Automated HTTPS with Let's Encrypt

---

Since i am a total n00b with regards to hosting and HTTP(s) i would like to get the setup for using HTTPS more n00b friendly.

I tried enabeling the HTTPS in my config file but i dislike to import certs on every device i own.

Now, to my knowledge, using certs from let’s encrypt would give us valid certs for HTTPS.

I just stumbled upon this and was wondering if this would be something one could use for pimatic???

If not, does someone have a step by step on how to get the Let’s Encrypt working on a default Pimatic installation?

Is your server reachable under a public domain like example.com? Otherwise letsencrypt.org won’t issue a certificate.

[Personally I don’t like to expose my home automation software to the internet, but that’s just my 2 cents]

Yes it is, i get one with my Synology NAS…

Right now it’s already exposed to the web, i see no/little harm in this, as long as it uses httpS of course!

Then it should be possible My knowledge is limited at this topic.

I guess, you already stumbled across this guide? In your case just the last paragraph “Configuration” is important.
If I’m right, letsencrypt will give you two certificates (public and private). You then have to tell pimatic where these files are and leave “rootCertFile” empty, because letsencrypt is a a trusted CA. And because letsencrypt is trusted you can skip the last sentence, that tells you to import the root certificate to all your devices.

Edit: changed my config, pimatic starts without errors, but does not respond on the chosen https port. http is running fine on another port.

@Stokstaart
It works. I converted my existing certificate files to ones with the ending .pem and put them in the same directory as the config.json. In config.json I added

"httpsServer": {
      "enabled": true,
      "port": 443,
      "hostname": "",
      "keyFile": "private.pem",
      "certFile": "public.pem"
    },

right after the entry httpServer. For me it was important to leave hostname empty. First I put in the name of the server. which didn’t work.

Now it’s up to you to get certificates from letsencrypt.org.

@Marie Did you just go where i was afraid to go??
Sounds great, did u use the link i provided in the OP?

@Stokstaart A reliable backup is always a good start to do crazy things

Sorry, I did not use the link you provided. Simple reason: my servers are not reachable over Internet. Partly my choice, partly because I’m sitting behind a firewall I have no access to, that blocks all unwanted incoming traffic.

I created the used certificates directly via openssl for my apache some time ago. Then I imported the root certificate into the browsers on my PC. My PC accepts the configuration above without a single notice, unlike my mobile devices (without the self signed root certificate). They state, they do not trust the certificate (which is the expected behaviour).

So I’m pretty sure, it’ll work for you without problems once you got the certificates from letsencrypt

So i tried to get Certs via the certbot from letsencrypt but no joy. (must be my n00b level of using the HTTPS certs…)

I really would like to see this as a automated standard within Pimatic!

@Stokstaart
Have you tried ths guide: https://forum.pimatic.org/topic/1037/pimatic-with-trusted-ssl-certificate-from-letsencrypt ?

@thost96 I looked at it before, and to be honest i stopped reading when the remark was made that the beta wasn’t accepting anymore.

Silly me should have read further!!

I am going to try this one out, thanks for pointing it out!!

EDIT)
Okay, this is working! Had to tinker with some of the paths to get the scripts (i used them one by one on the CL because of errors…) to work but at the end i finally have a save connection!

For other users who are also struggeling to get this to work i’ll post in the mentioned topic!

BE AWARE as long as you have unsafe properties loading (For me iframes which were from http: sources) chrome still issues a warning…

@Stokstaart said in Automated HTTPS with Let's Encrypt:

Okay, this is working! Had to tinker with some of the paths to get the scripts (i used them one by one on the CL because of errors…) to work but at the end i finally have a save connection!

Well, after 3 months it looks like the certificates are not renewed

I really really would like to make this feature request happen!
(Or if one could provide a really n00b proof howto i would be happy to try i out and give feedback!)

@Stokstaart this is working fore me full autometed:
https://forum.pimatic.org/topic/1037/pimatic-with-trusted-ssl-certificate-from-letsencrypt/18

@n3ro The problem is that this setup uses nginx. I’d prefer all configuration within Pimatic