For the used SSL certificate to be valid, we need to use the externally visible hostname when accessing the RaspberryMatic GUI. Thus, we need to configure this external hostname as the server's hostname, even if the server is only available on our internal network.

Be careful when exposing your actual RaspberryMatic instance to the outside world without further safe-guards. Usually, it should only be accessible on the internal network.

Create a self-signed certificate

Go to Einstellungen -> Systemsteuerung -> Netzwerkeinstellungen. There, you can create a self-signed certificate. Enter the hostname, your email address, and your country. The latter two values are rather unimportant here.

We need this certificate so that the web server is configured correctly and we have a template file which we can later overwrite with our actual SSL certificate from Let's Encrypt.

Enable SSH in Homematic

Go to Einstellungen -> Systemsteuerung -> Sicherheit. There, you can enable the SSH service and set a password for the root user.

Install acme.sh

Now, connect to the SSH-server as root with your chosen password.

We need to manually install acme.sh since the root filesystem of our RaspberryMatic installation is mounted readonly (only /usr/local is writable). We want to preserve this basic setup to still allow simple updates of RaspberryMatic.

mkdir /usr/local/.acme.sh
curl https://raw.githubusercontent.com/Neilpang/acme.sh/master/acme.sh > /usr/local/.acme.sh/acme.sh
chmod +x /usr/local/.acme.sh/acme.sh

Now we install the cronjob to automatically renew our certificates:

crontab -c /usr/local/crontabs -e

Add the following line:

0 0 * * * /usr/local/.acme.sh/acme.sh --cron --home /usr/local/.acme.sh > /dev/null

Obtain and install our certificate

/usr/local/.acme.sh/acme.sh --issue -d MYHOSTNAME.EXAMPLE.COM --standalone --httpport 8000 --home /usr/local/.acme.sh --fullchain-file /etc/config/server.crt --key-file /etc/config/server.key --reloadcmd "cat /etc/config/server.key /etc/config/server.crt > /etc/config/server.pem && chmod 600 /etc/config/server.pem && /etc/init.d/S50lighttpd reload"

Here, we use acme.sh's standalone mode to confirm the domain ownership which uses the builtin HTTP server of acme.sh on port 8000. For that to work, we need to:

• Add the hostname to the external DNS, e.g. as a CNAME to our router
• Configure the router to accept HTTP requests to the hostname (on port 80) and to forward them to port 8000 of our internal RaspberryMatic box. When using pfSense or OPNsense on the router, you could e.g. use the HAProxy package for that.

We leave this configuration as an exercise to the user.

If this is not possible, we could also use the DNS mode of acme.sh to avoid the HTTP negotiation (and accompanying setup of our router). For that, it is necessary that the external domain is hosted on one of the supported providers. See https://github.com/Neilpang/acme.sh/tree/master/dnsapi#how-to-use-dns-api for details on how to use this with acme.sh.