Your Let's Encrypt certificate, on every device.
CertFleet installs into Home Assistant and pushes your certificate to the switches, printers, firewalls and appliances on your network — then reconnects to each one and confirms the certificate actually landed. No browser warnings. No renewal reminders in your calendar.
MIT licensed · Runs entirely inside your Home Assistant instance · Requires Home Assistant 2026 or newer
The CertFleet dashboard, mid-renewal.
This project exists because its author refused to let a printer — a perfectly good printer, working exactly as intended — go on serving a self-signed certificate.
Things escalated.
Renewing a certificate is the easy part; Let's Encrypt already handles that. The tedious part is everything downstream — the switch, the firewall, the NAS, the KVM, and the printer that hides its certificate import behind four menus and a mandatory reboot. CertFleet is the part that does the downstream work, and then checks it.
Renew once. Everything downstream follows.
CertFleet watches the certificate Home Assistant already manages, and treats every registered device as a destination for it.
Renew
Let's Encrypt issues your certificate to Home Assistant, exactly as it does today. CertFleet doesn't replace your existing ACME setup.
Detect
CertFleet picks up the new certificate and reads its expiry, fingerprint and subject alternative names.
Deploy
Each device receives the certificate through its own supported channel — vendor API, SSH, or the device's web interface — including any restart that device requires.
Verify
CertFleet reconnects and reads the certificate back off the device. A match is reported as in sync. A mismatch is reported plainly, not swallowed.
Automatic on renewal
Turn on auto-deploy and the fleet updates itself the next time Let's Encrypt renews. Or keep it manual and press the button yourself.
One dashboard
Every device, its current certificate state, and when it was last checked — on a single page in your Home Assistant sidebar.
Honest failures
When a device is unreachable or refuses an import, CertFleet says so and attaches the underlying error. Silent partial success is the failure mode worth fearing.
Twelve device types, each spoken to in its own language.
There is no universal way to install a certificate on a network appliance, so CertFleet implements each one properly — API tokens where they exist, SSH and vendor PKI commands where they don't, and web-interface automation for the devices that offer nothing else.
Missing something? Device support lives in self-contained handlers, so adding one is a contained job — open an issue with the device and how it accepts certificates.
It handles private keys, so it should explain itself.
Any tool that distributes certificates is, by definition, a tool that holds key material and logs in to your infrastructure. That deserves a straight answer about what it does and where things go.
Everything stays on your network
CertFleet runs as an add-on inside your own Home Assistant instance. The certificate and key travel from Home Assistant to the device across your own LAN. There is no cloud service, no relay, and no account to create.
Fingerprints are pinned on first contact
The first time CertFleet reaches a device it records that device's certificate fingerprint. If the fingerprint later changes unexpectedly, that is surfaced as a warning to confirm — not quietly accepted as the new normal.
Deploys are verified, not assumed
A successful upload is not treated as a successful deployment. CertFleet reconnects afterwards and reads the live certificate back off the device, comparing fingerprints before it will call anything in sync.
Every action is logged
Checks, deploys, restarts, warnings and failures are written to a timestamped event log with the device and endpoint attached, so you can reconstruct exactly what touched what, and when.
Credentials are per device
Each device carries its own credentials or API token. Give CertFleet a dedicated service account on each device and scope it to what it actually needs — certificate management, nothing more.
The source is public
MIT licensed and readable on GitHub. Nobody should hand key material to a tool they can't inspect, and you shouldn't make an exception for this one.
What CertFleet does not do
- Send your certificate, key or credentials anywhere except the devices you registered
- Phone home, report usage, or contact any third-party service
- Scan or discover devices on its own — it only touches what you explicitly add
- Issue or renew certificates; that stays with your existing Let's Encrypt setup
- Require inbound access from the internet, or any port forwarding
Five steps, all inside Home Assistant.
- In Home Assistant, go to Settings → Add-ons → Add-on store.
- Open the three-dot menu (⋮) and choose Repositories.
-
Add the CertFleet repository:
https://github.com/tinmansc/CertFleet - Find CertFleet in the store and install it.
- Enable Show in sidebar, start the add-on, and add your first device.
Pre-built multi-architecture images (amd64 and aarch64) are published automatically, so installing on a Raspberry Pi is the same five steps as anywhere else.
Stop clicking through the certificate warning.
Add the repository to Home Assistant, register your devices, and let the next renewal take care of itself.