Pairing

Create the device in HA

Open RustyHAMA → Devices, enter a name, profile and area ID, then choose Create pairing. HA creates an eight-digit code and a QR code. Both are single-use, valid for ten minutes and locked after five failed attempts. The QR contains the HA URL, a high-entropy one-time token and an optional public_key_pin; it never contains a device credential or provider secret.

After uninstalling the app or clearing its app data, choose Re-pair on the existing device and use the new code or QR code in the fresh installation. The device ID, HA device and entities, area, profile, device overrides and provider bindings are preserved. Only a successfully completed re-pair replaces the previous credential, closes any remaining old session and invalidates every other outstanding re-pairing code for that device.

Confirm the certificate

If Android does not trust the certificate chain, the app displays the SHA-256 fingerprint of the current certificate and the public-key pin. Compare the fingerprint over a trusted path and confirm it. RustyHAMA stores the sha256/... SPKI pin, so a normal Let's Encrypt renewal with the same key remains valid. If the key changes, the connection stops and waits for confirmation instead of reconnecting forever.

Routed and old devices

Connect IP/host override changes only the actual connection target. URL, TLS host name and SNI remain unchanged. Accept insecure certificate disables chain and host-name validation completely and must only be used deliberately on a trusted isolated network. For Android 4.2 through 7 the app bundles Conscrypt, a CA set and an adapted OkHttp stack.