Recommended Free Tools
The safest way to reach Home Assistant away from home is to choose one of four architectures: Home Assistant Cloud for the least setup, DuckDNS with a Let’s Encrypt certificate and an NGINX reverse proxy for a self-hosted HTTPS endpoint, direct TLS in Home Assistant, or a VPN/SSH tunnel that keeps Home Assistant private. Do not simply forward Home Assistant’s port to the internet. Use the procedure below that matches your router, ISP and tolerance for maintenance.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What HTTPS changes in Home Assistant
Home Assistant normally serves its web interface on your local network. HTTPS adds encryption and server identity to the connection, so credentials, dashboard data and commands are protected while traveling between your browser or Companion app and your home.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →HTTPS is not a single Home Assistant setting. It is an access architecture. A cloud tunnel can publish a protected endpoint without accepting inbound connections at your router; a reverse proxy can terminate HTTPS before forwarding traffic to Home Assistant; Home Assistant itself can terminate TLS; or a VPN can make your remote device behave as though it is on your home network.
Home Assistant’s securing guidance puts the decision plainly: “If you want to reach Home Assistant from outside your home network, set up a secure method for remote access rather than exposing it directly to the internet.” An open router port is only a path to your network, not encryption or authentication.
#1 Best Overall
- Home Assistant provides a professional and reliable platform for home automation, designed to run continuously 24/7.
- Powered by a 64-bit Quad-Core Cortex-A53 processor, delivering smooth and efficient performance for smart home automations.
- Includes 4GB SDRAM for reliable multitasking and 64GB eMMC
- Features a Mali-450 MP2 GPU for responsive visual interfaces, housed in a compact 85 × 85 × 15mm (3.35" × 3.35" × 0.59") design that fits easily in any space.
- Typical power consumption is under 10W, with fanless operation for quiet performance suitable for any room in your home.
Choose an access architecture first
| Method | Setup effort | Router port exposed? | Certificate and proxy maintenance | Works with CG-NAT? | Best fit |
|---|---|---|---|---|---|
| Home Assistant Cloud | Lowest; enable remote access in the Home Assistant interface | No | Handled by the service; no manual certificate or reverse-proxy configuration | Yes, because it does not require an inbound connection | Most households that want reliable remote access without networking work |
| DuckDNS + Let’s Encrypt + NGINX | Moderate; DNS, certificate app, proxy app, YAML and port forwarding | Normally TCP 443 to the proxy | You must keep the DNS app, certificate renewal and proxy configuration healthy | Usually no; inbound forwarding is blocked by CG-NAT | Self-hosters who want their own hostname and a conventional HTTPS stack |
| Direct TLS in Home Assistant | Moderate; certificate paths and HTTP settings are configured in YAML | Normally a forwarded HTTPS port to Home Assistant | Home Assistant handles TLS, but you remain responsible for certificate files and renewal | Usually no | Installations that do not need a separate reverse proxy |
| VPN or SSH tunnel | Moderate to high; install and maintain a private tunnel on every remote device | No public Home Assistant port; the tunnel endpoint may need access | No public web certificate is required for the Home Assistant connection | Often, depending on the VPN service and topology | Users who want Home Assistant private and are comfortable connecting a VPN first |
Home Assistant Cloud’s remote-access documentation describes the practical advantage: “Home Assistant Cloud gives you remote access to your Home Assistant from anywhere, without opening any ports on your router and without exposing your home network to the internet.” It is the shortest path if you do not want to operate DNS, certificates and a proxy. A subscription is required; the current price is not specified here.
DuckDNS is a free dynamic-DNS service that gives you a custom subdomain under duckdns.org. It solves the changing-public-IP problem and, together with Let’s Encrypt, supplies a trusted certificate. NGINX then accepts HTTPS and forwards the request to Home Assistant.
Direct TLS removes the proxy layer, but it does not remove the need for a public name, certificate renewal and a router rule if you want direct internet access. A VPN or SSH tunnel is different: it provides private network reachability rather than publishing Home Assistant as a public website.
Prerequisites and decisions before you begin
- Know whether your ISP gives your router a real public IPv4 address. Carrier-grade NAT (CG-NAT) places several customers behind one public address and normally prevents unsolicited inbound port forwarding.
- Make sure you can administer the Home Assistant installation, router and DNS or VPN service you choose.
- Decide whether your remote devices will use the Home Assistant Companion app, a browser, or both. The app’s external URL must be updated whenever the public hostname or port changes.
- Back up your Home Assistant configuration before changing
configuration.yamlor the HTTP integration. - Use a strong Home Assistant password and enable multi-factor authentication for accounts that support it. Remote HTTPS does not replace account security.
Find Home Assistant’s current local port at Settings > System > Network. The internal default is commonly 8123, but use the value shown by your installation rather than assuming it.
Option 1: Home Assistant Cloud
Cloud is the recommended starting point when your priority is a working remote connection with minimal maintenance. It avoids router port forwarding and manual certificate setup, which also makes it suitable when your ISP uses CG-NAT.
Rank #2
- Custom fit design provides a snug and secure hold for your compatible with Home Assistant Green, ensuring stability and easy access at eye level.
- Space-saving wall installation helps declutter surfaces by moving your smart home hub off counters and onto the wall for a cleaner setup.
- Durable construction crafted for reliable long-term use with quick and straightforward mounting on various wall surfaces.
- Sleek minimalist style complements modern home aesthetics while keeping ports and displays accessible.
- This product is a third-party accessory designed to be compatible with Home Assistant. Our products are not affiliated with, authorized, or endorsed by it and are mentioned for compatibility purposes only.
- Open Home Assistant and go to the Cloud area in Settings.
- Start or activate the Home Assistant Cloud trial or subscription, following the current prompts.
- Enable the remote-access option. The service generates an encrypted remote URL for your instance.
- Open that URL from a device using cellular data or another network outside your home. Do not use the same Wi-Fi network for this first test.
- In the Companion app, set the generated address as the external URL if the app does not pick it up automatically.
No router port is opened in this design, and you do not copy certificate files into Home Assistant. If the cloud URL works but the app does not, check the app’s internal and external URL fields and sign in again. If the cloud connection itself cannot be established, verify that Home Assistant has working outbound internet access and that the subscription is active.
Option 2: DuckDNS, Let’s Encrypt and an NGINX reverse proxy
This is the standard self-hosted HTTPS pattern. DuckDNS gives you a stable name, the DuckDNS app obtains and renews a Let’s Encrypt certificate, and an NGINX Home Assistant SSL proxy terminates TLS. Home Assistant receives proxied traffic on its internal HTTP port.
1. Create the DuckDNS name
Register a DuckDNS subdomain and point it to your router’s current public IP address. Record the DuckDNS token; the Home Assistant app needs it to update the address and request certificates. If your public IP changes, the app must continue updating the DNS record.
2. Install and configure the DuckDNS app
- In Home Assistant, open Settings > Apps. The exact menu label can vary by Home Assistant release.
- Install the DuckDNS app.
- Enter the DuckDNS domain without the protocol, supply the token, and accept the Let’s Encrypt terms as requested by the app.
- Start the app and inspect its log. A successful setup normally creates
/ssl/fullchain.pemand/ssl/privkey.pem.
fullchain.pem contains the server certificate and its chain; privkey.pem is the matching private key. Treat the key as a secret and do not paste it into support forums or commit it to a repository.
3. Install the NGINX proxy app
- From Settings > Apps, install NGINX Home Assistant SSL proxy.
- Open the app’s configuration panel.
- Set
domainto the fully qualified DuckDNS name, such asyour-name.duckdns.org. - Set
certfiletofullchain.pemandkeyfiletoprivkey.pem. - Save the configuration, but do not expose Home Assistant’s internal port directly on the router.
The proxy reads the certificate files from the shared /ssl location and listens for HTTPS. Certificate renewal is performed by the DuckDNS app; restart or reload the proxy if its log indicates that it has not picked up a renewed certificate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Multi-Protocol Hub with Matter Bridge] The Aqara Hub M200 is a versatile smart hub that supports multiple advanced features, acting as a Matter Controller, Thread Border Router, and Matter Bridge. It integrates third-party devices into the Aqara Home app. With advanced Matter bridging functionality, it syncs Aqara-exclusive features with ecosystems like Home Assistant, Apple HomeKit, Alexa, and Google Home for seamless integration. Supports up to 40 Aqara Zigbee devices and 40 Thread devices.
- [Smart IR Blaster with Feedback and Learning] The 360°IR blaster not only sends commands but also provides accurate status updates by detecting traditional remote use. It connects IR air conditioning units to Matter, functioning as an AC thermostat when paired with an Aqara Temperature and Humidity Sensor. (Note: Only one AC device can be exposed to Matter. Functionality may vary based on the Matter integration app. For Apple Home exposure, use Matter integration instead of HomeKit.)
- [Wired & Wireless Connectivity with PoE Support] Enjoy flexible setup with dual-band Wi-Fi (2.4/5 GHz) using advanced WPA3 security, and Power over Ethernet (PoE), making the M200 a versatile PoE Ethernet Smart Home Hub. The USB-C port supports mini-UPS or power bank connections for uninterrupted operation, ensuring your energy-saving and security automations stay online. (*2A USB power adapter is not included. )
- [Home Automation and Alarm System] Works with all Aqara devices to create a comprehensive, smart home automation system. The Aqara Hub M200 is equipped with a built-in speaker that can be used in a variety of ways: security alerts, doorbell, alarm clock, and custom audio messages. (** 𝐍𝐨𝐭 𝐭𝐡𝐢𝐫𝐝-𝐩𝐚𝐫𝐭𝐲 𝐙𝐢𝐠𝐛𝐞𝐞 𝐝𝐞𝐯𝐢𝐜𝐞𝐬)
- [Local Automation for Reliable Performance] Supports local execution of automations for Zigbee and Matter devices, ensuring smooth operation even without Wi-Fi or cloud access. Enjoy millisecond response times for a more stable and reliable smart home experience. (Some automation, such as cloud push notifications, will still require the cloud connection to be executed.)
4. Trust only the proxy in Home Assistant
Add the HTTP integration settings to configuration.yaml. The network below is an example from the proxy environment; use the proxy’s actual address or CIDR from your installation.
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.30.33.0/24use_x_forwarded_for allows Home Assistant to interpret the original client information supplied by NGINX. trusted_proxies limits which senders may provide those forwarding headers. Do not replace it with an unnecessarily broad network: an untrusted client that can reach Home Assistant could spoof its apparent source address.
Validate the configuration and restart Home Assistant after saving the YAML. If the restart fails, undo the last change and check indentation, the CIDR syntax and the proxy address. The proxy must be able to reach Home Assistant, but ordinary internet clients must not be listed as trusted proxies.
5. Forward only HTTPS at the router
Create a router rule that forwards the external HTTPS port, normally TCP 443, to the NGINX proxy’s HTTPS port. Do not forward that public port directly to Home Assistant’s unencrypted internal service. Keep the destination and protocol exactly as required by the proxy app.
Free tools Windows power users keep installed
One-click scans. No signup required.
If your router cannot use port 443, you can choose another external port, but remote URLs and the Companion app must include that port. The proxy still needs to receive encrypted HTTPS traffic; changing the number does not make an HTTP endpoint secure.
Rank #4
- 💡 EASIEST WAY TO GET STARTED WITH HOME ASSISTANT - With Home Assistant already installed, it only requires plugging the included power supply and Ethernet cable to get started.
- ✅ OFFICIAL - This official Home Assistant hardware is built and supported by Nabu Casa, the team driving the development of Home Assistant.
- 🏡 DESIGNED FOR THE HOME - The small, fanless, and silent design packs a quad-core processor, 32GB of storage, and 4GB of RAM.
- 📱 ONE HUB TO CONTROL THE WHOLE HOME - Cut down hub and app clutter and control your whole home from Home Assistant Green.
- 🤖 AUTOMATE EVERYTHING - Make all the devices in your home work in harmony - have your lights dim when you start watching a movie, or turn off your heat when you’re away from home.
6. Set Home Assistant’s external URL
- Go to Settings > System > Network.
- Enter
https://your-name.duckdns.orgin the Internet or external URL field. Include:portif you selected a nonstandard external port. - Save the setting.
- Start the NGINX app and read its log until startup completes without certificate or upstream errors.
Now test from a network outside your LAN. Use cellular data, a neighbor’s Wi-Fi or another independent connection. A test from inside the same network can succeed because of local DNS or router loopback even when outside access is broken.
Common reverse-proxy failures
- Certificate errors: confirm that the DuckDNS name resolves to your current public IP and that both certificate files exist under
/ssl. A certificate for a different hostname will not validate. - 502 or upstream errors: verify the proxy can reach Home Assistant on the current internal address and port, commonly
8123. - “400: Bad Request” or incorrect client addresses: check
use_x_forwarded_forand replace the example trusted-proxy range with the proxy’s real CIDR. - Works locally but not externally: inspect the router forwarding rule, firewall and public DNS. Test from cellular data rather than relying on hairpin NAT.
- Port forwarding never works: determine whether the ISP uses CG-NAT. If the router’s WAN address differs from the public address shown by an independent service, inbound forwarding may be impossible without an ISP-provided public address.
Option 3: Enable TLS directly in Home Assistant
Use direct TLS when Home Assistant itself should serve HTTPS and you do not need NGINX to provide the public endpoint. This is simpler than operating a proxy, but the router still needs to forward an HTTPS port and the certificate files still need renewal.
With the certificate files in /ssl, add absolute paths under the HTTP integration:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutehttp:
ssl_certificate: /ssl/fullchain.pem
ssl_key: /ssl/privkey.pem- Obtain a certificate whose name matches the hostname remote clients will use. The DuckDNS app can place the Let’s Encrypt files in
/ssl. - Add the two absolute paths to
configuration.yaml. - Validate the configuration before restarting.
- Restart Home Assistant and connect with
https://, using the HTTPS port configured by your installation. - Forward the router’s external HTTPS port directly to Home Assistant’s HTTPS listener, not to an unencrypted listener.
- Set the resulting URL under Settings > System > Network and update the Companion app’s external URL.
Do not combine this design casually with a reverse proxy. If NGINX terminates TLS, keep the proxy trust settings and avoid adding incompatible ssl_certificate, ssl_key or port settings to Home Assistant. A missing certificate, wrong path or occupied port can prevent startup; Home Assistant’s HTTP documentation says it can fall back to the last known-good configuration in that situation. Read the startup log before changing several settings at once.
Option 4: VPN or SSH tunnel
A VPN keeps Home Assistant off the public web. After the remote device connects to the VPN, open Home Assistant using its private address as if you were at home. An SSH tunnel offers the same principle for a single administrator session, but it is less convenient for continuous Companion-app use.
Best Value
- EASIEST WAY TO GET STARTED WITH HOME ASSISTANT: With Home Assistant already installed, it only requires plugging the included power supply and Ethernet cable to get started
- DESIGNED FOR THE HOME: The small, fanless, and silent design packs a quad-core processor, 32GB of storage, and 4GB of RAM
- ONE HUB TO CONTROL YOUR WHOLE HOME: Simplify your smart home with HA70. Built with official Home Assistant OS and a professional Zigbee coordinator, it brings local control, powerful automation, and seamless device management into one compact hub
- AUTOMATE EVERYTHING: Make all the devices in your home work in harmony - have your lights dim when you start watching a movie, or turn off your heat when you're away from home
- YOUR HOME, YOUR DATA: Your home's data will be kept in the home on your HomeAssistant. You can easily view, share, and export that data anywhere you want
VPN workflow
- Install a VPN server on your home network, router or a trusted gateway, or use a VPN service that can reach the home network.
- Create a client profile for each phone, tablet or computer that needs access. Protect the profile like a password.
- Connect the VPN before opening Home Assistant.
- Use the internal Home Assistant address and port, such as
http://home-assistant.local:8123or its LAN IP, unless your VPN provides internal DNS. - Configure the Companion app to use the internal address while the VPN is active. If you need automatic switching between home and away, use the app’s internal and external URL fields appropriately.
A VPN can still require an internet-reachable VPN endpoint. CG-NAT may block a VPN server hosted only inside your home, so choose a topology that supports outbound connections or a relay when the ISP does not provide inbound reachability. HTTPS is still useful for any public VPN management interface; the tunnel itself is not a reason to expose Home Assistant’s web port.
CG-NAT: why port forwarding fails
With CG-NAT, your router receives a private or shared WAN address and the ISP performs the public translation upstream. A rule such as “forward TCP 443 to Home Assistant” exists only on your router; unsolicited packets may never reach it. Repeatedly changing internal ports or adding more forwarding rules cannot solve that architectural limitation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Compare the router’s WAN/Internet address with the public address reported by an independent internet connection. A mismatch is a strong indication of upstream NAT.
- Ask the ISP whether a public IPv4 address or a bridge mode option is available.
- Use Home Assistant Cloud when you want the fewest changes and no inbound connection.
- Use a VPN or tunnel designed to work through outbound connections when you want private access.
DuckDNS can update a name correctly even when inbound traffic is impossible; successful DNS resolution does not prove that a port is reachable.
Security checklist after HTTPS works
- Use HTTPS or a VPN for every remote session; never interpret an open port as a security feature.
- Enable multi-factor authentication for Home Assistant accounts whenever possible.
- Give administrator privileges only to accounts that need them.
- For a reverse proxy, trust only its correct IP address or CIDR and keep the list as narrow as the deployment allows.
- Keep Home Assistant, its apps and the Companion app updated.
- Protect
privkey.pem, VPN profiles and SSH keys as credentials. - Review proxy, Home Assistant and router logs after setup so failed login attempts and certificate errors are visible.
- After changing a hostname, port or architecture, update the Companion app’s external URL and test both on-LAN and off-LAN behavior.
Which setup should you use?
Choose Home Assistant Cloud if you want the quickest supported remote URL, have CG-NAT, or do not want to maintain certificates and a proxy. Choose DuckDNS plus Let’s Encrypt and NGINX if you want a self-hosted hostname and are comfortable maintaining DNS, certificate renewal, router forwarding and proxy trust settings. Choose direct TLS when you want Home Assistant itself to terminate HTTPS and can manage certificate files without a proxy. Choose a VPN or SSH tunnel when keeping Home Assistant private matters more than having a universally reachable public URL.
Whichever method you select, finish by setting the external URL in Settings > System > Network, testing from outside your home network and checking the relevant logs. That sequence verifies not just encryption, but the complete path your browser and Companion app will use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
