SSL Broke My Audio Devices

Configuration
1

My Configuration:

  • Home Assistant OS running on VirtualBox
  • Signed DigiCert SSL Certificate
  • Local DNS to forward FQDN locally
  • Local firewall to forward FQDN from outside using a different port number
  • NoIP for external dynamic IP (Probably unrelated to my issue)
  • Setting System > Network > Home Assistant URL both set to https://ha.mydomain.com:8123

About 6 months ago, I finally got my SSL up and running on my HA. (I purchased the certificate for another purpose, but ended up not for that and repurposed it, so I will switch to Let’s Encrypt once it expires.) I can now access my HA from inside and outside my network perfectly with the app and browser on HTTPS protocol. However, once I got it set up, my HomePods quit working with HA. I get the following error:

Failed to call service media_player/play_media. HTTPSConnectionPool(host='ha.mydomain.com', port=8123): Max retries exceeded with url: /api/tts_proxy/820916028fa53f3f20cee970df32152d7b901714_en-us_4895e0822d_microsoft.mp3 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

unable to get local issuer certificate seems odd to me, since this is not issued locally, but that error may not be saying what I think it is saying.

Related, in troubleshooting, I deactivated the SSL on HA to see to if my HomePods would work again. I also changed the Home Assistant URLs to http://hamachine.localnet.com:8123. The HomePods still didn’t work, though the error was shorter, my MuseLux magically started working, which I have NEVER been able to get to work. I turned the SSL back on and the MuseLux is not working again.

I can only assume I have configured the SSL incorrectly some how, but it is pretty straight forward, and I don’t know what I could have missed. Any advice?

2

You setup certs in HA config http section?

3

Yes, this is my line in the configuration.yaml file:

http:
  ssl_certificate: /ssl/ha.mydomain.com_ssl_certificate.cer
  ssl_key: /ssl/ha.mydomain.com_private_key.key
4

I figured out the problem with the MuseLux (after at least six months and 2 speakers)–rubber duck debugging. I keep my IoT devices that don’t need access to the Internet on a segregated subnet, and although I did configure my firewall correctly to access the HA server, I didn’t NOT configure it correctly to access the DNS. I am not sure why turning off the SSL fixed that, but oh well. Now that I have that sorted, I see lots of MuseLux speakers in my future!

I’d still like to sort the HomePods out though. The HomePods are on the same subnet as the HA server–I tried putting it on a different subnet, but Apple devices don’t really appreciation it.