ThisCalculator

Everyday

HTTPS for Home Assistant: Setup Guide

Updated · Standard formula, shown below

HTTPS for Home Assistant: Setup Guide

This guide walks you through setting up HTTPS for your Home Assistant instance, so your dashboard and API traffic are encrypted. You’ll get a valid certificate from Let’s Encrypt, configure Home Assistant to use it, and set up automatic renewal. You’ll need a domain name pointing to your Home Assistant, and either a publicly reachable port or a reverse proxy.

What You’ll Need

  • A domain name (e.g., home.example.com) with DNS pointing to your Home Assistant’s public IP or a dynamic DNS service.
  • Port 80 and 443 reachable from the internet (or a reverse proxy that handles this).
  • Home Assistant OS, Supervised, or Container installation with access to the command line and configuration files.
  • Basic familiarity with SSH or the terminal, and editing YAML files.

Step-by-Step

  1. Set up a domain and DNS. If you don’t have a domain, get one from a registrar and create an A record (or AAAA for IPv6) pointing to your public IP. If your IP changes, use a dynamic DNS service like DuckDNS (free) and install the DuckDNS add-on in Home Assistant.
  2. Open ports on your router. Forward external port 80 and 443 to your Home Assistant’s internal IP (e.g., 192.168.1.10). Note: If you already use a reverse proxy like Nginx Proxy Manager, point those ports to the proxy instead.
  3. Install the Let’s Encrypt add-on (Home Assistant OS/Supervised). In Settings → Add-ons → Add-on Store, search for “Let’s Encryptâ€� and install it. If you’re using Docker (container install), skip to step 5.
  4. Configure the Let’s Encrypt add-on. In the add-on’s Configuration tab, set your email, domain(s), and choose the challenge type: use “httpâ€� if port 80 is forwarded directly to Home Assistant, or “dnsâ€� if you need a DNS-based challenge (e.g., for DuckDNS). For DuckDNS, use the “dnsâ€� challenge with your DuckDNS token. Save and start the add-on. It will create certificates in /ssl/.
  5. For Docker (container) installs: Install certbot on the host, then run a command like:
    certbot certonly --standalone -d home.example.com --email you@example.com --agree-tos -n
    This creates certificates in /etc/letsencrypt/live/home.example.com/. Make sure port 80 is free during this (stop Home Assistant temporarily if needed).
  6. Edit your Home Assistant configuration. Open configuration.yaml and add or modify the http section:
http:
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem

For Docker, use the paths like /etc/letsencrypt/live/home.example.com/fullchain.pem and privkey.pem (you’ll need to mount the directory into the container). Save the file.

  1. Restart Home Assistant. Go to Settings → System → Restart, or run ha core restart from SSH. After restart, access your instance via https://home.example.com – you should see a padlock icon.
  2. Set up automatic renewal. The Let’s Encrypt add-on renews automatically. For Docker, add a cron job: 0 3 * * * certbot renew --quiet --deploy-hook "docker restart homeassistant" (adjust container name).
  3. Optional: Redirect HTTP to HTTPS. To force HTTPS, in configuration.yaml add http: use_x_forwarded_for: true and trusted_proxies if behind a proxy; otherwise, use a reverse proxy to redirect port 80 to 443.

Common Mistakes

  • Port 80 not forwarded: Let’s Encrypt HTTP challenge requires port 80 reachable from the internet. If it’s blocked, the certificate issuance fails.
  • Wrong certificate paths: Home Assistant expects the certificate files in the /ssl directory (for add-ons). If you point to the wrong path, the service won’t start.
  • Using an IP address instead of a domain: Let’s Encrypt does not issue certificates for bare IPs. You must use a domain name.
  • Forgetting to restart after config change: Home Assistant does not apply SSL changes automatically; a restart is required.
  • DNS not propagated: If you just changed DNS, wait a few hours or check with nslookup before attempting certificate issuance.

Tips

  • Use a reverse proxy like Nginx Proxy Manager or Traefik if you have multiple services; it simplifies certificate management and lets you keep Home Assistant on a local port.
  • For DuckDNS, the add-on automatically updates your IP and handles certificates, making it the easiest option for dynamic IPs.
  • Test your certificate with an online checker or openssl s_client -connect home.example.com:443 to verify the chain.
  • Keep your Home Assistant and add-ons updated to ensure compatibility with the latest TLS standards.

Troubleshooting

  • Certificate issuance fails with “Invalid responseâ€�: Check that port 80 is open and that your domain resolves to the correct IP. Also, ensure no other service is using port 80 on your Home Assistant.
  • Home Assistant won’t start after adding SSL: Check the log for errors like “File not foundâ€� – verify the certificate paths. If the files are missing, re-run the Let’s Encrypt add-on or certbot.
  • Browser shows “Not secureâ€� or certificate error: This usually means the certificate is for a different domain, or it has expired. Check the certificate’s subject and validity dates.
  • Renewal fails: For the add-on, check the add-on’s log. For Docker, ensure the cron job runs and that certbot can write to the directory. Also, verify port 80 is free during renewal.
  • HTTPS works locally but not externally: Check your router’s port forwarding and firewall. Also, ensure your ISP is not blocking ports 80/443 (some do). Try using a non-standard port for external access, but then you’ll need to adjust the certificate challenge.

Frequently Asked Questions

Can I use a self-signed certificate instead?

Yes, but browsers will show a warning, and it’s not recommended for remote access. Let’s Encrypt is free and trusted.

Do I need to open port 443 as well?

Yes, port 443 is the standard HTTPS port. You must forward it to Home Assistant (or your reverse proxy).

What if my IP changes often?

Use a dynamic DNS service like DuckDNS or a domain with a dynamic DNS client. The Let’s Encrypt add-on can handle DNS challenges automatically.

Can I use HTTPS with the Nabu Casa cloud?

Nabu Casa already provides a secure remote access URL, so you don’t need to set up your own HTTPS for remote access, but you can still add it for local network use.

How long does the certificate last?

Let’s Encrypt certificates are valid for 90 days. The add-on or cron job renews them automatically, so you don’t need to worry.

What if I want to use a different port than 443?

You can, but then you’d need to include the port in the URL (e.g., https://home.example.com:8443). The certificate still works, but you must forward that port.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.