mirror of
https://github.com/immich-app/immich.git
synced 2026-03-02 22:57:45 -05:00
Android app certificate validation invalid #4277
Closed
opened 2026-02-20 03:03:15 -05:00 by deekerman
·
15 comments
No Branch/Tag specified
main
renovate/typescript-projects
release/next
renovate/github-actions
chore/translations
push-nwxlpmyzkyrl
push-wzwotsylzylq
push-zpwsovysllvn
push-zunuwtznrlpm
renovate/opentofu-1.x
renovate/node
push-rsywxvptwxuv
renovate/prom-prometheus
renovate/docker.io-valkey-valkey-9
push-suusrsrnmzrp
push-xyozownmuwqp
csp-policy
uhthomas/fix-mobile-video-state
uhthomas/fix-mobile-hero-height
feat/use-native-clients
uhthomas/chore-mobile-simplify-scroll
feat/mobile-edit-3-mobile-sync-handling
feat/panorama-tiles
refactor/zod-migration
fix/maintenance-reload
refactor/restores-file-interceptor
uhthomas/fix-mobile-inconsistent-asset-detials-background
postgres-socketio
claude/auto-screenshot-web-changes-Y7efI
visual-review/pr-26535
push-lvyturrtwkrq
feat/notification
feat/library-offline-stats
feat/checksum-algorithm-indicator
feat/library-offline-count
uhthomas/feat-mobile-search-results
fix/bring-back-globalkeys
fix/map-webgl-error
feat/mobile-ocr
feat/custom-date-range
fix/mobile-video-aspect-ratio
fix/ml-ocr-batch-size
fix/timeline-rtl
feat/integrity-checks-izzy
uhthomas/fix-mobile-search-results
renovate/flutter
uhthomas/feat-sort-smart-search
renovate/github-cqlabs-homebrew-dcm-1.x
feat/video-player
feat/mobile-editing
refactor/remove-replace-with-upload
uhthomas/chore-mobile-maplibre
uhthomas/mobile-fix-asset-details-album-pop
feat/crawl-wrapper
feat/open-in-browser
push-skvzqoozqkpl
feat/edit-filters
fix/locale-settings-desc
feat/pg-queue
refactor/asset-upload
renovate/connectivity_plus-7.x
better-project-structure
uhthomas/mobile-feat-asset-viewer-details
fix/ml-rocm-build
fix/25803
feat/asset-file-apis
midzelis/wip
feature/bottom-buttons-order
sqlite_thumbs
fix-keep-correct-ios-shared-album-asset
fix-memory-generation-and-display
push-vpxwmwwxwnvw
fix-migration-width-height
revert/prettier-translations
shared-deep-link-handler
feat/thumbnail-native-clients
feat/platform-clients
fix/foreground-cloud-sync
filter-by-person
feat/csp
refactor/sidebar
fix/disable-editing
fix/view-timeline-deeplink
image-zoom-on-slow-connection
fix/merged-edited-assets
open-api-fix
feat/create-job-with-dto
use-toast-primary
feat/vitest-4
feat/ios-fastlane-match
match-signing
fix-update-time-update-timeline
feat/modal-routes
feature/mobile-view-asset-owner
feat/system-settings
feature/show-activity-count
better-info-in-asset-viewer
fix/all-people-count
feat/location-favorites
feature/rearrange-buttons-2
fix/download-storage-template
feat/kb-shortcuts-mobile
fix/people-count
push-qolzzzzxrvvn
chore/originals-in-asset-files
feat/asset-size-columns
ben/tree-a11y
new-search-filter-ui
refactor/expectSelectedReadonly
refactor/mobile-grdb
push-qvuktpxmkknu
feat/mobile-native-local-sync
refactor/timeline_ops
fix/scrubber_end
feat/version.txt
feat/context-menus
feat/server-chunked-uploads
refactor/virtualsegment
refactor/rename_daymonth_groups
fix/restrict-android-bg-worker
feat/android-periodic-worker
fix-remote-sync-clean-up
refactor/timeline_move_ops
fix/timeline_split_selectable
feat/keyboard_actions_help_modal
feat/static_frontend
feat/notification-warnign-android
feat/plugins2
feat/plugins
test/create-workflow-token-action
fix/docs-force
debug/search-result-similarity
debug/cf-chunked-uploads
feat/eslint_rule
feat/search-filter-album/web
refactor/timeline_photostream
refactor/timelineasset_asset
feat/session-permissions
feat/timeline_photostream_assetnav
feat/timeline_minor_optimize
feat/timeline_perf_nocomp
feat/timeline_search_results_actions
feat/timeline_search_results_page
fix/timeline_padding
fix/timeline_search_reactivity_warnings
feat/timeline_scrollbar
feat/timeline_stream_withviewer
fix/timeline_back_forth_nav
refactor/timeline_photostream_component
fix/generated-files-checks
fix/locate-button-local
chore/base-image-mimalloc
refactor/timeline_assetlayout
refactor/timeline_selectable
refactor/timeline_aware_actions
refactor/timeline_monthsegment
feat/remove-old-pages
chore/deps-gradle
tmp_photostream
tmp/lcms
feat/mobile-dynamic-thumbnails
fix/mobile-finer-thumbnail-concurrency
refactor/timeline1
refactor/extract_photostream
refactor/rename_load_api
refactor/timeline2
refactor/timeline3
feat/multi-select-asset-viewer
feat-no-thumbhash-cache
refactor/asset_grid
feat/faster-access-checks
fix/18991
fix/19543
chore/temp-remove
fix/21419
feat/mobile-hdr-images
chore/update-mise-lockfile
feat/mise-server-checks
feat/mise-ci
feat/windows-2025
feat/dev_cli
refactor/mobile-migrate-clients
fix/map-theme
fix/require-checkbox
chore/use_swc
feat/efficient-thumbnail-decoding
refactor/mobile-thumbhash
refactor/mobile-thumbhash-new
feat/beta-background-upload
fix/beta-timeline-memories-setting
fix/failed-uploads-not-removed
feat/mobile-shared-album
feat/groups
drift-map-page
drift-auth-user-sync
fix/disable-memory
feat/add-to-album-action
edit-date-time-action
drift-people-page
sqlite-remove-isIn
chore/required-reviewers
refact/asset-manager
fix/folder-sort
pnpm
feat/widget-multiple-server-urls
chore/medium-tests-dbname
fix/web-no-iterator-find
fix/map-pan-interruption
track-livephotos
timeline_events
chore/oxlint-migration
feat/maintenance-worker
feat/dav
chore/demo-snapshot
refactor/server-side-dedupe
feat/integrity-checks
dev/recognition-eval
lighter_buckets_test
perf/postgres-queue
postgres-queue
focus_rings
refactor/web-stores-1
refactor/add-to-taken
feat/sort-places
vet
tmp/demo-snapshot-preview
fix/server-migration-file-extension
fix/asset-update-race-condition
rknn-toolkit-lite2
refactor/mobile-split-up-search-page
feature/Add-rocm-support-for-machine-learning
feat/rocm
chore/async-hash-file
feat/shared-link-view-count
feat/rotation
feat/graphql
feat/job-ids
feat/ignore-library-permission-error
feat/docker-compose-builder
feat/kysely-typeorm
mobile/onboarding
no-video-player
fix/server-qsv-output-format
chore/server-geodata-tweaks
mobile/native-video-player-no-hero
feat/xxhash
fix/docs-concurrency
feat/local-tileserver
refactor/exif-orientation
original-path-infix
refactor/mobile/login-form-1
feat/server-editor-endpoints
fix/server-qsv-vbr
fix-mobile-db-problems
feat/ml-armnn-conversion
feat/mobile/backup-with-album-info
feat/fast-initial-sync-1
chore/handle-output_dims
feat/unassign-faces
feat/shortcuts-on-asset-grid
feat/capacitor-mobile-app-poc
feat/server-nvenc-hw-decoding
fix/mobile-fetch-non-archive
web/automation-ui
feat/mobile-server-endpoint-save-dropdown
object-storage
feat/memories-animations
dev/metrics
ml/tflite
feat/ml-export-cli
v2.5.6
v2.5.5
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5.0
v2.4.1
v2.4.0
v2.3.1
v2.3.0
v2.2.3
v2.2.2
v2.2.1
v2.2.0
v2.1.0
v2.0.1
v2.0.0
v1.144.1
v1.144.0
v1.143.1
v1.143.0
v1.142.1
v1.142.0
v1.141.1
v1.141.0
v1.140.1
v1.140.0
v1.139.4
v1.139.3
v1.139.2
v1.139.1
v1.139.0
v1.138.1
v1.138.0
v1.137.3
v1.137.2
v1.137.1
v1.137.0
v1.136.0
v1.135.3
v1.135.2
v1.135.1
v1.135.0
v1.134.0
v1.133.1
v1.133.0
v1.132.3
v1.132.2
v1.132.1
v1.132.0
v1.131.3
v1.131.2
v1.131.1
v1.131.0
v1.130.3
v1.130.2
v1.130.1
v1.130.0
v1.129.0
v1.128.0
v1.127.0
v1.126.1
v1.126.0
v1.125.7
v1.125.6
v1.125.5
v1.125.4
v1.125.3
v1.125.2
v1.125.1
v1.125.0
v1.124.2
v1.124.1
v1.124.0
v1.123.0
v1.122.3
v1.122.2
v1.122.1
v1.122.0
v1.121.0
v1.120.2
v1.120.1
v1.120.0
v1.119.1
v1.119.0
v1.118.2
v1.118.1
v1.118.0
v1.117.0
v1.116.2
v1.116.1
v1.116.0
v1.115.0
v1.114.0
v1.113.1
v1.113.0
v1.112.1
v1.112.0
v1.111.0
v1.110.0
v1.109.2
v1.109.1
v1.109.0
v1.108.0
v1.107.2
v1.107.1
v1.107.0
v1.106.4
v1.106.3
v1.106.2
v1.106.1
v1.106.0
v1.105.1
v1.105.0
v1.104.0
v1.103.1
v1.103.0
v1.102.3
v1.102.2
v1.102.1
v1.102.0
v1.101.0
v1.100.0
v1.99.0
v1.98.2
v1.98.1
v1.98.0
v1.97.0
v1.96.0
v1.95.1
v1.95.0
v1.94.1
v1.94.0
v1.93.3
v1.93.2
v1.93.1
v1.93.0
v1.92.1
v1.92.0
v1.91.4
v1.91.3
v1.91.2
v1.91.1
v1.91.0
v1.90.2
v1.90.1
v1.90.0
v1.89.0
v1.88.2
v1.88.1
v1.88.0
v1.87.0
v1.86.0
v1.85.0
v1.84.0
v1.83.0
v1.82.1
v1.82.0
v1.81.1
v1.81.0
v1.80.0
v1.79.1
v1.79.0
v1.78.1
v1.78.0
v1.77.0
v1.76.1
v1.76.0
v1.75.2
v1.75.1
v1.75.0
v1.74.0
v1.73.0
v1.72.2
v1.72.1
v1.72.0
v1.71.0
v1.70.0
v1.69.0
v1.68.0
v1.67.2
v1.67.1
v1.67.0
v1.66.1
v1.66.0
v1.65.0
v1.64.0
v1.63.2
v1.63.1
v1.63.0
v1.62.1
v1.62.0
v1.61.0
v1.60.0
v1.59.1
v1.59.0
v1.58.0
v1.57.1
v1.57.0
v1.56.2
v1.56.1
v1.56.0
v1.55.1
v1.55.0
v1.54.1
v1.54.0
v1.53.0
v1.52.1
v1.52.0
v1.51.2
v1.51.1
v1.51.0
v1.50.1
v1.50.0
v1.49.0
v1.48.1
v1.48.0
v1.47.3
v1.47.2
v1.47.1
v1.47.0
v1.46.1
v1.46.0
v1.45.0
v1.44.0
v1.43.1
v1.43.0
v1.42.0_65-dev
v1.41.1_64-dev
v1.41.0_64-dev
v1.40.1_63-dev
v1.40.0_63-dev
v1.39.0_61-dev
v1.38.2_60-dev
v1.38.1_60-dev
v1.38.0_60-dev
v1.37.0_58-dev
v1.36.2_56-dev
v1.36.1_55-dev
v1.36.0_55-dev
v1.35.0_54-dev
v1.34.0_53-dev
v1.33.1_52-dev
v1.33.0_52-dev
v1.32.1_51-dev
v1.32.0_50-dev
v1.31.1_49-dev
v1.31.0_49-dev
v1.30.2_48-dev
v1.30.0_46-dev
v1.29.6_45-dev
v1.29.6_44-dev
v1.29.5_44-dev
v1.29.4_44-dev
v1.29.3_43-dev
v1.29.2_43-dev
v1.29.1_43-dev
v1.29.0_42-dev
v1.28.4_41-dev
v1.28.4_42-dev
v1.28.3_41-dev
v1.28.2_40-dev
v1.28.1_39-dev
v1.28.0_38-dev
v1.27.0_37-dev
v1.26.0_36-dev
v1.25.0_35-dev
v1.24.0_34-dev
v1.23.0_33-dev
v1.22.0_32-dev
v1.21.1_31-dev
v1.21.0_31-dev
v1.20.3_30-dev
v1.20.2_30-dev
v1.20.1_30-dev
v1.20.0_30-dev
v1.19.1_29-dev
v1.19.0_29-dev
v1.18.0_27-dev
v1.17.0_25-dev
v1.16.0_23-dev
v1.15.1_21-dev
v1.15.0_21-dev
v1.14.0_21-dev
v1.13.0_20-dev
v1.12.0_18-dev
v1.11.0_17-dev
v1.10.0_15-dev
v1.9.1_14-dev
v1.9.0_13-dev
v1.8.0_12-dev
v1.7.0_11-dev
v1.6.0_10-dev
v1.5.1+9-dev
v1.5.0+8-dev
v1.4.0+7-dev
v1.4.0+6-dev
v1.4.0-dev
v1.3.0-dev
v1.3.1-dev
v0.6-dev
v0.5-dev
v0.4-dev
v0.3-dev
v0.2-dev
first-android-release
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set.
Reference
starred/immich#4277
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nodiaque on GitHub (Nov 12, 2024).
The bug
Hello,
When using a reverse proxy that have a certificate where the subject name doesn't match the domain but have alternate subject name that match, immich won't connect and throw an invalid certificat error
https://pastebin.com/imYAe9b1
As soon as I change the subject name for my wildcard domain (which is in the alternate subject), it work.
The OS that Immich Server is running on
Unraid
Version of Immich Server
1.12.0.1
Version of Immich Mobile App
1.20.0.1 build 166
Platform with the issue
Your docker-compose.yml content
Your .env content
Reproduction steps
...
Relevant log output
Additional information
No response
@bo0tzz commented on GitHub (Nov 12, 2024):
Can you clarify, is this a valid WebPKI certificate or something self signed?
@nodiaque commented on GitHub (Nov 12, 2024):
Let's Encrypt certificate
@nodiaque commented on GitHub (Nov 12, 2024):
Here's what I mean.
This is my server certificat. We can see here that the subject name (Objet, sorry it's in French) is something.duckdns.org. It is not a widcard. For privacy purpose, I blurred and renamed it a.duckdns.org. My immich server reside at immich.b.duckdns.org.
Here, you can see I have alternate subject set to DNS Name:
@mmomjian commented on GitHub (Nov 13, 2024):
I am not able to replicate this. My nginx serves a Lets Encrypt cert with a wildcard Subject Alternative Name and have had no issues on iOS or Android.
@nodiaque commented on GitHub (Nov 13, 2024):
Weirdly when I put back that certificat, it does the error back and it's made from the same software. Maybe when there's multiple alternative name? In my case, it was the third dns alternate name. Be sure that the subject doesn't match the domain nor subdomain.
@mmomjian commented on GitHub (Nov 13, 2024):
My cert has like 20 alternate names , FWIW. And no, the subject doesn’t match
@nodiaque commented on GitHub (Nov 13, 2024):
I really don't know what to say. It's the only difference between this certificate and the one I'm using right now.
@squanbo commented on GitHub (Dec 10, 2024):
I encountered the same issue when using a reverse proxy. I am using a self-signed certificate and have enabled the 'Allow self-signed certificates' option in the settings. When opening a video on the Android client, the app crashes.
ApiException 400: TLS/SSL communication failed: GET /partners (Inner exception: HandshakeException: Handshake error in client (OS Error:
CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate(handshake.cc:393)))
#0 _SecureFilterImpl._handshake (dart:io-patch/secure_socket_patch.dart:99)
#1 _SecureFilterImpl.handshake (dart:io-patch/secure_socket_patch.dart:143)
#2 _RawSecureSocket._secureHandshake (dart:io/secure_socket.dart:920)
#3 _RawSecureSocket._tryFilter (dart:io/secure_socket.dart:1049)
@mmomjian commented on GitHub (Dec 10, 2024):
Your issue is not related. Self signed certs currently do not support video playback.
@mmomjian commented on GitHub (Dec 10, 2024):
@nodiaque please share your full domain name for us to be able to test on our end.
@nodiaque commented on GitHub (Dec 10, 2024):
is there a way to send private message in github? Cause I won't disclose my domain name publicy on the internet
@mmomjian commented on GitHub (Dec 10, 2024):
You can join our discord and then ask to DM someone there
@bo0tzz commented on GitHub (Dec 10, 2024):
Is your reverse proxy sending the full certificate chain or only the leaf cert?
@mmomjian commented on GitHub (Dec 10, 2024):
Confirmed misconfigured reverse proxy.
@nodiaque commented on GitHub (Dec 10, 2024):
problem solved. for those that might have this issue, in nginx ssl.conf, normally you have let's encrypt dealing with this without a problem but since I'm importing cert from somewhere else, I had to modify the configuration.
Default nginx/swag configuration
What's important to note here is:
cert.crt is actually a symlink to fullchain.pem
cert.key is a symlink to privkey.pem
My non working config was like that:
Weirdly enough, one would think that ssl_trusted_certificate would install the whole chain but no. So I changed the first line to
ssl_certificate /config/acme/###.duckdns.org.all.pem;And voila, it's now resolving the chain properly.
For anyone else needing to check there ssl installation, this little tool work great. There's also an offline version if you don't have access from internet (ssl tools on the same page)
https://www.sslshopper.com/SSL-CHECKER.HTML
I should have followed my own advice, check my ssl installation and not blindly trust my docker ;)