home-assistant / home-assistant/iOS

[mTLS] Render Template iOS Shortcut action fails

Open
#5,616 0 comments 1 reaction 0 assignees View on GitHub
bug ios
Dominant language
Swift
Stars
2.4k
Forks
520
Avg merge
7h 27m
Merged PRs (30d)
264

Description

### Preflight checks

- [x] I am using the experimental mTLS feature
- [x] I have reproduced this issue at least once after restarting the app

### App platform

iOS

### Device and app information

Model: iPhone 13 Pro
iOS: 26.6.1
App Version: 2026.9.0 (2026.2874)

### Home Assistant environment

Home Assistant Core Version: 2026.9.0
Installation Type: Container
Host OS: Unraid
Reverse Proxy: Traefik
TLS Termination Point: Traefik container on Host OS

### mTLS setup details

Client certificate source: StepCA
Client certificate format: PKCS#12
Certificate validity window: 25 Dec 2025 - 25 Dec 2027
Server certificate issuer: StepCA

The Home Assistant external URL is protected by mTLS at the Traefik reverse proxy.

A PKCS#12 client certificate has been imported and selected in the Home Assistant Companion App. Normal use of Home Assistant through the iOS app works correctly, confirming that the app can present the client certificate.

### Failure symptoms

The Render Template action supplied by the Home Assistant app in Apple Shortcuts does not work when the selected Home Assistant server is accessed through the mTLS-protected external URL.

The main Companion App continues to connect and operate correctly using the same server configuration and certificate.

When the Shortcut runs, it returns:

[The action “Render Template” could not run because an unknown error occurred]

Using Home Assistant internal URL route via direct IP and Port allows the Shortcut action to work.

This suggests that the Home Assistant Shortcuts/App Intent extension may not have access to, or may not be using, the client certificate selected in the main Companion App.

### Steps to reproduce

1. Place Home Assistant behind a reverse proxy requiring a valid TLS client certificate.
2. Import a valid PKCS#12 client certificate into the Home Assistant iOS app.
3. Confirm that the main Companion App connects successfully through the mTLS-protected URL.
4. Open Apple Shortcuts.
5. Create a new Shortcut.
6. Add the Home Assistant Render Template action.
7. Select the same Home Assistant server.
8. Enter a simple template, for example I’m using:
{{ states('input_boolean.iphone_charging') }}
9. Run the Shortcut.
10. Observe that the Render Template action fails.
11. Remove or bypass the mTLS requirement and run it again.
12. Observe that the same Shortcut succeeds.

### Expected vs actual behavior

Expected behavior

The Render Template Shortcut action should use the mTLS client certificate configured for the selected Home Assistant server, just as the main Companion App does.

Actual behavior

The main Companion App works through mTLS, but the Render Template Shortcut action fails to connect.

It appears other iOS shortcut actions are not impacted based on my limited testing.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the Home Assistant Render Template Shortcut action and its iOS App Intent extension, then compare how it accesses the selected server and client certificate with the main Companion App. Reproduce the action against the mTLS-protected external URL and verify that the same template succeeds while using the configured certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, swift
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.