home-assistant / home-assistant/iOS
[mTLS] Render Template iOS Shortcut action fails
- Dominant language
- Swift
- Stars
- 2.4k
- Forks
- 520
- Avg merge
- 7h 27m
- Merged PRs (30d)
- 264
Description
### Preflight checks
- [x] I am using the experimental mTLS feature
- [x] I have reproduced this issue at least once after restarting the app
### App platform
iOS
### Device and app information
Model: iPhone 13 Pro
iOS: 26.6.1
App Version: 2026.9.0 (2026.2874)
### Home Assistant environment
Home Assistant Core Version: 2026.9.0
Installation Type: Container
Host OS: Unraid
Reverse Proxy: Traefik
TLS Termination Point: Traefik container on Host OS
### mTLS setup details
Client certificate source: StepCA
Client certificate format: PKCS#12
Certificate validity window: 25 Dec 2025 - 25 Dec 2027
Server certificate issuer: StepCA
The Home Assistant external URL is protected by mTLS at the Traefik reverse proxy.
A PKCS#12 client certificate has been imported and selected in the Home Assistant Companion App. Normal use of Home Assistant through the iOS app works correctly, confirming that the app can present the client certificate.
### Failure symptoms
The Render Template action supplied by the Home Assistant app in Apple Shortcuts does not work when the selected Home Assistant server is accessed through the mTLS-protected external URL.
The main Companion App continues to connect and operate correctly using the same server configuration and certificate.
When the Shortcut runs, it returns:
[The action “Render Template” could not run because an unknown error occurred]
Using Home Assistant internal URL route via direct IP and Port allows the Shortcut action to work.
This suggests that the Home Assistant Shortcuts/App Intent extension may not have access to, or may not be using, the client certificate selected in the main Companion App.
### Steps to reproduce
1. Place Home Assistant behind a reverse proxy requiring a valid TLS client certificate.
2. Import a valid PKCS#12 client certificate into the Home Assistant iOS app.
3. Confirm that the main Companion App connects successfully through the mTLS-protected URL.
4. Open Apple Shortcuts.
5. Create a new Shortcut.
6. Add the Home Assistant Render Template action.
7. Select the same Home Assistant server.
8. Enter a simple template, for example I’m using:
{{ states('input_boolean.iphone_charging') }}
9. Run the Shortcut.
10. Observe that the Render Template action fails.
11. Remove or bypass the mTLS requirement and run it again.
12. Observe that the same Shortcut succeeds.
### Expected vs actual behavior
Expected behavior
The Render Template Shortcut action should use the mTLS client certificate configured for the selected Home Assistant server, just as the main Companion App does.
Actual behavior
The main Companion App works through mTLS, but the Render Template Shortcut action fails to connect.
It appears other iOS shortcut actions are not impacted based on my limited testing.
### Additional context
_No response_
Contributor guide
Research direction
Start at the Home Assistant Render Template Shortcut action and its iOS App Intent extension, then compare how it accesses the selected server and client certificate with the main Companion App. Reproduce the action against the mTLS-protected external URL and verify that the same template succeeds while using the configured certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios, swift
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100