SSL certificate for localhost using Lets Encrypt and duckdns

[champagj (JF Champagne)]

I have successfully migrated from Home Assistant Cloud (sorry Nabu Casa) to managing local SSL certificate using the Lets Encrypt and DuckDNS add-ons.

I am not an IT pro but I have a good understanding of networking and my recommendation is that if you are not comfortable with networking, the Nabu Casa option is worth the price and headaches.

I still have a few issues and discussion items for the community:

I elected to open a random port routed to the HA as opposed to 443 as I believe it would be a bigger security risk. I also feared it would interfere with remote access on my UDM-Pro. I found out this will still work for Google integration but not Alexa.

How to I handled local traffic with SSL? the local url does connect https://homeassistant.local:8123 but with security error. I can use the external url on the local lan and it works but do I understand it needs to resolve externally to
duckdns ?

I need a local SSL cert? self-signed certificate? Thats outside my knowledge base.

Any insights would be greatly appreciated.

[aceindy]

That is because your SSL certificate does not match with the FQN homeassistent.local.
All you need to do is to set your SSL certificate’s dns name in your local dns server (=router)

HTTPS inside LAN | New Version of HA iOS App

Yeah, you are right… what I did: added a domain name in my router f.e. assistant.url [image] added a lease for HA on it’s IP f.e. 192.168.100.100 and gave it a name f.e. home [image] After that, your router should be able to resolve home.assistant.url as the reserved IP (home.assistant.url should equal your qualified https dns name )

so the URL for external (https:/home.assistant.url) and internal (https:/home.assistant.url:8123) are both the same (except for the port), and SSL certificate is valid agian.

If you want to get rid of :8123, configure hairpin NAT (which is not recommended, but for local use pretty safe)

Router to do NAT hairpinning

Before i used hairpin loopback nat, i used a dns solution on my EdgeRouterX. The only difference between dns solution and hairpin loopback is that on my local network i needed to add :8123 on my local address… How? On my router: DNS configured to use my domain name synology.me as FQDN locally DHCP reservation for myHA at 192.168.1.2 So when querying myha.synology.me locally it will resolve into 192.168.1.2, but since ha is listening on 8123 and there is nothing in between my local client a…

[champagj (JF Champagne)]

Thanks for the quick feedback and guidance.
I’ll probably have to do a bit of trial and error since I have all my IoT on a VLAN on my UDM Pro. When using my browser I am on a separate VLAN. I suspect DNS resolution is done at the VLAN level… Anyway, I have something to explore.

Thanks,