Connecting HA with https

[steigerbalett]

Is it possible to access the RemoteWebViewServer through https?
At the moment I get only: 404: Not Found if I try to access the RemoteWebViewServer at https://${haip}:8123/dashboard-mobile/0

[strange-v]

I hadn’t considered using HTTPS, since it was intended for use inside the home network. What’s your use case?

In theory, it should be possible, but it requires some code changes:

1. Put the server behind a reverse proxy (Nginx/Traefik) with a valid TLS certificate (Let’s Encrypt, etc.).
2. Provide a CA bundle on the ESP and force the client to use TLS.

esp32:
  framework:
    type: esp-idf
    sdkconfig_options:
      CONFIG_MBEDTLS_CERTIFICATE_BUNDLE: y

esp_websocket_client_config_t cfg = {};
cfg.uri = "wss://host:8081/"; 
cfg.transport = WEBSOCKET_TRANSPORT_OVER_SSL;
cfg.crt_bundle_attach = esp_crt_bundle_attach;
...
auto client = esp_websocket_client_init(&cfg);

As I said, this is purely theoretical; I haven’t tried it.

[strange-v]

I've reread your question, and it looks like you are trying to access the HA dashboard over HTTPS, not the RemoteWebViewServer. Am I right?

[steigerbalett]

You are right!
I can open this conversation on the display :-D
So it's not a general https issue, it has to be something more specific.
I have to search for the issue at the server side.
Could you force the RemoteWebViewServer to accept every certificate?

[strange-v]

Are you using a self-signed (private) certificate? By default, headless Chromium won't accept it.

Could you force the RemoteWebViewServer to accept every certificate?

AFAIK, yes, but it isn't the right way. You can make your certificate trusted for the container (not tested, just googled it):

1. Export your CA certificate
   • Use the CA/root certificate in PEM (Base64) form, e.g., my-root-ca.crt.
   • Do not use the leaf/server cert.
2. Copy the CA into the system trust store

   cp my-root-ca.crt /usr/local/share/ca-certificates/
   update-ca-certificates

3. Restart the container

[strange-v]

I may add an option to ignore certificate errors if there’s demand, but it’s a bit odd to force the use of TLS and then accept any certificate without proper validation.

[steigerbalett]

Maybe you could expose /usr/local/share/ca-certificates/ in the HA-AddOn so its easier to copy.
But I have also problems with some letsencrypt certificates - I will try to generate new one ...

[strange-v]

With Let's Encrypt certificates, everything should be fine without any additional tinkering.

Offtopic

I don’t know your setup, but I’ve been using nginx and certbot for a long time. Nginx acts as a reverse proxy that exposes secure (TLS) endpoints to the outside world, and Certbot keeps certificates valid (updated), since they’re quite short-lived — a few months, AFAIR. So Certbot is a must-have option if you’re using Let’s Encrypt certificates.

I then switched to Cloudflare because it hides and protects your public IP. In both cases, locally I access the server directly without any proxies and without TLS, as the fastest option.