immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-25 19:08:38 +03:00
Code Issues 783 Packages Projects Releases 12 Wiki Activity

Error in OAuth discovery: Error: self-signed certificate #4166

New Issue
Closed
opened 2026-02-05 09:48:39 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 09:48:39 +03:00
Owner
Copy Link

Originally created by @goarano on GitHub (Aug 27, 2024).

The bug

Hey immich team

First of all, you're doing a great job with this software, I'm enjoying it immensely :)

I am using a self-hosted Authentik instance for OAuth login with Immich, I followed the tutorial in the docs when we were around version 1.105.
Unfortunately, I recently started to experience a problem with OAuth, after it used to work without an issue.
Whenever I click the "Login using OAuth" button, the following message appears in the UI and the server logs:

Error in OAuth discovery: Error: self-signed certificate

I am unclear which certificate this refers to, but I am self hosting both immich and authentik on HTTPS using valid Letsencrypt certificates.

The relevant OAuth config is the following (using the immich helm chart):

immich:
  configuration:
    oauth:
      enabled: true
      issuerUrl: "https://AUTHENTIK_DOMAIN/application/o/immich/"
      clientId: "$OAUTH_CLIENT_ID"
      clientSecret: "$OAUTH_CLIENT_SECRET"
      scope: "openid email profile"
      #signingAlgorithm: "RS256",
      #storageLabelClaim: "preferred_username",
      #storageQuotaClaim: "immich_quota",
      #defaultStorageQuota: 0,
      buttonText: "Login with Authentik"
      #autoRegister: true,
      autoLaunch: true # automatically redirect to oauth
      #mobileOverrideEnabled: false,
      #mobileRedirectUri: ""

The crazy part is that it just stopped working out of the blue.
I've updated both Authentik (now 2024.6.4) and Immich to the latest versions, but it didn't help.
The problem is encountered on all devices (several computers and phones).

Do you have any idea what could have caused this and how I could fix it?

Thanks and cheers,
goarano

The OS that Immich Server is running on

helm chart on k3s on Debian

Version of Immich Server

v1.112.1

Version of Immich Mobile App

v1.107.2

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

immich:
  configuration:
    oauth:
      enabled: true
      issuerUrl: "https://AUTHENTIK_DOMAIN/application/o/immich/"
      clientId: "$OAUTH_CLIENT_ID"
      clientSecret: "$OAUTH_CLIENT_SECRET"
      scope: "openid email profile"
      #signingAlgorithm: "RS256",
      #storageLabelClaim: "preferred_username",
      #storageQuotaClaim: "immich_quota",
      #defaultStorageQuota: 0,
      buttonText: "Login with Authentik"
      #autoRegister: true,
      autoLaunch: true # automatically redirect to oauth
      #mobileOverrideEnabled: false,
      #mobileRedirectUri: ""

Your .env content

no relevant content

Reproduction steps

  1. configure OAuth with Authentik 2024.6.4
  2. Login via OAuth is working, so we wait an undefined amount of time
  3. Error in OAuth discovery: Error: self-signed certificate when clicking "Login using OAuth"

Relevant log output

[Nest] 17  - 08/27/2024, 12:12:16 PM   ERROR [Api:AuthService~e3jwrzuh] Error in OAuth discovery: Error: self-signed certificate
[Nest] 17  - 08/27/2024, 12:12:16 PM   ERROR [Api:AuthService~e3jwrzuh] Error: self-signed certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34)
    at TLSSocket.emit (node:events:519:28)
    at TLSSocket._finishInit (node:_tls_wrap:1085:8)
    at ssl.onhandshakedone (node:_tls_wrap:871:12)
    at TLSWrap.callbackTrampoline (node:internal/async_hooks:130:17)

Additional information

No response

Originally created by @goarano on GitHub (Aug 27, 2024). ### The bug Hey immich team First of all, you're doing a great job with this software, I'm enjoying it immensely :) I am using a self-hosted Authentik instance for OAuth login with Immich, I followed the tutorial in the docs when we were around version 1.105. Unfortunately, I recently started to experience a problem with OAuth, after it used to work without an issue. Whenever I click the "Login using OAuth" button, the following message appears in the UI and the server logs: ``` Error in OAuth discovery: Error: self-signed certificate ``` I am unclear which certificate this refers to, but I am self hosting both immich and authentik on HTTPS using valid Letsencrypt certificates. The relevant OAuth config is the following (using the immich helm chart): ```yaml immich: configuration: oauth: enabled: true issuerUrl: "https://AUTHENTIK_DOMAIN/application/o/immich/" clientId: "$OAUTH_CLIENT_ID" clientSecret: "$OAUTH_CLIENT_SECRET" scope: "openid email profile" #signingAlgorithm: "RS256", #storageLabelClaim: "preferred_username", #storageQuotaClaim: "immich_quota", #defaultStorageQuota: 0, buttonText: "Login with Authentik" #autoRegister: true, autoLaunch: true # automatically redirect to oauth #mobileOverrideEnabled: false, #mobileRedirectUri: "" ``` The crazy part is that it just stopped working out of the blue. I've updated both Authentik (now 2024.6.4) and Immich to the latest versions, but it didn't help. The problem is encountered on all devices (several computers and phones). Do you have any idea what could have caused this and how I could fix it? Thanks and cheers, goarano ### The OS that Immich Server is running on helm chart on k3s on Debian ### Version of Immich Server v1.112.1 ### Version of Immich Mobile App v1.107.2 ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML immich: configuration: oauth: enabled: true issuerUrl: "https://AUTHENTIK_DOMAIN/application/o/immich/" clientId: "$OAUTH_CLIENT_ID" clientSecret: "$OAUTH_CLIENT_SECRET" scope: "openid email profile" #signingAlgorithm: "RS256", #storageLabelClaim: "preferred_username", #storageQuotaClaim: "immich_quota", #defaultStorageQuota: 0, buttonText: "Login with Authentik" #autoRegister: true, autoLaunch: true # automatically redirect to oauth #mobileOverrideEnabled: false, #mobileRedirectUri: "" ``` ### Your .env content ```Shell no relevant content ``` ### Reproduction steps 1. configure OAuth with Authentik 2024.6.4 2. Login via OAuth is working, so we wait an undefined amount of time 3. ```Error in OAuth discovery: Error: self-signed certificate``` when clicking "Login using OAuth" ### Relevant log output ```shell [Nest] 17 - 08/27/2024, 12:12:16 PM ERROR [Api:AuthService~e3jwrzuh] Error in OAuth discovery: Error: self-signed certificate [Nest] 17 - 08/27/2024, 12:12:16 PM ERROR [Api:AuthService~e3jwrzuh] Error: self-signed certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34) at TLSSocket.emit (node:events:519:28) at TLSSocket._finishInit (node:_tls_wrap:1085:8) at ssl.onhandshakedone (node:_tls_wrap:871:12) at TLSWrap.callbackTrampoline (node:internal/async_hooks:130:17) ``` ### Additional information _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#4166
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?