Home Assistant serves its web interface over plain HTTP by default. Getting a browser-trusted certificate in front of it takes one of two common approaches, and which one makes sense depends mostly on how you're already running Home Assistant.
Option A: A community ACME add-on (Home Assistant OS / Supervised installs)
If you're running Home Assistant OS or a Supervised install, community add-ons exist (commonly built around Let's Encrypt or DuckDNS-integrated ACME issuance) that request and renew a certificate for you, then hand the resulting cert and key to Home Assistant's built-in HTTP integration via its ssl_certificate and ssl_key configuration keys in configuration.yaml. This path needs a real hostname pointing at your home network (your own domain, or a dynamic-DNS service like DuckDNS) and port forwarding so the ACME challenge on port 80 can complete — the same domain-validation requirement any ACME issuance has.
Option B: A reverse proxy in front (Nginx Proxy Manager, Traefik, Caddy)
If you're already running other Docker services at home, a much more common pattern is putting a reverse proxy in front of Home Assistant that holds the actual certificate and forwards plain HTTP to Home Assistant's internal port. This avoids duplicating certificate management across every self-hosted service you run — one proxy, one certificate/renewal setup, serving all of them by hostname. Home Assistant's own documentation recommends this pattern for anything beyond the simplest local-only setups.
When using a reverse proxy, you'll also want to set http: use_x_forwarded_for: true and list the proxy's internal IP under trusted_proxies in configuration.yaml — without this, Home Assistant sees every request as coming from the proxy's IP rather than the real client, which breaks IP-based access rules and shows inaccurate client addresses in logs.
A managed alternative worth knowing about
Home Assistant Cloud (a paid subscription service from Nabu Casa, the company behind Home Assistant) provides secure remote access without any manual certificate or port-forwarding setup at all, by tunneling through Nabu Casa's own infrastructure. It's outside the scope of a self-hosted-certificate guide, but worth knowing about if the DNS, port-forwarding, and certificate-renewal setup above is more than you want to manage yourself.
Local network access without any of this
None of the above is required just to reach Home Assistant from devices on your own local network — plain HTTP over your local network is a normal, low-risk setup for local-only access. The certificate work described here specifically addresses secure remote access from outside your home network, or wanting a proper hostname and no browser warnings even locally.
Loading comments…