Let's Encrypt for Home Assistant (app)

About

Let's Encrypt is an app that requests and manages TLS certificates from Let's Encrypt for Home Assistant OS. It issues certificates for the domain names and e-mail address given in its configuration, and writes the certificate and private key files to the ssl share. Two validation methods are supported: an HTTP challenge that needs port 80 reachable from the internet, and a DNS challenge that works with supported DNS providers, allows wildcard certificates and needs no open port. A setting for public nameservers helps when renewal fails in split DNS setups. Certificates are created when the app starts, and the app then stops; renewal happens only when it is started again, for example by an automation that restarts it nightly. A force renewal option can replace a certificate regardless of its expiry date.

Automatic summary of the docs and configuration of home-assistant/apps. Something wrong, or are you the maintainer and want your own text here? Get in touch

Supports

Updated with Home Assistant Ships and updates with every Home Assistant release.

Setting it up

Install it under Settings, Apps, then start it.

Permissions

Needs no special permissions.

Network

80/tcpOnly needed for http challenge

Configuration

DomainsThe domain names to issue certificates for, use "*.yourdomain.com" for wildcard certificates.
EmailThe email address that will be registered for the certificate.
Private Key FilePath to where the Private Key File will be placed.
Certificate FilePath to where the Certificate File will be placed.
ChallengeThe type of challenge used to validate the domain.
Custom ACME ServerBy default, this app uses Let's Encrypt's servers. However, you can specify a different ACME server.
ACME Root CA CertificateOnly relevant with a custom ACME server using a certificate signed by an untrusted certificate authority (CA) that requires addition to the trust store.
DNSDNS Provider configuration
Key TypeSelect the certificate key type. If unset, will auto-detect based on the key type of the existing certificate or default to ecdsa.
Elliptic CurveElliptic curve for ECDSA keys. This option must be used with Key Type set to ECDSA. If unset the Certbot default will be used.
Dry RunDo a certbot dry-run for requesting the certificates from Let's Encrypt. This is ignored if a custom server is used.
Issue test certificatesObtain a test certificate from Let's Encrypt staging server. This is ignored if a custom server is used.
Verbose ModeRun certbot in verbose mode.
Force RenewForce certificate renewal even if it is not close to expiry.