I was unable to access my HA OS install this morning, the web UI giving me the “Unable to connect to Home Assistant” placeholder. Checking the SSL certificate showed that it had expired overnight. The Let’s Encrypt app is supposed to automatically renew, but obviously hadn’t, and annoyingly the HA web UI was stopping me accessing the tools I needed to diagnose and fix the problem.
I rebooted the HAOS VM, hoping that the Let’s Encrypt app would launch and renew the cert, but the problem remained.
I eventually gained access to the web UI by using a Private Browser Window and accepting the expired cert.
Looking at the logs for the Let’s Encrypt app I could see that it was trying and failing to renew. Specifically, it was failing to communicate with the DNS API endpoint (I use DNS01 validation with Mythic Beasts as my DNS provider). Interestingly, the timestamps were wrong. The attempts were logged at 2026-09-02T05:00:19.943+01:00, when I knew it was actually running at around 10:00 (I’m in BST, so UTC+1). This probably explains why the API calls were failing: the local and remote times didn’t match up and the SSL handshake would be failing.
Strangely, though, looking elsewhere in the HA UI I could see events being logged correctly, charts full of data with no gaps. Everything looked fine with respect to time.
So I started the Let’s Encrypt app manually from the HA web UI, and this time it renewed, and the timestamps in the logs were correct.
My system now appears to be working correctly.
Further reading suggests that, “apps” in HA OS run in docker containers. It would appear that the Let’s Encrypt container didn’t sync it’s time correctly when it started, causing it’s SSL negotiation with the Mythic Beasts API endpoints to fail, but for all operations outside of the container to continue to operate correctly.
Why did it fail when the renewal process ran automatically, but succeed when I ran it manually?
Who knows ¯\_(ツ)_/¯