Restart Home Assistant.

  5. Open Home Assistant and confirm settings.

6. Test the Cloudflare Tunnel

At this point, Home Assistant should be accessible through the hostname you configured.

For example:

https://123456.xyz

However, there is an important security issue: Home Assistant is currently accessible from the entire internet.

We will fix this by using mTLS client certificates.

7. Create an mTLS Client Certificate

With mTLS, Cloudflare can verify whether a device has a valid client certificate. Only devices with a valid certificate will be allowed to access Home Assistant.

  1. Open the Cloudflare Dashboard

  2. Navigate to: Account → Domains → Overview → Your Domain → SSL/TLS → Client Certificates

  3. Click Add certificate

  4. Click Continue

8. Save the Certificate and Private Key

Cloudflare will provide two pieces of information:

  • the client certificate
  • the private key

Save them as two separate files.

For example:

cert.pem

and

key.pem

Important

The private key is sensitive information.

Never share or publish key.pem.

After saving both files, click Continue.

9. Associate the Certificate with Your Hostname

Cloudflare will ask you to select the hostnames that should be associated with the certificate.

Search for your domain and add your Home Assistant hostname.

For example:

123456.xyz

Then click Save.

10. Add a Device Tag

You can use Cloudflare’s certificate tags to identify which certificate belongs to which device.

In the certificate overview, select the certificate and create a new tag.

For example:

Key:

device

Value:

iPhone John

It is recommended to create a separate certificate for each device.
If one of the devices is lost, stolen, or no longer trusted, you can simply revoke that device’s certificate without affecting the certificates used by your other devices.

11. Convert the Certificate to PFX

Browsers and mobile devices generally require the certificate and private key to be packaged together. We can do this using OpenSSL.

  1. Run:

    openssl pkcs12 -export -out client_cert.pfx -inkey key.pem -in cert.pem

  2. OpenSSL will ask you to create a password.

  3. Choose a secure password and do not leave it blank.

  4. You will need this password when importing the certificate onto your device.

  5. The resulting file will be:

    client_cert.pfx

    Keep this file secure.

12. Create the Cloudflare Security Rule

Now we need to tell Cloudflare: Block every request that does not have a valid mTLS client certificate.

  1. Open the Cloudflare Dashboard

  2. Navigate to: Domains → Overview → Your Domain → Security → Security Rules

  3. Create rule → Custom rule

  4. Set the rule name to:

    mTLS-enforced authentication

  5. Click Edit expression and enter:

    ((not cf.tls_client_auth.cert_verified or cf.tls_client_auth.cert_revoked) and http.host eq "123456.xyz")

    Replace 123456.xyz with your own Home Assistant hostname.

  6. For Take action, select: Block

  7. Then click Save

13. Test the Security Rule

Now open your Home Assistant domain from a device that does not have the client certificate installed.

For example:

 https://123456.xyz

Cloudflare should block the request.

You should see a message similar to:

Sorry, you have been blocked.

This confirms that mTLS protection is working.

14. Transfer Certificate on Your Phone

Now securely transfer the .pfx certificate to your phone.

Make sure you transfer it securely and do not send it through an untrusted service.

15. Configure the iPhone Home Assistant Companion App

  1. Open the Home Assistant Companion App on your phone.

  2. Click Settings

  3. Click Companion App

  4. Select your Home Assistant server.

  5. Under External URL, enter your Cloudflare hostname:

    https://123456.xyz

  6. Then find the Client Certificate option and import the .pfx certificate you created earlier.

  7. Enter the certificate password.

  8. The Home Assistant Companion App should now be able to connect through the Cloudflare Tunnel.

Result

With this configuration:

  • Home Assistant is accessible remotely through Cloudflare.
  • You do not need to expose Home Assistant directly to the internet.
  • Cloudflare handles the incoming connection.
  • mTLS verifies the client device.
  • Devices without a valid certificate are blocked.
  • Each device can have its own certificate and device tag.
  • The Home Assistant Companion App can use the certificate for remote access.
2 Likes
2

Excellent guide, worked like a charm!

1 Like