[Bug]: Self signed certificate error when searching for podcast or when trying to get more podcast episodes #2396

New issue

Open

opened 2026-02-20 10:18:52 -05:00 by deekerman · 1 comment

deekerman commented

2026-02-20 10:18:52 -05:00

Owner

Originally created by @ufondu88 on GitHub (Dec 5, 2024).

What happened?

When I search for a podcast or try to get more episodes of a podcast that I already have added, I get a self-signed certificate error

What did you expect to happen?

Get a list of results of podcasts that match the search term.
Get more episodes of the podcast that I already have added

Steps to reproduce the issue

Search for podcast

Audiobookshelf version

v2.17.3

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

Chrome

Logs

[iTunes] search request error AxiosError: self-signed certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34) at TLSSocket.emit (node:events:518:28) at TLSSocket._finishInit (node:_tls_wrap:1076:8) at ssl.onhandshakedone (node:_tls_wrap:862:12) { code: 'DEPTH_ZERO_SELF_SIGNED_CERT', config: { transitional: { silentJSONParsing: true, forcedJSONParsing: true, clarifyTimeoutError: false }, adapter: [Function: httpAdapter], transformRequest: [ [Function: transformRequest] ], transformResponse: [ [Function: transformResponse] ], timeout: 30000, xsrfCookieName: 'XSRF-TOKEN', xsrfHeaderName: 'X-XSRF-TOKEN', maxContentLength: -1, maxBodyLength: -1, env: { FormData: [Function] }, validateStatus: [Function: validateStatus], headers: { Accept: 'application/json, text/plain, */*', 'User-Agent': 'axios/0.27.2' }, params: { term: 'patriots', media: 'podcast', entity: 'podcast', lang: undefined, limit: undefined, country: 'us' }, method: 'get', url: 'https://itunes.apple.com/search', data: undefined }, request: <ref *1> Writable { _events: { close: undefined, error: [Function: handleRequestError], prefinish: undefined, finish: undefined, drain: undefined, response: [Function: handleResponse], socket: [Array], timeout: undefined, abort: undefined }, _writableState: WritableState { highWaterMark: 16384, length: 0, corked: 0, onwrite: [Function: bound onwrite], writelen: 0, bufferedIndex: 0, pendingcb: 0, [Symbol(kState)]: 17580812, [Symbol(kBufferedValue)]: null }, _maxListeners: undefined, _options: { maxRedirects: 21, maxBodyLength: 10485760, protocol: 'https:', path: '/search?term=patriots&media=podcast&entity=podcast&country=us', method: 'GET', headers: [Object], agent: undefined, agents: [Object], auth: undefined, hostname: 'itunes.apple.com', port: null, nativeProtocols: [Object], pathname: '/search', search: '?term=patriots&media=podcast&entity=podcast&country=us' }, _ended: true, _ending: true, _redirectCount: 0, _redirects: [], _requestBodyLength: 0, _requestBodyBuffers: [], _eventsCount: 3, _onNativeResponse: [Function (anonymous)], _currentRequest: ClientRequest { _events: [Object: null prototype], _eventsCount: 7, _maxListeners: undefined, outputData: [], outputSize: 0, writable: true, destroyed: false, _last: true, chunkedEncoding: false, shouldKeepAlive: true, maxRequestsOnConnectionReached: false, _defaultKeepAlive: true, useChunkedEncodingByDefault: false, sendDate: false, _removedConnection: false, _removedContLen: false, _removedTE: false, strictContentLength: false, _contentLength: 0, _hasBody: true, _trailer: '', finished: true, _headerSent: true, _closed: false, socket: [TLSSocket], _header: 'GET /search?term=patriots&media=podcast&entity=podcast&country=us HTTP/1.1\r\n' + 'Accept: application/json, text/plain, */*\r\n' + 'User-Agent: axios/0.27.2\r\n' + 'Host: itunes.apple.com\r\n' + 'Connection: keep-alive\r\n' + '\r\n', _keepAliveTimeout: 0, _onPendingData: [Function: nop], agent: [Agent], socketPath: undefined, method: 'GET', maxHeaderSize: undefined, insecureHTTPParser: undefined, joinDuplicateHeaders: undefined, path: '/search?term=patriots&media=podcast&entity=podcast&country=us', _ended: false, res: null, aborted: false, timeoutCb: [Function: emitRequestTimeout], upgradeOrConnect: false, parser: null, maxHeadersCount: null, reusedSocket: false, host: 'itunes.apple.com', protocol: 'https:', _redirectable: [Circular *1], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(kBytesWritten)]: 0, [Symbol(kNeedDrain)]: false, [Symbol(corked)]: 0, [Symbol(kOutHeaders)]: [Object: null prototype], [Symbol(errored)]: null, [Symbol(kHighWaterMark)]: 16384, [Symbol(kRejectNonStandardBodyWrites)]: false, [Symbol(kUniqueHeaders)]: null }, _currentUrl: 'https://itunes.apple.com/search?term=patriots&media=podcast&entity=podcast&country=us', _timeout: null, [Symbol(shapeMode)]: true, [Symbol(kCapture)]: false } }

-------

[podcastUtils] getPodcastFeed Error AxiosError: self-signed certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34) at TLSSocket.emit (node:events:518:28) at TLSSocket._finishInit (node:_tls_wrap:1076:8) at ssl.onhandshakedone (node:_tls_wrap:862:12) { code: 'DEPTH_ZERO_SELF_SIGNED_CERT', config: { transitional: { silentJSONParsing: true, forcedJSONParsing: true, clarifyTimeoutError: false }, adapter: [Function: httpAdapter], transformRequest: [ [Function: transformRequest] ], transformResponse: [ [Function: transformResponse] ], timeout: 12000, xsrfCookieName: 'XSRF-TOKEN', xsrfHeaderName: 'X-XSRF-TOKEN', maxContentLength: -1, maxBodyLength: -1, env: { FormData: [Function] }, validateStatus: [Function: validateStatus], headers: { Accept: 'application/rss+xml, application/xhtml+xml, application/xml, */*;q=0.8', 'User-Agent': 'audiobookshelf (+https://audiobookshelf.org; like iTMS)' }, url: 'https://www.omnycontent.com/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', method: 'get', responseType: 'arraybuffer', httpAgent: Agent { _events: [Object: null prototype], _eventsCount: 2, _maxListeners: undefined, defaultPort: 443, protocol: 'https:', options: [Object: null prototype], requests: [Object: null prototype] {}, sockets: [Object: null prototype] {}, freeSockets: [Object: null prototype] {}, keepAliveMsecs: 1000, keepAlive: false, maxSockets: Infinity, maxFreeSockets: 256, scheduling: 'lifo', maxTotalSockets: Infinity, totalSocketCount: 0, maxCachedSessions: 100, _sessionCache: [Object], createConnection: [Function (anonymous)], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(active)]: true }, httpsAgent: Agent { _events: [Object: null prototype], _eventsCount: 2, _maxListeners: undefined, defaultPort: 443, protocol: 'https:', options: [Object: null prototype], requests: [Object: null prototype] {}, sockets: [Object: null prototype], freeSockets: [Object: null prototype] {}, keepAliveMsecs: 1000, keepAlive: false, maxSockets: Infinity, maxFreeSockets: 256, scheduling: 'lifo', maxTotalSockets: Infinity, totalSocketCount: 1, maxCachedSessions: 100, _sessionCache: [Object], createConnection: [Function (anonymous)], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(active)]: true }, data: undefined }, request: <ref *1> Writable { _events: { close: undefined, error: [Function: handleRequestError], prefinish: undefined, finish: undefined, drain: undefined, response: [Function: handleResponse], socket: [Array], timeout: undefined, abort: undefined }, _writableState: WritableState { highWaterMark: 16384, length: 0, corked: 0, onwrite: [Function: bound onwrite], writelen: 0, bufferedIndex: 0, pendingcb: 0, [Symbol(kState)]: 17580812, [Symbol(kBufferedValue)]: null }, _maxListeners: undefined, _options: { maxRedirects: 21, maxBodyLength: 10485760, protocol: 'https:', path: '/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', method: 'GET', headers: [Object], agent: [Agent], agents: [Object], auth: undefined, hostname: 'www.omnycontent.com', port: null, nativeProtocols: [Object], pathname: '/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss' }, _ended: true, _ending: true, _redirectCount: 0, _redirects: [], _requestBodyLength: 0, _requestBodyBuffers: [], _eventsCount: 3, _onNativeResponse: [Function (anonymous)], _currentRequest: ClientRequest { _events: [Object: null prototype], _eventsCount: 7, _maxListeners: undefined, outputData: [], outputSize: 0, writable: true, destroyed: false, _last: true, chunkedEncoding: false, shouldKeepAlive: false, maxRequestsOnConnectionReached: false, _defaultKeepAlive: true, useChunkedEncodingByDefault: false, sendDate: false, _removedConnection: false, _removedContLen: false, _removedTE: false, strictContentLength: false, _contentLength: 0, _hasBody: true, _trailer: '', finished: true, _headerSent: true, _closed: false, socket: [TLSSocket], _header: 'GET /d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss HTTP/1.1\r\n' + 'Accept: application/rss+xml, application/xhtml+xml, application/xml, */*;q=0.8\r\n' + 'User-Agent: audiobookshelf (+https://audiobookshelf.org; like iTMS)\r\n' + 'Host: www.omnycontent.com\r\n' + 'Connection: close\r\n' + '\r\n', _keepAliveTimeout: 0, _onPendingData: [Function: nop], agent: [Agent], socketPath: undefined, method: 'GET', maxHeaderSize: undefined, insecureHTTPParser: undefined, joinDuplicateHeaders: undefined, path: '/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', _ended: false, res: null, aborted: false, timeoutCb: null, upgradeOrConnect: false, parser: null, maxHeadersCount: null, reusedSocket: false, host: 'www.omnycontent.com', protocol: 'https:', _redirectable: [Circular *1], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(kBytesWritten)]: 0, [Symbol(kNeedDrain)]: false, [Symbol(corked)]: 0, [Symbol(kOutHeaders)]: [Object: null prototype], [Symbol(errored)]: null, [Symbol(kHighWaterMark)]: 16384, [Symbol(kRejectNonStandardBodyWrites)]: false, [Symbol(kUniqueHeaders)]: null }, _currentUrl: 'https://www.omnycontent.com/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', _timeout: null, [Symbol(shapeMode)]: true, [Symbol(kCapture)]: false } }

Additional Notes

Audiobookshelf is running in a container within a Proxmox LXC

Docker compose:

services:
  audiobookshelf:
    container_name: audiobookshelf
    image: ghcr.io/advplyr/audiobookshelf:latest
    environment:
      - TZ='America/Chicago'
      - AUDIOBOOKSHELF_UID=1000
      - AUDIOBOOKSHELF_GID=1000
    ports:
      - 13378:80
    volumes:
      - ./config:/config
      - ./metadata:/metadata
      - /home/media/audiobooks:/audiobooks
      - /home/media/podcasts:/podcasts
      - /home/media/downloads:/downloads
    restart: unless-stopped

No response

Originally created by @ufondu88 on GitHub (Dec 5, 2024). ### What happened? When I search for a podcast or try to get more episodes of a podcast that I already have added, I get a self-signed certificate error ### What did you expect to happen? Get a list of results of podcasts that match the search term. Get more episodes of the podcast that I already have added ### Steps to reproduce the issue 1. Search for podcast ### Audiobookshelf version v2.17.3 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? Chrome ### Logs ```shell [iTunes] search request error AxiosError: self-signed certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34) at TLSSocket.emit (node:events:518:28) at TLSSocket._finishInit (node:_tls_wrap:1076:8) at ssl.onhandshakedone (node:_tls_wrap:862:12) { code: 'DEPTH_ZERO_SELF_SIGNED_CERT', config: { transitional: { silentJSONParsing: true, forcedJSONParsing: true, clarifyTimeoutError: false }, adapter: [Function: httpAdapter], transformRequest: [ [Function: transformRequest] ], transformResponse: [ [Function: transformResponse] ], timeout: 30000, xsrfCookieName: 'XSRF-TOKEN', xsrfHeaderName: 'X-XSRF-TOKEN', maxContentLength: -1, maxBodyLength: -1, env: { FormData: [Function] }, validateStatus: [Function: validateStatus], headers: { Accept: 'application/json, text/plain, */*', 'User-Agent': 'axios/0.27.2' }, params: { term: 'patriots', media: 'podcast', entity: 'podcast', lang: undefined, limit: undefined, country: 'us' }, method: 'get', url: 'https://itunes.apple.com/search', data: undefined }, request: <ref *1> Writable { _events: { close: undefined, error: [Function: handleRequestError], prefinish: undefined, finish: undefined, drain: undefined, response: [Function: handleResponse], socket: [Array], timeout: undefined, abort: undefined }, _writableState: WritableState { highWaterMark: 16384, length: 0, corked: 0, onwrite: [Function: bound onwrite], writelen: 0, bufferedIndex: 0, pendingcb: 0, [Symbol(kState)]: 17580812, [Symbol(kBufferedValue)]: null }, _maxListeners: undefined, _options: { maxRedirects: 21, maxBodyLength: 10485760, protocol: 'https:', path: '/search?term=patriots&media=podcast&entity=podcast&country=us', method: 'GET', headers: [Object], agent: undefined, agents: [Object], auth: undefined, hostname: 'itunes.apple.com', port: null, nativeProtocols: [Object], pathname: '/search', search: '?term=patriots&media=podcast&entity=podcast&country=us' }, _ended: true, _ending: true, _redirectCount: 0, _redirects: [], _requestBodyLength: 0, _requestBodyBuffers: [], _eventsCount: 3, _onNativeResponse: [Function (anonymous)], _currentRequest: ClientRequest { _events: [Object: null prototype], _eventsCount: 7, _maxListeners: undefined, outputData: [], outputSize: 0, writable: true, destroyed: false, _last: true, chunkedEncoding: false, shouldKeepAlive: true, maxRequestsOnConnectionReached: false, _defaultKeepAlive: true, useChunkedEncodingByDefault: false, sendDate: false, _removedConnection: false, _removedContLen: false, _removedTE: false, strictContentLength: false, _contentLength: 0, _hasBody: true, _trailer: '', finished: true, _headerSent: true, _closed: false, socket: [TLSSocket], _header: 'GET /search?term=patriots&media=podcast&entity=podcast&country=us HTTP/1.1\r\n' + 'Accept: application/json, text/plain, */*\r\n' + 'User-Agent: axios/0.27.2\r\n' + 'Host: itunes.apple.com\r\n' + 'Connection: keep-alive\r\n' + '\r\n', _keepAliveTimeout: 0, _onPendingData: [Function: nop], agent: [Agent], socketPath: undefined, method: 'GET', maxHeaderSize: undefined, insecureHTTPParser: undefined, joinDuplicateHeaders: undefined, path: '/search?term=patriots&media=podcast&entity=podcast&country=us', _ended: false, res: null, aborted: false, timeoutCb: [Function: emitRequestTimeout], upgradeOrConnect: false, parser: null, maxHeadersCount: null, reusedSocket: false, host: 'itunes.apple.com', protocol: 'https:', _redirectable: [Circular *1], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(kBytesWritten)]: 0, [Symbol(kNeedDrain)]: false, [Symbol(corked)]: 0, [Symbol(kOutHeaders)]: [Object: null prototype], [Symbol(errored)]: null, [Symbol(kHighWaterMark)]: 16384, [Symbol(kRejectNonStandardBodyWrites)]: false, [Symbol(kUniqueHeaders)]: null }, _currentUrl: 'https://itunes.apple.com/search?term=patriots&media=podcast&entity=podcast&country=us', _timeout: null, [Symbol(shapeMode)]: true, [Symbol(kCapture)]: false } } ------- [podcastUtils] getPodcastFeed Error AxiosError: self-signed certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1677:34) at TLSSocket.emit (node:events:518:28) at TLSSocket._finishInit (node:_tls_wrap:1076:8) at ssl.onhandshakedone (node:_tls_wrap:862:12) { code: 'DEPTH_ZERO_SELF_SIGNED_CERT', config: { transitional: { silentJSONParsing: true, forcedJSONParsing: true, clarifyTimeoutError: false }, adapter: [Function: httpAdapter], transformRequest: [ [Function: transformRequest] ], transformResponse: [ [Function: transformResponse] ], timeout: 12000, xsrfCookieName: 'XSRF-TOKEN', xsrfHeaderName: 'X-XSRF-TOKEN', maxContentLength: -1, maxBodyLength: -1, env: { FormData: [Function] }, validateStatus: [Function: validateStatus], headers: { Accept: 'application/rss+xml, application/xhtml+xml, application/xml, */*;q=0.8', 'User-Agent': 'audiobookshelf (+https://audiobookshelf.org; like iTMS)' }, url: 'https://www.omnycontent.com/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', method: 'get', responseType: 'arraybuffer', httpAgent: Agent { _events: [Object: null prototype], _eventsCount: 2, _maxListeners: undefined, defaultPort: 443, protocol: 'https:', options: [Object: null prototype], requests: [Object: null prototype] {}, sockets: [Object: null prototype] {}, freeSockets: [Object: null prototype] {}, keepAliveMsecs: 1000, keepAlive: false, maxSockets: Infinity, maxFreeSockets: 256, scheduling: 'lifo', maxTotalSockets: Infinity, totalSocketCount: 0, maxCachedSessions: 100, _sessionCache: [Object], createConnection: [Function (anonymous)], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(active)]: true }, httpsAgent: Agent { _events: [Object: null prototype], _eventsCount: 2, _maxListeners: undefined, defaultPort: 443, protocol: 'https:', options: [Object: null prototype], requests: [Object: null prototype] {}, sockets: [Object: null prototype], freeSockets: [Object: null prototype] {}, keepAliveMsecs: 1000, keepAlive: false, maxSockets: Infinity, maxFreeSockets: 256, scheduling: 'lifo', maxTotalSockets: Infinity, totalSocketCount: 1, maxCachedSessions: 100, _sessionCache: [Object], createConnection: [Function (anonymous)], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(active)]: true }, data: undefined }, request: <ref *1> Writable { _events: { close: undefined, error: [Function: handleRequestError], prefinish: undefined, finish: undefined, drain: undefined, response: [Function: handleResponse], socket: [Array], timeout: undefined, abort: undefined }, _writableState: WritableState { highWaterMark: 16384, length: 0, corked: 0, onwrite: [Function: bound onwrite], writelen: 0, bufferedIndex: 0, pendingcb: 0, [Symbol(kState)]: 17580812, [Symbol(kBufferedValue)]: null }, _maxListeners: undefined, _options: { maxRedirects: 21, maxBodyLength: 10485760, protocol: 'https:', path: '/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', method: 'GET', headers: [Object], agent: [Agent], agents: [Object], auth: undefined, hostname: 'www.omnycontent.com', port: null, nativeProtocols: [Object], pathname: '/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss' }, _ended: true, _ending: true, _redirectCount: 0, _redirects: [], _requestBodyLength: 0, _requestBodyBuffers: [], _eventsCount: 3, _onNativeResponse: [Function (anonymous)], _currentRequest: ClientRequest { _events: [Object: null prototype], _eventsCount: 7, _maxListeners: undefined, outputData: [], outputSize: 0, writable: true, destroyed: false, _last: true, chunkedEncoding: false, shouldKeepAlive: false, maxRequestsOnConnectionReached: false, _defaultKeepAlive: true, useChunkedEncodingByDefault: false, sendDate: false, _removedConnection: false, _removedContLen: false, _removedTE: false, strictContentLength: false, _contentLength: 0, _hasBody: true, _trailer: '', finished: true, _headerSent: true, _closed: false, socket: [TLSSocket], _header: 'GET /d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss HTTP/1.1\r\n' + 'Accept: application/rss+xml, application/xhtml+xml, application/xml, */*;q=0.8\r\n' + 'User-Agent: audiobookshelf (+https://audiobookshelf.org; like iTMS)\r\n' + 'Host: www.omnycontent.com\r\n' + 'Connection: close\r\n' + '\r\n', _keepAliveTimeout: 0, _onPendingData: [Function: nop], agent: [Agent], socketPath: undefined, method: 'GET', maxHeaderSize: undefined, insecureHTTPParser: undefined, joinDuplicateHeaders: undefined, path: '/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', _ended: false, res: null, aborted: false, timeoutCb: null, upgradeOrConnect: false, parser: null, maxHeadersCount: null, reusedSocket: false, host: 'www.omnycontent.com', protocol: 'https:', _redirectable: [Circular *1], [Symbol(shapeMode)]: false, [Symbol(kCapture)]: false, [Symbol(kBytesWritten)]: 0, [Symbol(kNeedDrain)]: false, [Symbol(corked)]: 0, [Symbol(kOutHeaders)]: [Object: null prototype], [Symbol(errored)]: null, [Symbol(kHighWaterMark)]: 16384, [Symbol(kRejectNonStandardBodyWrites)]: false, [Symbol(kUniqueHeaders)]: null }, _currentUrl: 'https://www.omnycontent.com/d/playlist/e73c998e-6e60-432f-8610-ae210140c5b1/73e7109b-287b-452a-a1ac-aea9013f8eb9/fe972ea1-2d5b-44c5-ba0c-aea9013f8ec7/podcast.rss', _timeout: null, [Symbol(shapeMode)]: true, [Symbol(kCapture)]: false } } ``` ### Additional Notes Audiobookshelf is running in a container within a Proxmox LXC Docker compose: ``` services: audiobookshelf: container_name: audiobookshelf image: ghcr.io/advplyr/audiobookshelf:latest environment: - TZ='America/Chicago' - AUDIOBOOKSHELF_UID=1000 - AUDIOBOOKSHELF_GID=1000 ports: - 13378:80 volumes: - ./config:/config - ./metadata:/metadata - /home/media/audiobooks:/audiobooks - /home/media/podcasts:/podcasts - /home/media/downloads:/downloads restart: unless-stopped ``` _No response_

deekerman added the

bug

unable to reproduce

labels

2026-02-20 10:18:52 -05:00

deekerman commented

2026-02-20 10:18:53 -05:00

Author

Owner

@ufondu88 commented on GitHub (Dec 5, 2024):

From within the Proxmox LXC that contains audiobookshelf, I can run this command and get valid output

curl -v https://itunes.apple.com

*   Trying 23.197.220.30:443...
* Connected to itunes.apple.com (23.197.220.30) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted h2
* Server certificate:
*  subject: businessCategory=Private Organization; jurisdictionC=US; jurisdictionST=California; serialNumber=C0806592; C=US; ST=California; L=Cupertino; O=Apple Inc.; CN=itunes.apple.com
*  start date: Dec  3 19:25:58 2024 GMT
*  expire date: Apr  2 18:31:05 2025 GMT
*  subjectAltName: host "itunes.apple.com" matched cert's "itunes.apple.com"
*  issuer: C=US; O=Apple Inc.; CN=Apple Public EV Server RSA CA 2 - G1
*  SSL certificate verify ok.
* using HTTP/2
* h2h3 [:method: GET]
* h2h3 [:path: /]
* h2h3 [:scheme: https]
* h2h3 [:authority: itunes.apple.com]
* h2h3 [user-agent: curl/7.88.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x564956d20ce0)
> GET / HTTP/2
> Host: itunes.apple.com
> user-agent: curl/7.88.1
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/2 301
< server: daiquiri/5
< content-type: text/html; charset=UTF-8
< content-length: 0
< x-apple-jingle-correlation-key: 664WWOBXYZ6XIA5MHI5LNHQYDA
< x-apple-request-uuid: f7b96b38-37c6-7d74-03ac-3a3ab69e1818
< x-apple-translated-wo-url: /WebObjects/MZStore.woa/wa/topLevelCountry?urlDesc=
< apple-tk: false
< x-b3-spanid: f6300e29d155a6c0
< x-responding-instance: MZStore:3500771:::
< b3: f7b96b3837c67d7403ac3a3ab69e1818-f6300e29d155a6c0
< x-apple-aka-ttl: Generated Thu Dec 05 19:39:58 PST 2024, Expires Thu Dec 05 19:39:58 PST 2024, TTL 0s
< x-b3-traceid: f7b96b3837c67d7403ac3a3ab69e1818
< x-webobjects-loadaverage: 0
< last-modified: Fri, 06 Dec 2024 03:39:58 GMT
< apple-seq: 0.0
< access-control-allow-origin: *
< apple-originating-system: MZStore
< strict-transport-security: max-age=31536000; includeSubDomains
< x-frame-options: SAMEORIGIN
< x-apple-orig-url: https://itunes.apple.com/
< x-apple-application-site: MR22
< apple-timing-app: 2 ms
< vary: X-Apple-Store-Front
< location: https://www.apple.com/itunes/
< x-apple-application-instance: 3500771
< x-daiquiri-instance: daiquiri:11896011:mr50p00it-qujn12081301:7987:24RELEASE242:daiquiri-amp-store-l7shared-int-001-mr
< x-daiquiri-instance: daiquiri:12282003:mr47p00it-qujn03120502:7987:24RELEASE242:daiquiri-amp-store-l7shared-ext-001-mr
< cache-control: no-transform, max-age=0
< date: Fri, 06 Dec 2024 03:39:58 GMT
< x-cache: TCP_MISS from a23-192-37-174.deploy.akamaitechnologies.com (AkamaiGHost/11.7.1-5d2a058efeda81c5505a169a6e16c38e) (-)
< x-true-cache-key: /L/itunes.apple.com/ vcd=2897 ci2=///
< x-cache-remote: TCP_MISS from a23-198-14-139.deploy.akamaitechnologies.com (AkamaiGHost/11.7.1-5d2a058efeda81c5505a169a6e16c38e) (-)
< x-apple-partner: origin.0
<
* Connection #0 to host itunes.apple.com left intact

But I get SSL handshake errors from within the ABS container itself

curl -v https://itunes.apple.com
* Host itunes.apple.com:443 was resolved.
* IPv6: 2600:1404:a00:288::2a1, 2600:1404:a00:286::2a1, 2600:1404:a00:28d::2a1, 2600:1404:a00:285::2a1, 2600:1404:a00:281::2a1
* IPv4: 23.40.144.30
*   Trying [2600:1404:a00:288::2a1]:443...
* Immediate connect fail for 2600:1404:a00:288::2a1: Network unreachable
*   Trying [2600:1404:a00:286::2a1]:443...
* Immediate connect fail for 2600:1404:a00:286::2a1: Network unreachable
*   Trying [2600:1404:a00:28d::2a1]:443...
* Immediate connect fail for 2600:1404:a00:28d::2a1: Network unreachable
*   Trying [2600:1404:a00:285::2a1]:443...
* Immediate connect fail for 2600:1404:a00:285::2a1: Network unreachable
*   Trying [2600:1404:a00:281::2a1]:443...
* Immediate connect fail for 2600:1404:a00:281::2a1: Network unreachable
*   Trying 23.40.144.30:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* closing connection #0
curl: (60) SSL peer certificate or SSH remote key was not OK
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

@ufondu88 commented on GitHub (Dec 5, 2024): From within the Proxmox LXC that contains audiobookshelf, I can run this command and get valid output ``` curl -v https://itunes.apple.com * Trying 23.197.220.30:443... * Connected to itunes.apple.com (23.197.220.30) port 443 (#0) * ALPN: offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN: server accepted h2 * Server certificate: * subject: businessCategory=Private Organization; jurisdictionC=US; jurisdictionST=California; serialNumber=C0806592; C=US; ST=California; L=Cupertino; O=Apple Inc.; CN=itunes.apple.com * start date: Dec 3 19:25:58 2024 GMT * expire date: Apr 2 18:31:05 2025 GMT * subjectAltName: host "itunes.apple.com" matched cert's "itunes.apple.com" * issuer: C=US; O=Apple Inc.; CN=Apple Public EV Server RSA CA 2 - G1 * SSL certificate verify ok. * using HTTP/2 * h2h3 [:method: GET] * h2h3 [:path: /] * h2h3 [:scheme: https] * h2h3 [:authority: itunes.apple.com] * h2h3 [user-agent: curl/7.88.1] * h2h3 [accept: */*] * Using Stream ID: 1 (easy handle 0x564956d20ce0) > GET / HTTP/2 > Host: itunes.apple.com > user-agent: curl/7.88.1 > accept: */* > * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * old SSL session ID is stale, removing < HTTP/2 301 < server: daiquiri/5 < content-type: text/html; charset=UTF-8 < content-length: 0 < x-apple-jingle-correlation-key: 664WWOBXYZ6XIA5MHI5LNHQYDA < x-apple-request-uuid: f7b96b38-37c6-7d74-03ac-3a3ab69e1818 < x-apple-translated-wo-url: /WebObjects/MZStore.woa/wa/topLevelCountry?urlDesc= < apple-tk: false < x-b3-spanid: f6300e29d155a6c0 < x-responding-instance: MZStore:3500771::: < b3: f7b96b3837c67d7403ac3a3ab69e1818-f6300e29d155a6c0 < x-apple-aka-ttl: Generated Thu Dec 05 19:39:58 PST 2024, Expires Thu Dec 05 19:39:58 PST 2024, TTL 0s < x-b3-traceid: f7b96b3837c67d7403ac3a3ab69e1818 < x-webobjects-loadaverage: 0 < last-modified: Fri, 06 Dec 2024 03:39:58 GMT < apple-seq: 0.0 < access-control-allow-origin: * < apple-originating-system: MZStore < strict-transport-security: max-age=31536000; includeSubDomains < x-frame-options: SAMEORIGIN < x-apple-orig-url: https://itunes.apple.com/ < x-apple-application-site: MR22 < apple-timing-app: 2 ms < vary: X-Apple-Store-Front < location: https://www.apple.com/itunes/ < x-apple-application-instance: 3500771 < x-daiquiri-instance: daiquiri:11896011:mr50p00it-qujn12081301:7987:24RELEASE242:daiquiri-amp-store-l7shared-int-001-mr < x-daiquiri-instance: daiquiri:12282003:mr47p00it-qujn03120502:7987:24RELEASE242:daiquiri-amp-store-l7shared-ext-001-mr < cache-control: no-transform, max-age=0 < date: Fri, 06 Dec 2024 03:39:58 GMT < x-cache: TCP_MISS from a23-192-37-174.deploy.akamaitechnologies.com (AkamaiGHost/11.7.1-5d2a058efeda81c5505a169a6e16c38e) (-) < x-true-cache-key: /L/itunes.apple.com/ vcd=2897 ci2=/// < x-cache-remote: TCP_MISS from a23-198-14-139.deploy.akamaitechnologies.com (AkamaiGHost/11.7.1-5d2a058efeda81c5505a169a6e16c38e) (-) < x-apple-partner: origin.0 < * Connection #0 to host itunes.apple.com left intact ``` But I get SSL handshake errors from within the ABS container itself ``` curl -v https://itunes.apple.com * Host itunes.apple.com:443 was resolved. * IPv6: 2600:1404:a00:288::2a1, 2600:1404:a00:286::2a1, 2600:1404:a00:28d::2a1, 2600:1404:a00:285::2a1, 2600:1404:a00:281::2a1 * IPv4: 23.40.144.30 * Trying [2600:1404:a00:288::2a1]:443... * Immediate connect fail for 2600:1404:a00:288::2a1: Network unreachable * Trying [2600:1404:a00:286::2a1]:443... * Immediate connect fail for 2600:1404:a00:286::2a1: Network unreachable * Trying [2600:1404:a00:28d::2a1]:443... * Immediate connect fail for 2600:1404:a00:28d::2a1: Network unreachable * Trying [2600:1404:a00:285::2a1]:443... * Immediate connect fail for 2600:1404:a00:285::2a1: Network unreachable * Trying [2600:1404:a00:281::2a1]:443... * Immediate connect fail for 2600:1404:a00:281::2a1: Network unreachable * Trying 23.40.144.30:443... * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (OUT), TLS alert, unknown CA (560): * closing connection #0 curl: (60) SSL peer certificate or SSH remote key was not OK More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above. ```