Update destroyed my setup - Let's Encrypt to blame; ECDSA option set by update

Third party integrations
1

Out of nowhere my HA setup stopped accepting HTTPS request. Didn’t change anything, only updated to latest.

Let’s Encrypt showed the following in the log;

Are you trying to change the key type of the certificate named mydomain.com from RSA to ECDSA?

After one hour of research it appeard that it was the Let’s Encrypt settings changed without me doing so;

image

Setting it back to RSA, and renewing the certificate fixed the problem.

But as others in this post mention;

A lot of people will be effected by this, as mentioned in the topic on Github is this a breaking change…

Been saying for years now that the guy’s at Home Assistant should incorporate proper certificate management from the GUI of Home Assistant itself. You cannot expect people to setup reverse proxies and as it seems you cannot rely on third party tools like LetsEncrypt. Home Assistant is getting to important to be wrecked by stupid issues like this…

I’m reporting this issue for others to see and hopefully it will get them back online quick again. I’m not asking advice for other products / solutions.

1 Like
2

that you can have a nabu casa subscription so you don’t need to spend time with reverse proxies and certificates. Beside you support the HA devolpment!

3

I would not mind spending money on HA.

But I’m allergic to cloud. The sole reason I picked Home Assistant is not to depend on the cloud.

4

duckdns addon + app on phone work with not issue

5

Making it available via proxy/https is connecting it to the cloud/www!

Not enough!

6

I think using a VPN creates a smaller security hole than using reverse proxy+https. I use Tailscale which is free for up to 3 users.

2 Likes
7

Indeeed! Essentially allowing access to your LAN when abroad without (totally) exposing your server to the cloud/www!

8

I use certificates, but no reverse proxy.
It is often possible to run all encrypted and HA already have the features built-in for this to happend.
I still use Let’s encrypt, but that is just to renew the certificate, which would have to be done with any other CA I could have chosen.

9

Every automated tool, there is another tools to monitor the automated tools.

That why there is healthcheck addons or uptime addons…

I actively monitor my cert from HA/healthcheck/UptimeKuma and alert me when it drop below 30 days.

Regardless, the author already made PR to fix the problem @thanks that. Appreciate it.

Just careful for next few update to make sure it stable. i going to test it from backup HA before going for update for now.

if you need a code to monitor your cert from HA

10

Back to the original point, using RSA isn’t much better than no key at all.
If I were to guess RSA was dropped as the default because it is useless. To ‘fix’ this change the key algorithm to a modern one. Don’t reinstall the RSA speedbump key.

Cracking 256-bit RSA Keys - Surprisingly Simple!.

1 Like
11

RSA and ECDSA have the same security issues. ECDSA can use a smaller key compared to RSA, which RSA just even put by using keys of 4096 bits instead of the EDCSA keysize of 384.
ECDSA is much more complex though, which means the chances of security holes in the implementation of the encryption method is higher.

You might be able to crack the 256bit RSA in 1 minute, but each extra bit will double that, so it will still take you years to crack a 4096bit RSA encryption.

1 Like
12

Kinda unfair to use 256 bit to claim RSA is easily crackable… most modern SSL cert is on 2048 or even higher which still not easily crack…

you cant compare 4 character password with 12 character password and claim 12 character passwords as easy to crack as 4 character password.

13

Anyone placing a certificate with a 256 RSA key on a server deserves to be pwned by an APT.

14

OK, I guess I’m completely wrong. It happens.

RSA Encryption: Definition, Architecture, Benefits & Use | Okta.
Seriously, stop using RSA | Trail of Bits Blog.
What is RSA encryption, and is it safe to use? | NordVPN.
https://www.thesslstore.com/blog/how-secure-is-rsa-in-an-increasingly-connected-world/.
RSA Is Dead — We Just Haven’t Accepted It Yet.

Would you mind contacting these and many more to explain it to them?
This was just some of the first page when I googled it.

Personally I was just trying to guess why RSA was removed as a default, which I’m guessing what happened by your description. I’m not a crypto programming expert at all. I wasn’t looking to get attacked.