immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 17 Packages Projects Releases 10 Wiki Activity

[BUG] Immich App ignores Android CA trust database #1776

New Issue
Closed
opened 2026-02-05 03:43:22 +03:00 by OVERLORD · 8 comments
OVERLORD commented 2026-02-05 03:43:22 +03:00
Owner
Copy Link

Originally created by @M1cha on GitHub (Dec 12, 2023).

The bug

My immich server uses a certificate, that is signed by my own CA. I imported the CAs certificate into the Android trust store and with that, other Android apps(firefox, chrome, syncthing, gotify, ... just to name a few) can connect to my servers just fine.

But immich fails with:

MESSAGE
Invalid SSL certificate for immich.home.arpa:443

FROM
HttpSSLCertOverride

The OS that Immich Server is running on

Fedora CoreOS 39.20231119.3.0

Version of Immich Server

v1.90.2

Version of Immich Mobile App

v1.89.0

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

I'm using podman systemd units. See the immich units in my repo:
https://github.com/M1cha/homeserver/tree/227bde2604d6024f7622b919d8614864ea1b63de/files/containers

Your .env content

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=./library

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secrets for postgres and typesense. You should change these to random passwords
TYPESENSE_HOST=immich-typesense
TYPESENSE_API_KEY=some-random-text
DB_PASSWORD=postgres

# The values below this line do not need to be changed
###################################################################################
DB_HOSTNAME=immich-database
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

REDIS_HOSTNAME=immich-redis

Reproduction steps

1. start immich
2. set up an SSL proxy(e.g. using traefik)
3. enter the URL into the Android App
4. Hit `Next`
...

Additional information

No response

Originally created by @M1cha on GitHub (Dec 12, 2023). ### The bug My immich server uses a certificate, that is signed by my own CA. I imported the CAs certificate into the Android trust store and with that, other Android apps(firefox, chrome, syncthing, gotify, ... just to name a few) can connect to my servers just fine. But immich fails with: ``` MESSAGE Invalid SSL certificate for immich.home.arpa:443 FROM HttpSSLCertOverride ``` ### The OS that Immich Server is running on Fedora CoreOS 39.20231119.3.0 ### Version of Immich Server v1.90.2 ### Version of Immich Mobile App v1.89.0 ### Platform with the issue - [ ] Server - [ ] Web - [X] Mobile ### Your docker-compose.yml content ```YAML I'm using podman systemd units. See the immich units in my repo: https://github.com/M1cha/homeserver/tree/227bde2604d6024f7622b919d8614864ea1b63de/files/containers ``` ### Your .env content ```Shell # You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables # The location where your uploaded files are stored UPLOAD_LOCATION=./library # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release # Connection secrets for postgres and typesense. You should change these to random passwords TYPESENSE_HOST=immich-typesense TYPESENSE_API_KEY=some-random-text DB_PASSWORD=postgres # The values below this line do not need to be changed ################################################################################### DB_HOSTNAME=immich-database DB_USERNAME=postgres DB_DATABASE_NAME=immich REDIS_HOSTNAME=immich-redis ``` ### Reproduction steps ```bash 1. start immich 2. set up an SSL proxy(e.g. using traefik) 3. enter the URL into the Android App 4. Hit `Next` ... ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 03:43:36 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Dec 12, 2023):

Please click on this

image

Then go into the Advanced section and enable Allow self-signed SSL certificated

image

@alextran1502 commented on GitHub (Dec 12, 2023): Please click on this ![image](https://github.com/immich-app/immich/assets/27055614/6173893b-be7d-4fb2-a4e5-d18308a9eeed) Then go into the `Advanced` section and `enable Allow self-signed SSL certificated` ![image](https://github.com/immich-app/immich/assets/27055614/d6f347c4-c8a1-467d-8ae5-e5ed14c1fdb2)
OVERLORD commented 2026-02-05 03:43:39 +03:00
Author
Owner
Copy Link

@M1cha commented on GitHub (Dec 12, 2023):

I saw that but it sounds like it would disable SSL verification completely. That's not what I want though because that sounds very insecure. I want it to verify the server certificate against the trusted CA certificates that are inside the Android trust store - which among public certs also includes user certs like the one I have installed.

@M1cha commented on GitHub (Dec 12, 2023): I saw that but it sounds like it would disable SSL verification completely. That's not what I want though because that sounds very insecure. I want it to verify the server certificate against the trusted CA certificates that are inside the Android trust store - which among public certs also includes user certs like the one I have installed.
OVERLORD commented 2026-02-05 03:43:42 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Dec 12, 2023):

Flutter ships its own CA store, so it's not possible for us to use the system store. This topic has been discussed at length before so I'm going to close this issue as a duplicate.

(you should really just use let's encrypt, it's easy and free).

@bo0tzz commented on GitHub (Dec 12, 2023): Flutter ships its own CA store, so it's not possible for us to use the system store. This topic has been discussed at length before so I'm going to close this issue as a duplicate. (you should really just use let's encrypt, it's easy and free).
OVERLORD commented 2026-02-05 03:43:53 +03:00
Author
Owner
Copy Link

@M1cha commented on GitHub (Dec 12, 2023):

That's unfortunate. Apparently it would be possible to fix this by using native libraries for HTTP communication instead of DARTs libraries: https://github.com/flutter/flutter/issues/41781
Is that something you'd be willing to accept as a PR?

Also, some reasons why I'm not using letsencrypt for homeserver stuff:

  • I want it to work offline. I don't want to not have SSL just because my provider just happens to have issues while the letsencrypt certificates expired.
  • I don't want to buy a domain and I don't want public domains for all of my internal servers which are not reachable without a VPN. That's why I'm using .home.arpa domains. letsencrypt does not support those.
@M1cha commented on GitHub (Dec 12, 2023): That's unfortunate. Apparently it would be possible to fix this by using native libraries for HTTP communication instead of DARTs libraries: https://github.com/flutter/flutter/issues/41781 Is that something you'd be willing to accept as a PR? Also, some reasons why I'm not using letsencrypt for homeserver stuff: - I want it to work offline. I don't want to not have SSL just because my provider just happens to have issues while the letsencrypt certificates expired. - I don't want to buy a domain and I don't want public domains for all of my internal servers which are not reachable without a VPN. That's why I'm using `.home.arpa domains`. letsencrypt does not support those.
OVERLORD commented 2026-02-05 03:44:02 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Dec 12, 2023):

@M1cha Yes, a PR would be welcomed if you can make it work with OpenAPI code generation

@alextran1502 commented on GitHub (Dec 12, 2023): @M1cha Yes, a PR would be welcomed if you can make it work with OpenAPI code generation
OVERLORD commented 2026-02-05 03:44:07 +03:00
Author
Owner
Copy Link

@denysvitali commented on GitHub (Mar 2, 2025):

A PR has been created but now it has been closed without any reason. Why is this marked as not planned?

@denysvitali commented on GitHub (Mar 2, 2025): A PR has been created but now it has been closed without any reason. Why is this marked as not planned?
OVERLORD commented 2026-02-05 03:44:13 +03:00
Author
Owner
Copy Link

@coral746 commented on GitHub (Jun 9, 2025):

As per this comment in the PR

Hey @vfreex, we need more metrics to justify this use case. Hence, I am closing this PR. We'll consider adding if we have more requests about this feature. Thank you for the PR.

+1
Really basic case to be supported.

@coral746 commented on GitHub (Jun 9, 2025): As per this comment in the PR > Hey @vfreex, we need more metrics to justify this use case. Hence, I am closing this PR. We'll consider adding if we have more requests about this feature. Thank you for the PR. +1 Really basic case to be supported.
OVERLORD commented 2026-02-05 03:44:21 +03:00
Author
Owner
Copy Link

@AppyxDaniel commented on GitHub (Jan 19, 2026):

It is a completly basic use case required for the local network synchronization, where people usually have their own CA.

Please consider adding it.

@AppyxDaniel commented on GitHub (Jan 19, 2026): It is a completly basic use case required for the local network synchronization, where people usually have their own CA. Please consider adding it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1776
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?