Self-signed certificate no longer work on Android #7886

Closed
opened 2026-02-20 05:07:56 -05:00 by deekerman · 11 comments
Owner

Originally created by @EnricoOri on GitHub (Jan 29, 2026).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

I recently installed Immich on my local server with self signed certificate via Caddy internal tls (used as reverse proxy) and all worked until I updated the Android app to 2.5.2 version, now videos and photos on the server do not load. Weird is that the first time i configure the app and set "accept self signed certificates" to true it works. Then it do not work anymore.

I updated also iOS but it works, my wife has the previous Android version and it works too

Attached are the app logs

Immich logs 2026-01-29T21_43_30.txt

The OS that Immich Server is running on

Ubuntu 24.04.3

Version of Immich Server

2.5.2

Version of Immich Mobile App

2.5.2

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

Google Pixel 7

Your docker-compose.yml content

#
# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    extends:
      file: hwaccel.transcoding.yml
      service: nvenc # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    #ports:
    # - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    networks:
      - default
      - web_proxy
    healthcheck:
      disable: false
    runtime: nvidia
    environment:
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=all
      - LIBVA_DRIVER_NAME=nvidia
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu, video, compute, utility]

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-cuda
    # privileged: true      # Grimaldello per i permessi
    runtime: nvidia       # Il tunnel diretto per la scheda
    environment:
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=all
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities:
                - gpu
    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:9@sha256:fb8d272e529ea567b9bf1302245796f21a2672b8368ca3fcb938ac334e613c8f
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always

volumes:
  model-cache:

networks:
  default:
  web_proxy:
    external: true

Your .env content

# You can find documentation for all the supported env variables at https://docs.immich.app/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=./library

# The location where your database files are stored. Network shares are not supported for the database
DB_DATA_LOCATION=./postgres

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
# TZ=Etc/UTC

# The Immich version to use. You can pin this to a specific version like "v2.1.0"
IMMICH_VERSION=v2

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=2448115341

# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

Reproduction steps

1.Install on server with self-signed certificate
2.Install the Android app and log-in
3.Close the app
4.Reopen the app
...

Relevant log output


Additional information

No response

Originally created by @EnricoOri on GitHub (Jan 29, 2026). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug I recently installed Immich on my local server with self signed certificate via Caddy internal tls (used as reverse proxy) and all worked until I updated the Android app to 2.5.2 version, now videos and photos on the server do not load. Weird is that the first time i configure the app and set "accept self signed certificates" to true it works. Then it do not work anymore. I updated also iOS but it works, my wife has the previous Android version and it works too Attached are the app logs [Immich logs 2026-01-29T21_43_30.txt](https://github.com/user-attachments/files/24947627/Immich.logs.2026-01-29T21_43_30.txt) ### The OS that Immich Server is running on Ubuntu 24.04.3 ### Version of Immich Server 2.5.2 ### Version of Immich Mobile App 2.5.2 ### Platform with the issue - [ ] Server - [ ] Web - [x] Mobile ### Device make and model Google Pixel 7 ### Your docker-compose.yml content ```YAML # # WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose # # Make sure to use the docker-compose.yml of the current release: # # https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml # # The compose file on main may not be compatible with the latest release. name: immich services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} extends: file: hwaccel.transcoding.yml service: nvenc # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding volumes: # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file - ${UPLOAD_LOCATION}:/data - /etc/localtime:/etc/localtime:ro env_file: - .env #ports: # - '2283:2283' depends_on: - redis - database restart: always networks: - default - web_proxy healthcheck: disable: false runtime: nvidia environment: - NVIDIA_VISIBLE_DEVICES=all - NVIDIA_DRIVER_CAPABILITIES=all - LIBVA_DRIVER_NAME=nvidia deploy: resources: reservations: devices: - driver: nvidia count: 1 capabilities: [gpu, video, compute, utility] immich-machine-learning: container_name: immich_machine_learning # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag. # Example tag: ${IMMICH_VERSION:-release}-cuda image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-cuda # privileged: true # Grimaldello per i permessi runtime: nvidia # Il tunnel diretto per la scheda environment: - NVIDIA_VISIBLE_DEVICES=all - NVIDIA_DRIVER_CAPABILITIES=all deploy: resources: reservations: devices: - driver: nvidia count: 1 capabilities: - gpu # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration # file: hwaccel.ml.yml # service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable volumes: - model-cache:/cache env_file: - .env restart: always healthcheck: disable: false redis: container_name: immich_redis image: docker.io/valkey/valkey:9@sha256:fb8d272e529ea567b9bf1302245796f21a2672b8368ca3fcb938ac334e613c8f healthcheck: test: redis-cli ping || exit 1 restart: always database: container_name: immich_postgres image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} POSTGRES_INITDB_ARGS: '--data-checksums' # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs DB_STORAGE_TYPE: 'HDD' volumes: # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file - ${DB_DATA_LOCATION}:/var/lib/postgresql/data shm_size: 128mb restart: always volumes: model-cache: networks: default: web_proxy: external: true ``` ### Your .env content ```Shell # You can find documentation for all the supported env variables at https://docs.immich.app/install/environment-variables # The location where your uploaded files are stored UPLOAD_LOCATION=./library # The location where your database files are stored. Network shares are not supported for the database DB_DATA_LOCATION=./postgres # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List # TZ=Etc/UTC # The Immich version to use. You can pin this to a specific version like "v2.1.0" IMMICH_VERSION=v2 # Connection secret for postgres. You should change it to a random password # Please use only the characters `A-Za-z0-9`, without special characters or spaces DB_PASSWORD=2448115341 # The values below this line do not need to be changed ################################################################################### DB_USERNAME=postgres DB_DATABASE_NAME=immich ``` ### Reproduction steps 1.Install on server with self-signed certificate 2.Install the Android app and log-in 3.Close the app 4.Reopen the app ... ### Relevant log output ```shell ``` ### Additional information _No response_
Author
Owner

@mmomjian commented on GitHub (Jan 29, 2026):

#15230

@mmomjian commented on GitHub (Jan 29, 2026): #15230
Author
Owner

@alextran1502 commented on GitHub (Jan 29, 2026):

I think if it was working before and now it stops working we need to fix it

@alextran1502 commented on GitHub (Jan 29, 2026): I think if it was working before and now it stops working we need to fix it
Author
Owner

@mertalev commented on GitHub (Jan 29, 2026):

I haven't reproduced this behavior. I installed the user certificate on Android, enabled "allow self-signed certificates", imported the certificate and all images load as normal. If I try to use the app without this configuration, it cannot connect (as expected).

@mertalev commented on GitHub (Jan 29, 2026): I haven't reproduced this behavior. I installed the user certificate on Android, enabled "allow self-signed certificates", imported the certificate and all images load as normal. If I try to use the app without this configuration, it cannot connect (as expected).
Author
Owner

@EnricoOri commented on GitHub (Jan 30, 2026):

I'll try to define better my passages, sorry I'm not very good at this:
1 - Install immich with Caddy as reverse proxy
2 - Install the Caddy .cer file as CA on Android (I think it's the only file Caddy gives me)
3 - Install Immich
4 - Enable self-signed certificates in-app (and not import anything)
5 - Connect with https to the server
6 - Login
7 - Remote photos and videos work fine
8 - Force close the app
9 - Re-enter
10 - Remote photos and videos not work anymore

Looks like the "Enable self-signed" certificates is read correctly until you close the app, then it doesen't read it anymore (while still showing the switch checked)

Hope this better clarifies the issue.
Still, iOS (with the CA installed on device and accepted) works and the old version of the app on Android works even without the .cer file installed on device

@EnricoOri commented on GitHub (Jan 30, 2026): I'll try to define better my passages, sorry I'm not very good at this: 1 - Install immich with Caddy as reverse proxy 2 - Install the Caddy .cer file as CA on Android (I think it's the only file Caddy gives me) 3 - Install Immich 4 - Enable self-signed certificates in-app (and not import anything) 5 - Connect with https to the server 6 - Login 7 - Remote photos and videos work fine 8 - Force close the app 9 - Re-enter 10 - Remote photos and videos not work anymore Looks like the "Enable self-signed" certificates is read correctly until you close the app, then it doesen't read it anymore (while still showing the switch checked) Hope this better clarifies the issue. Still, iOS (with the CA installed on device and accepted) works and the old version of the app on Android works even without the .cer file installed on device
Author
Owner

@mmomjian commented on GitHub (Jan 31, 2026):

If the certificate is added to the system trust store you should not need to enable self signed SSL cert. What happens when you try to load the Immich website in the mobile web browser? Does it load successfully without any SSL warnings?

@mmomjian commented on GitHub (Jan 31, 2026): If the certificate is added to the system trust store you should not need to enable self signed SSL cert. What happens when you try to load the Immich website in the mobile web browser? Does it load successfully without any SSL warnings?
Author
Owner

@EnricoOri commented on GitHub (Jan 31, 2026):

Yes it works.
Now I tried to get a Let's Encrypt cretificate using Cloudflare with Caddy (DNS Challenge, no public IP or port-forwarding, just domain and reverse proxy) to try a simpler setup and also the app works.
True, now it's a Let's Encrypt certificate and not a self-signed one, but I had too many issues also with other services with self-signed.

@EnricoOri commented on GitHub (Jan 31, 2026): Yes it works. Now I tried to get a Let's Encrypt cretificate using Cloudflare with Caddy (DNS Challenge, no public IP or port-forwarding, just domain and reverse proxy) to try a simpler setup and also the app works. True, now it's a Let's Encrypt certificate and not a self-signed one, but I had too many issues also with other services with self-signed.
Author
Owner

@ToniCipriani commented on GitHub (Feb 2, 2026):

If the certificate is added to the system trust store you should not need to enable self signed SSL cert. What happens when you try to load the Immich website in the mobile web browser? Does it load successfully without any SSL warnings?

I just noticed the setting still needs to be enabled to allow it. However I did not need to import the cert within Immich.

@ToniCipriani commented on GitHub (Feb 2, 2026): > If the certificate is added to the system trust store you should not need to enable self signed SSL cert. What happens when you try to load the Immich website in the mobile web browser? Does it load successfully without any SSL warnings? I just noticed the setting still needs to be enabled to allow it. However I did not need to import the cert within Immich.
Author
Owner

@maghiel commented on GitHub (Feb 2, 2026):

I was facing a similar issue (blurry thumbs, memories and people not showing, etc), but was able to resolve the problem by issueing a new self-signed cert. I did not need to manually add it to the trust store.

@maghiel commented on GitHub (Feb 2, 2026): I was facing a similar issue (blurry thumbs, memories and people not showing, etc), but was able to resolve the problem by issueing a new self-signed cert. I did not need to manually add it to the trust store.
Author
Owner

@mertalev commented on GitHub (Feb 6, 2026):

Self-signed certificates do work as of app 2.5.5, but it requires you to add the certificate to the OS store.

@mertalev commented on GitHub (Feb 6, 2026): Self-signed certificates do work as of app 2.5.5, but it requires you to add the certificate to the OS store.
Author
Owner

@maghiel commented on GitHub (Feb 7, 2026):

Self-signed certificates do work as of app 2.5.5, but it requires you to add the certificate to the OS store.

For me it wasn't necessary to add the cert to the store.

Just upgraded to 2.5.5, now it is necessary to add the ca cert to the store. In prior versions it wasn't.

@maghiel commented on GitHub (Feb 7, 2026): > Self-signed certificates do work as of app 2.5.5, but it requires you to add the certificate to the OS store. ~~For me it wasn't necessary to add the cert to the store.~~ Just upgraded to 2.5.5, now it *is* necessary to add the ca cert to the store. In prior versions it wasn't.
Author
Owner

@JoseEnder commented on GitHub (Feb 8, 2026):

I'm using 2.5.5 and even installing the CA cert in android store is not working. Below the logs from the app in android:

_

_2026-02-08 13:51:51.287631 | severe | ThumbnailWidget | Error loading image: PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false
at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3)
, null) | PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false
at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3)
, null) |
#0 RemoteImageApi.requestImage (package:immich_mobile/platform/remote_image_api.g.dart:69)

#1 RemoteImageRequest.load (package:immich_mobile/infrastructure/loaders/remote_image_request.dart:15)

#2 CancellableImageProviderMixin.loadRequest (package:immich_mobile/presentation/widgets/images/image_provider.dart:59)

#3 ImageStreamCompleter.setImage (package:flutter/src/painting/image_stream.dart:724)

2026-02-08 13:51:51.287490 | severe | ThumbnailWidget | Error loading image: PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false
at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3)
, null) | PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false
at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3)
, null) |
#0 RemoteImageApi.requestImage (package:immich_mobile/platform/remote_image_api.g.dart:69)

#1 RemoteImageRequest.load (package:immich_mobile/infrastructure/loaders/remote_image_request.dart:15)

#2 CancellableImageProviderMixin.loadRequest (package:immich_mobile/presentation/widgets/images/image_provider.dart:59)

#3 ImageStreamCompleter.setImage (package:flutter/src/painting/image_stream.dart:724)

__

@JoseEnder commented on GitHub (Feb 8, 2026): I'm using 2.5.5 and even installing the CA cert in android store is not working. Below the logs from the app in android: _ _2026-02-08 13:51:51.287631 | severe | ThumbnailWidget | Error loading image: PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3) , null) | PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3) , null) | #0 RemoteImageApi.requestImage (package:immich_mobile/platform/remote_image_api.g.dart:69) <asynchronous suspension> #1 RemoteImageRequest.load (package:immich_mobile/infrastructure/loaders/remote_image_request.dart:15) <asynchronous suspension> #2 CancellableImageProviderMixin.loadRequest (package:immich_mobile/presentation/widgets/images/image_provider.dart:59) <asynchronous suspension> #3 ImageStreamCompleter.setImage (package:flutter/src/painting/image_stream.dart:724) <asynchronous suspension> 2026-02-08 13:51:51.287490 | severe | ThumbnailWidget | Error loading image: PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3) , null) | PlatformException(ms, m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false, Cause: null, Stacktrace: m1.ms: Exception in CronetUrlRequest: net::ERR_CERT_AUTHORITY_INVALID, ErrorCode=11, InternalErrorCode=-202, Retryable=false at org.chromium.net.impl.CronetUrlRequest.onError(:com.google.android.gms.dynamite_cronetdynamite@260434029@26.04.34 (190400-0):3) , null) | #0 RemoteImageApi.requestImage (package:immich_mobile/platform/remote_image_api.g.dart:69) <asynchronous suspension> #1 RemoteImageRequest.load (package:immich_mobile/infrastructure/loaders/remote_image_request.dart:15) <asynchronous suspension> #2 CancellableImageProviderMixin.loadRequest (package:immich_mobile/presentation/widgets/images/image_provider.dart:59) <asynchronous suspension> #3 ImageStreamCompleter.setImage (package:flutter/src/painting/image_stream.dart:724) <asynchronous suspension> __
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/immich#7886
No description provided.