Anyone who points Home Assistant at its own SSL certificate, instead of putting it behind a reverse proxy, will see a new repair after updating to 2026.11. It offers to switch the HTTP server to a newer set of TLS rules. On 29 October 2026, a day before the second beta, the developers changed which set that repair recommends: Intermediate v6, which still accepts TLS 1.2, rather than Modern v6, which accepts TLS 1.3 only. The stable release is planned for 4 November.
Where the old settings came from
Until now Home Assistant had two SSL profiles, modern and intermediate, both built from Mozilla's TLS configuration lists in version 4 from 2016. Despite its name, modern still allowed TLS 1.2 and older cipher suites. A change merged on 12 October split the setting into versioned profiles: modern_v4, intermediate_v4, modern_v6 and intermediate_v6. Existing installations with a certificate are moved to the matching v4 profile, so after the update the server behaves exactly as before. Outgoing connections from integrations such as REST, Scrape or IMAP keep their current client settings.
The migration bumps the version of the stored configuration. Going back to 2026.10 afterwards means restoring a backup taken before the update.
Why the recommendation changed
The first version of the repair pointed users at Modern v6. The follow-up change quotes Mozilla, which describes Intermediate as the recommended configuration for a general-purpose server, and adds that smart home devices are slow to update their TLS stacks. Its list of clients that connect to Home Assistant over HTTPS and support only TLS 1.2 includes the Home Assistant Voice Preview Edition (firmware 26.9.0, ESPHome 2026.6.0) when it downloads text-to-speech audio, the Android companion app on Android 6 to 9, GPSLogger, Sonos speakers and anything built on the ESP8266 with BearSSL. A fix for the Voice Preview Edition has been proposed in ESPHome, but it is not released yet.
Intermediate v6 keeps TLS 1.2 and TLS 1.3, drops the CBC cipher suites and, for those coming from intermediate_v4, also SHA-1, RSA key exchange and DHE. The oldest clients it still supports are Chrome 49, Firefox 31, Safari 9, iOS 9, Android 4.4 and Edge 15. Modern v6 needs at least Chrome 70, Firefox 63, Safari 12.1, iOS 12.2, Android 10 or Edge 75. New installations also get Intermediate v6 as the default. Windows 7 and 8.1 lose access under either v6 profile when the certificate uses an RSA key.
How the switch works
The repair is now titled "Update the HTTPS encryption settings" and says the certificate itself is not touched. The new profile is applied on trial: Home Assistant restarts with it, and if nobody confirms the change within five minutes, it goes back to the previous profile. That covers the case where the browser you used to start the switch can no longer connect.
After confirming, check the devices that talk to the server directly: wall tablets, phones, voice satellites, speakers playing media from Home Assistant and services that call webhooks. If one stops working, the profile can be changed back under Settings > System > Network, in the HTTP server section under SSL/TLS.