By default, Home Assistant runs its local web interface on port 8123. When you configure encrypted external access, standard HTTPS traffic routes through port 443. Getting this setup right means you can check your dashboard from anywhere without leaving your home network vulnerable to snooping.
Most smart home beginners get stuck because Home Assistant doesn't use port 443 out of the box. Instead, the core application listens internally on port 8123, while external routers or reverse proxies handle the translation to port 443. Setting this up correctly requires matching your SSL certificates, router port forwarding, and configuration files.
How Home Assistant Handles Network Ports
When you install Home Assistant on hardware like a Raspberry Pi or an Intel NUC, the local server starts up on port 8123. If you type [http://homeassistant.local:8123](http://homeassistant.local:8123) into your browser while sitting on your living room couch, you're talking directly to that unencrypted port.
External Request (Port 443) ---> Router / Reverse Proxy ---> Home Assistant (Port 8123)
Directly exposing port 8123 to the internet is a bad idea because the traffic isn't encrypted. Anyone on public Wi-Fi could intercept your username, password, and automation commands. That's why secure access relies on routing traffic through port 443 with SSL/TLS encryption enabled.
Configuring SSL and Base URL
To use port 443 securely, your Home Assistant instance needs a valid SSL certificate. You can obtain free certificates using the Let's Encrypt add-on within Home Assistant OS, or you can manage them manually if you're running a Docker container on Linux.
Open your configuration.yaml file and add your network details. For example:
http:
ssl_certificate: /ssl/fullchain.pem
ssl_key: /ssl/privkey.pem
After saving the file, check your configuration via developer tools and restart the server. Once SSL is active, Home Assistant expects secure HTTPS connections, meaning your local URLs will change from http://...:8123 to https://...:8123.
Router Port Forwarding vs Reverse Proxy
You have two main paths for mapping external secure requests to your local setup: direct router port forwarding or using a reverse proxy.
Direct Port Forwarding
If you use direct forwarding, you tell your home router to take any incoming traffic hitting public port 443 and forward it directly to your Home Assistant device's internal IP address on port 8123 (with SSL enabled on Home Assistant).
- Pros: Easy to set up in five minutes.
- Cons: Home Assistant handles the SSL termination directly, and exposing the native port to the wider web can introduce risks if software updates lag behind.
Reverse Proxy (Recommended)
Running a reverse proxy like Nginx Proxy Manager, Caddy, or Traefik on a separate container or device is much safer.
- The proxy listens on port 443 and holds the SSL certificates.
- The proxy decrypts incoming web traffic securely.
- The proxy forwards the clean traffic locally to Home Assistant on port 8123.
Using a proxy also lets you host other local services (like Plex or Pi-hole) behind the same port 443 without conflicts.
Common Mistakes to Avoid
Even experienced home lab builders run into snags when configuring external access. Watch out for these pitfalls:
- Forgetting internal base URLs: If you set up external HTTPS access, update your internal and external URLs in the Home Assistant companion app settings. Otherwise, your phone won't connect when you arrive home.
- ISP port blocking: Many residential internet service providers block incoming traffic on port 443 to discourage home web hosting. If external connections fail completely, check if your ISP blocks standard ports, and configure your router to map a custom external port (like 8443) to internal port 443 on your proxy.
- Ignoring certificate expiration: If you use manual SSL certificates instead of automated Let's Encrypt renewals, your smart home app will suddenly lock you out when the certificate expires after 90 days.
- Skipping local DNS overrides: Accessing your domain name from inside your house can fail if your router doesn't support NAT reflection. Setting up local DNS resolution (via AdGuard Home or Pi-hole) solves this instantly.
Frequently Asked Questions
Can I run Home Assistant on port 443 natively without port 8123?
Yes, but it requires running Home Assistant with root privileges or using a container network bridge, since standard Linux security rules prevent non-root apps from binding to ports below 1024. Using a reverse proxy is the cleaner, safer workaround.
Why does my Home Assistant app show a certificate error?
This usually happens if you access your instance via its local IP address while your SSL certificate was issued for a specific domain name (like home.yourdomain.com). SSL certificates only match the exact domain name they were signed for.
Do I need a domain name to use HTTPS?
Strictly speaking, trusted public SSL certificates from authorities like Let's Encrypt require a registered domain name. However, you can use built-in remote access services like Home Assistant Cloud (Nabu Casa), which handles all certificate generation and port mapping automatically behind the scenes.
Is port 443 safe from automated bot scanners?
Port 443 is scanned constantly by automated web crawlers looking for vulnerable servers. While HTTPS encryption protects your data from being read, you should always enforce strong passwords, multi-factor authentication, and check out the Home Assistant Security Checklist to keep your smart home locked down.
