immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-16 05:34:30 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

There is no problem with the https connection of immich on both sides of IOS and WEB, but Android (Xiaomi 14, Android Simulator) will report a certificate error. #5607

New Issue
Closed
opened 2026-02-05 11:35:50 +03:00 by OVERLORD · 5 comments
OVERLORD commented 2026-02-05 11:35:50 +03:00
Owner
Copy Link

Originally created by @zhz-we on GitHub (Mar 13, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

certificate
Image

There is no problem with the https connection of immich on both sides of IOS and WEB, but Android (Xiaomi 14, Android Simulator) will report a certificate error.
Image

Nginx

server {
listen 80;
server_name ****.life;

# 强制 HTTP 转 HTTPS
return 301 https://$host$request_uri;

}

server {
listen 443 ssl;
server_name ****.life;

# 允许大文件上传
client_max_body_size 50000M;

# 证书配置（根据实际路径调整）
ssl_certificate /etc/ssl/_.****.life-crt.pem;
ssl_certificate_key /etc/ssl/_.****.life-key.pem;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;

# 代理配置
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $remote_addr;
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade           $http_upgrade;
proxy_set_header Connection        "upgrade";
proxy_read_timeout 600s;
proxy_send_timeout 600s;

# 代理所有请求到 Immich
location / {
    proxy_pass http://immich-server:2283;
}

# 兼容 Let's Encrypt 和 Immich 发现路径
location /.well-known/acme-challenge/ {
    root /var/www/html;
}

location = /.well-known/immich {
    proxy_pass http://immich-server:2283;
}

}

The OS that Immich Server is running on

Windows 11 DockerDesktop 4.36

Version of Immich Server

129

Version of Immich Mobile App

129

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

#
# WARNING: Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.
#

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    extends:
      file: hwaccel.transcoding.yml
      service: vaapi-wsl # 设置为[nvenc,quicksync,rkmpp,vaapi,vaapi-wsl]之一以加速代码转换
    volumes:
      # 不要编辑下一行。如果您想更改系统上的媒体存储位置，请编辑. dev文件中UPLOAD_LOCATION的值
      # 上传路径
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      # 外部库
      - Z:/photos/hzh:/mnt/media/hzh
      - Z:/photos/lxp:/mnt/media/lxp
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    extends:
      # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
      file: hwaccel.ml.yml
      service: 'openvino-wsl' # 设置为[armnn,cuda,openvino,opnevino-wsl]之一以进行加速推理-在适用的情况下使用WSL 2的“-wsl”版本
    volumes:
      - ${CACHE_LOCATION}:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/redis:6.2-alpine@sha256:2ba50e1ac3a0ea17b736ce9db2b0a9f6f8b85d4c27d5f5accc6a416d8f42c6d5
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    healthcheck:
      test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
      interval: 5m
      start_interval: 30s
      start_period: 5m
    command: [ 'postgres', '-c', 'shared_preload_libraries=vectors.so', '-c', 'search_path="$$user", public, vectors', '-c', 'logging_collector=on', '-c', 'max_wal_size=2GB', '-c', 'shared_buffers=512MB', '-c', 'wal_compression=on' ]
    restart: always

  nginx:
    image: nginx:latest
    restart: always
    volumes:
      - ./nginx/nginx.conf.template:/etc/nginx/nginx.conf.template
      - ./nginx/proxy.conf.template:/etc/nginx/proxy.conf.template
      - ./nginx/https.conf.template:/etc/nginx/https.conf.template
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./nginx/docker-entrypoint.sh:/docker-entrypoint-mount.sh
      - E:/Certificate:/etc/ssl # 证书目录（遗留）
      - ./volumes/certbot/conf/live:/etc/letsencrypt/live # cert dir (with certbot container)
      - ./volumes/certbot/conf:/etc/letsencrypt
      - ./volumes/certbot/www:/var/www/html
    entrypoint: [ 'sh', '-c', "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh" ]
    command: ["bash", "-c", "nginx -t && tail -f /dev/null"]  # 临时命令，验证配置后停止
    environment:
      NGINX_SERVER_NAME: ${NGINX_SERVER_NAME:-_}
      NGINX_HTTPS_ENABLED: ${NGINX_HTTPS_ENABLED:-false}
      NGINX_SSL_PORT: ${NGINX_SSL_PORT:-443}
      NGINX_PORT: ${NGINX_PORT:-80}
      # You're required to add your own SSL certificates/keys to the `./nginx/ssl` directory
      # and modify the env vars below in .env if HTTPS_ENABLED is true.
      NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt}
      NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key}
      NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.1 TLSv1.2 TLSv1.3}
      NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto}
      NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-15M}
      NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65}
      NGINX_PROXY_READ_TIMEOUT: ${NGINX_PROXY_READ_TIMEOUT:-3600s}
      NGINX_PROXY_SEND_TIMEOUT: ${NGINX_PROXY_SEND_TIMEOUT:-3600s}
      NGINX_ENABLE_CERTBOT_CHALLENGE: ${NGINX_ENABLE_CERTBOT_CHALLENGE:-false}
      CERTBOT_DOMAIN: ${CERTBOT_DOMAIN:-}
    depends_on:
      immich-server:
        condition: service_healthy
      immich-machine-learning:
        condition: service_healthy
    ports:
      # - '${EXPOSE_NGINX_PORT:-80}:${NGINX_PORT:-80}'
      - '${EXPOSE_NGINX_SSL_PORT:-443}:${NGINX_SSL_PORT:-443}'
  # The Weaviate vector store.
volumes:
  model-cache:

Your .env content

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=Z:/immich/library 
# The location where your database files are stored
DB_DATA_LOCATION=./postgres
# Ai
CACHE_LOCATION=./cache
# 外部库
HZH=Z:/photos/hzh
LXP=Z:/photos/lxp
# mklink /j "E:\Docker Container Config\immich\external\aaasssddd" "E:\Docker Container Config\immich\external\hzh"

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
TZ=Asia/Shanghai

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=postgres

# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

# Nginx
NGINX_SERVER_NAME=****.life
NGINX_HTTPS_ENABLED=true
# HTTP port
NGINX_PORT=80
# 仅当 HTTPS_ENABLED 为真时才应用SSL设置
NGINX_SSL_PORT=443
# 如果HTTPS_ALEBLED为真，则需要将您自己的SSL证书/密钥添加到'./ nginx/ssl '目录
#并相应修改下面的环境变量。
NGINX_SSL_CERT_FILENAME=_.******.life-crt.pem
NGINX_SSL_CERT_KEY_FILENAME=_.******.life-key.pem
NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3
# 域名
CERTBOT_DOMAIN=*******.life
# 设置为true以接受/.众所周知的/acme-challenge/的请求
NGINX_ENABLE_CERTBOT_CHALLENGE=true
# Nginx性能调优
NGINX_WORKER_PROCESSES=auto
NGINX_CLIENT_MAX_BODY_SIZE=50000M
NGINX_KEEPALIVE_TIMEOUT=65

# 代理设置
NGINX_PROXY_READ_TIMEOUT=3600s
NGINX_PROXY_SEND_TIMEOUT=3600s


# ------------------------------
# Docker编写服务暴露主机端口收件箱
# ------------------------------
EXPOSE_NGINX_PORT=80
EXPOSE_NGINX_SSL_PORT=443

Reproduction steps

1.The picture and configuration above are detailed
2.
3.
...

Relevant log output

Additional information

No response

Originally created by @zhz-we on GitHub (Mar 13, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug **certificate** ![Image](https://github.com/user-attachments/assets/8f2e185d-fbbb-4cf3-82ce-8fca06538153) There is no problem with the https connection of immich on both sides of IOS and WEB, but Android (Xiaomi 14, Android Simulator) will report a certificate error. ![Image](https://github.com/user-attachments/assets/8cd67298-4e19-4d1d-ae98-a52181942ee5) **Nginx** server { listen 80; server_name ****.life; # 强制 HTTP 转 HTTPS return 301 https://$host$request_uri; } server { listen 443 ssl; server_name ****.life; # 允许大文件上传 client_max_body_size 50000M; # 证书配置（根据实际路径调整） ssl_certificate /etc/ssl/_.****.life-crt.pem; ssl_certificate_key /etc/ssl/_.****.life-key.pem; ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; # 代理配置 proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 600s; proxy_send_timeout 600s; # 代理所有请求到 Immich location / { proxy_pass http://immich-server:2283; } # 兼容 Let's Encrypt 和 Immich 发现路径 location /.well-known/acme-challenge/ { root /var/www/html; } location = /.well-known/immich { proxy_pass http://immich-server:2283; } } ### The OS that Immich Server is running on Windows 11 DockerDesktop 4.36 ### Version of Immich Server 129 ### Version of Immich Mobile App 129 ### Platform with the issue - [ ] Server - [ ] Web - [x] Mobile ### Your docker-compose.yml content ```YAML # # WARNING: Make sure to use the docker-compose.yml of the current release: # # https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml # # The compose file on main may not be compatible with the latest release. # name: immich services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} extends: file: hwaccel.transcoding.yml service: vaapi-wsl # 设置为[nvenc,quicksync,rkmpp,vaapi,vaapi-wsl]之一以加速代码转换 volumes: # 不要编辑下一行。如果您想更改系统上的媒体存储位置，请编辑. dev文件中UPLOAD_LOCATION的值 # 上传路径 - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro # 外部库 - Z:/photos/hzh:/mnt/media/hzh - Z:/photos/lxp:/mnt/media/lxp env_file: - .env ports: - '2283:2283' depends_on: - redis - database restart: always healthcheck: disable: false immich-machine-learning: container_name: immich_machine_learning # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag. # Example tag: ${IMMICH_VERSION:-release}-cuda image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration file: hwaccel.ml.yml service: 'openvino-wsl' # 设置为[armnn,cuda,openvino,opnevino-wsl]之一以进行加速推理-在适用的情况下使用WSL 2的“-wsl”版本 volumes: - ${CACHE_LOCATION}:/cache env_file: - .env restart: always healthcheck: disable: false redis: container_name: immich_redis image: docker.io/redis:6.2-alpine@sha256:2ba50e1ac3a0ea17b736ce9db2b0a9f6f8b85d4c27d5f5accc6a416d8f42c6d5 healthcheck: test: redis-cli ping || exit 1 restart: always database: container_name: immich_postgres image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0 environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} POSTGRES_INITDB_ARGS: '--data-checksums' volumes: # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file - ${DB_DATA_LOCATION}:/var/lib/postgresql/data healthcheck: test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1 interval: 5m start_interval: 30s start_period: 5m command: [ 'postgres', '-c', 'shared_preload_libraries=vectors.so', '-c', 'search_path="$$user", public, vectors', '-c', 'logging_collector=on', '-c', 'max_wal_size=2GB', '-c', 'shared_buffers=512MB', '-c', 'wal_compression=on' ] restart: always nginx: image: nginx:latest restart: always volumes: - ./nginx/nginx.conf.template:/etc/nginx/nginx.conf.template - ./nginx/proxy.conf.template:/etc/nginx/proxy.conf.template - ./nginx/https.conf.template:/etc/nginx/https.conf.template - ./nginx/conf.d:/etc/nginx/conf.d - ./nginx/docker-entrypoint.sh:/docker-entrypoint-mount.sh - E:/Certificate:/etc/ssl # 证书目录（遗留） - ./volumes/certbot/conf/live:/etc/letsencrypt/live # cert dir (with certbot container) - ./volumes/certbot/conf:/etc/letsencrypt - ./volumes/certbot/www:/var/www/html entrypoint: [ 'sh', '-c', "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh" ] command: ["bash", "-c", "nginx -t && tail -f /dev/null"] # 临时命令，验证配置后停止 environment: NGINX_SERVER_NAME: ${NGINX_SERVER_NAME:-_} NGINX_HTTPS_ENABLED: ${NGINX_HTTPS_ENABLED:-false} NGINX_SSL_PORT: ${NGINX_SSL_PORT:-443} NGINX_PORT: ${NGINX_PORT:-80} # You're required to add your own SSL certificates/keys to the `./nginx/ssl` directory # and modify the env vars below in .env if HTTPS_ENABLED is true. NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt} NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key} NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.1 TLSv1.2 TLSv1.3} NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto} NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-15M} NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65} NGINX_PROXY_READ_TIMEOUT: ${NGINX_PROXY_READ_TIMEOUT:-3600s} NGINX_PROXY_SEND_TIMEOUT: ${NGINX_PROXY_SEND_TIMEOUT:-3600s} NGINX_ENABLE_CERTBOT_CHALLENGE: ${NGINX_ENABLE_CERTBOT_CHALLENGE:-false} CERTBOT_DOMAIN: ${CERTBOT_DOMAIN:-} depends_on: immich-server: condition: service_healthy immich-machine-learning: condition: service_healthy ports: # - '${EXPOSE_NGINX_PORT:-80}:${NGINX_PORT:-80}' - '${EXPOSE_NGINX_SSL_PORT:-443}:${NGINX_SSL_PORT:-443}' # The Weaviate vector store. volumes: model-cache: ``` ### Your .env content ```Shell # You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables # The location where your uploaded files are stored UPLOAD_LOCATION=Z:/immich/library # The location where your database files are stored DB_DATA_LOCATION=./postgres # Ai CACHE_LOCATION=./cache # 外部库 HZH=Z:/photos/hzh LXP=Z:/photos/lxp # mklink /j "E:\Docker Container Config\immich\external\aaasssddd" "E:\Docker Container Config\immich\external\hzh" # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List TZ=Asia/Shanghai # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release # Connection secret for postgres. You should change it to a random password # Please use only the characters `A-Za-z0-9`, without special characters or spaces DB_PASSWORD=postgres # The values below this line do not need to be changed ################################################################################### DB_USERNAME=postgres DB_DATABASE_NAME=immich # Nginx NGINX_SERVER_NAME=****.life NGINX_HTTPS_ENABLED=true # HTTP port NGINX_PORT=80 # 仅当 HTTPS_ENABLED 为真时才应用SSL设置 NGINX_SSL_PORT=443 # 如果HTTPS_ALEBLED为真，则需要将您自己的SSL证书/密钥添加到'./ nginx/ssl '目录 #并相应修改下面的环境变量。 NGINX_SSL_CERT_FILENAME=_.******.life-crt.pem NGINX_SSL_CERT_KEY_FILENAME=_.******.life-key.pem NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3 # 域名 CERTBOT_DOMAIN=*******.life # 设置为true以接受/.众所周知的/acme-challenge/的请求 NGINX_ENABLE_CERTBOT_CHALLENGE=true # Nginx性能调优 NGINX_WORKER_PROCESSES=auto NGINX_CLIENT_MAX_BODY_SIZE=50000M NGINX_KEEPALIVE_TIMEOUT=65 # 代理设置 NGINX_PROXY_READ_TIMEOUT=3600s NGINX_PROXY_SEND_TIMEOUT=3600s # ------------------------------ # Docker编写服务暴露主机端口收件箱 # ------------------------------ EXPOSE_NGINX_PORT=80 EXPOSE_NGINX_SSL_PORT=443 ``` ### Reproduction steps 1.The picture and configuration above are detailed 2. 3. ... ### Relevant log output ```shell ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 11:35:53 +03:00
Author
Owner
Copy Link

@mmomjian commented on GitHub (Mar 13, 2025):

Hello,

This is most likely an issue with configuration of your reverse proxy - perhaps it is not sending the full chain but just part of the chain, for example. Please share the full URL (here or on our Discord) so someone can check the certificates being presented.

Please also test with curl on the command line: curl -vL https://immich.domain.tld:9527 and post the output here

@mmomjian commented on GitHub (Mar 13, 2025): Hello, This is most likely an issue with configuration of your reverse proxy - perhaps it is not sending the full chain but just part of the chain, for example. Please share the full URL (here or on our Discord) so someone can check the certificates being presented. Please also test with curl on the command line: `curl -vL https://immich.domain.tld:9527` and post the output here
OVERLORD commented 2026-02-05 11:35:54 +03:00
Author
Owner
Copy Link

@mmomjian commented on GitHub (Mar 13, 2025):

curl -v https://nas.domain.life:9527/api

* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
@mmomjian commented on GitHub (Mar 13, 2025): ``` curl -v https://nas.domain.life:9527/api * ALPN: offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (OUT), TLS alert, unknown CA (560): * SSL certificate problem: unable to get local issuer certificate * Closing connection 0 curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. ```
OVERLORD commented 2026-02-05 11:35:55 +03:00
Author
Owner
Copy Link

@mmomjian commented on GitHub (Mar 13, 2025):

Hello, this is a reverse proxy issue.

@mmomjian commented on GitHub (Mar 13, 2025): Hello, this is a reverse proxy issue.
OVERLORD commented 2026-02-05 11:35:56 +03:00
Author
Owner
Copy Link

@zhz-we commented on GitHub (Mar 13, 2025):

Hello, I'm sorry, I had a delay. I took you so late to reply. This is the result of the curl -vL command. Thank you for your help.

`

  • IPv6: (none)
  • IPv4: 125.78.13.88
  • Trying 125.78.13.88:9527...
  • Connected to nas.****.life (125.78.13.88) port 9527
  • schannel: disabled automatic use of client certificate
  • ALPN: curl offers http/1.1
  • ALPN: server accepted http/1.1
  • using HTTP/1.x

GET / HTTP/1.1
Host: nas.****.life:9527
User-Agent: curl/8.9.1
Accept: /

  • Request completely sent off

  • schannel: remote party requests renegotiation

  • schannel: renegotiating SSL/TLS connection

  • schannel: SSL/TLS connection renegotiated

  • schannel: remote party requests renegotiation

  • schannel: renegotiating SSL/TLS connection

  • schannel: SSL/TLS connection renegotiated
    < HTTP/1.1 200 OK < Server: nginx/1.27.4 < Date: Thu, 13 Mar 2025 11:24:58 GMT < Content-Type: text/html; charset=utf-8
    < Content-Length: 6853 < Connection: keep-alive < X-Powered-By: Express < Cache-Control: no-store <
    ETag: "1ac5-GeYRm+1r4naJvEqqjDOEjn1LKLw" < <!doctype html>

    <html> <head> <style> /* prevent FOUC */ html { height: 100%; width: 100%; } 
    body,
html {
  margin: 0;
  padding: 0;
}

@keyframes delayedVisibility {
  to {
    visibility: visible;
  }
}

@keyframes loadspin {
  100% {
    transform: rotate(360deg);
  }
}

#stencil {
  --stencil-width: 150px;
  display: flex;
  width: var(--stencil-width);
  margin-left: auto;
  margin-right: auto;
  margin-top: calc(50vh - var(--stencil-width) / 2);
  margin-bottom: 100vh;
  place-items: center;
  justify-content: center;
  overflow: hidden;
  visibility: hidden;
  animation:
    0s linear 0.3s forwards delayedVisibility,
    loadspin 8s linear infinite;
}

.bg-immich-bg {
  background-color: white;
}

.dark .dark\:bg-immich-dark-bg {
  background-color: black;
}

    </style>

    <script> /** * Prevent FOUC on page load. */ const colorThemeKeyName = 'color-theme'; let theme = localStorage.getItem(colorThemeKeyName); if (!theme) { theme = { value: 'light', system: true }; } else if (theme === 'dark' || theme === 'light') { theme = { value: theme, system: false }; localStorage.setItem(colorThemeKeyName, JSON.stringify(theme)); } else { theme = JSON.parse(theme); } let themeValue = theme.value; if (theme.system) { if (window.matchMedia('(prefers-color-scheme: dark)').matches) { themeValue = 'dark'; } else { themeValue = 'light'; } } if (themeValue === 'light') { document.documentElement.classList.remove('dark'); } else { document.documentElement.classList.add('dark'); } </script> </head>

    <style type="text/css"> .st0 { fill: #fa2921; } 
        .st1 {
      fill: #ed79b5;
    }

    .st2 {
      fill: #ffb400;
    }

    .st3 {
      fill: #1e83f7;
    }

    .st4 {
      fill: #18c249;
    }
  </style>
  <g>
    <path class="st0" d="M375.48,267.63c38.64,34.21,69.78,70.87,89.82,105.42c34.42-61.56,57.42-134.71,57.71-181.3
          c0-0.33,0-0.63,0-0.91c0-68.94-68.77-95.77-128.01-95.77s-128.01,26.83-128.01,95.77c0,0.94,0,2.2,0,3.72
          C300.01,209.24,339.15,235.47,375.48,267.63z" />
    <path class="st1" d="M164.7,455.63c24.15-26.87,61.2-55.99,103.01-80.61c44.48-26.18,88.97-44.47,128.02-52.84
          c-47.91-51.76-110.37-96.24-154.6-110.91c-0.31-0.1-0.6-0.19-0.86-0.28c-65.57-21.3-112.34,35.81-130.64,92.15
          c-18.3,56.34-14.04,130.04,51.53,151.34C162.05,454.77,163.25,455.16,164.7,455.63z" />
    <path class="st2" d="M681.07,302.19c-18.3-56.34-65.07-113.45-130.64-92.15c-0.9,0.29-2.1,0.68-3.54,1.15
          c-3.75,35.93-16.6,81.27-35.96,125.76c-20.59,47.32-45.84,88.27-72.51,118c69.18,13.72,145.86,12.98,190.26-1.14
          c0.31-0.1,0.6-0.2,0.86-0.28C695.11,432.22,699.37,358.52,681.07,302.19z" />
    <path class="st3" d="M336.54,510.71c-11.15-50.39-14.8-98.36-10.7-138.08c-64.03,29.57-125.63,75.23-153.26,112.76
          c-0.19,0.26-0.37,0.51-0.53,0.73c-40.52,55.78-0.66,117.91,47.27,152.72c47.92,34.82,119.33,53.54,159.86-2.24
          c0.56-0.76,1.3-1.78,2.19-3.01C363.28,602.32,347.02,558.08,336.54,510.71z" />
    <path class="st4" d="M617.57,482.52c-35.33,7.54-82.42,9.33-130.72,4.66c-51.37-4.96-98.11-16.32-134.63-32.5
          c8.33,70.03,32.73,142.73,59.88,180.6c0.19,0.26,0.37,0.51,0.53,0.73c40.52,55.78,111.93,37.06,159.86,2.24
          c47.92-34.82,87.79-96.95,47.27-152.72C619.2,484.77,618.46,483.75,617.57,482.52z" />
  </g>
</svg>
    <script> { __sveltekit_1n953bm = { base: "" }; 
        const element = document.currentScript.parentElement;

    Promise.all([
      import("/_app/immutable/entry/start.Dti-NM25.js"),
      import("/_app/immutable/entry/app.6B4UViqF.js")
    ]).then(([kit, app]) => {
      kit.start(app, element);
    });
  }
</script>
    </html> * Connection #0 to host nas.****.life left intact

`

你好

这很可能是反向代理配置的问题 - 例如，它可能没有发送整个链，而只是链的一部分。请分享完整的 URL（这里或我们的 Discord），以便有人可以检查所提供的证书。

请在命令行上使用 curl 进行测试：并在此处发布输出curl -vL https://immich.domain.tld:9527

@zhz-we commented on GitHub (Mar 13, 2025): **Hello, I'm sorry, I had a delay. I took you so late to reply. This is the result of the curl -vL command. Thank you for your help.** ` * IPv6: (none) * IPv4: 125.78.13.88 * Trying 125.78.13.88:9527... * Connected to nas.****.life (125.78.13.88) port 9527 * schannel: disabled automatic use of client certificate * ALPN: curl offers http/1.1 * ALPN: server accepted http/1.1 * using HTTP/1.x > GET / HTTP/1.1 > Host: nas.****.life:9527 > User-Agent: curl/8.9.1 > Accept: */* > * Request completely sent off * schannel: remote party requests renegotiation * schannel: renegotiating SSL/TLS connection * schannel: SSL/TLS connection renegotiated * schannel: remote party requests renegotiation * schannel: renegotiating SSL/TLS connection * schannel: SSL/TLS connection renegotiated < HTTP/1.1 200 OK < Server: nginx/1.27.4 < Date: Thu, 13 Mar 2025 11:24:58 GMT < Content-Type: text/html; charset=utf-8 < Content-Length: 6853 < Connection: keep-alive < X-Powered-By: Express < Cache-Control: no-store < ETag: "1ac5-GeYRm+1r4naJvEqqjDOEjn1LKLw" < <!doctype html> <html> <head> <!-- (used for SSR) --> <!-- metadata:tags --> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1" /> <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" /> <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png" /> <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png" /> <link rel="icon" type="image/png" sizes="48x48" href="/favicon-48.png" /> <link rel="icon" type="image/png" sizes="96x96" href="/favicon-96.png" /> <link rel="icon" type="image/png" sizes="144x144" href="/favicon-144.png" /> <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180.png" /> <link rel="preload" as="font" type="font/ttf" href="/_app/immutable/assets/Overpass.DCP28BvT.ttf" crossorigin="anonymous" /> <link rel="preload" as="font" type="font/ttf" href="/_app/immutable/assets/OverpassMono.XkUhFDDw.ttf" crossorigin="anonymous" /> <link rel="modulepreload" href="/_app/immutable/entry/start.Dti-NM25.js"> <link rel="modulepreload" href="/_app/immutable/chunks/f67Ns1jr.js"> <link rel="modulepreload" href="/_app/immutable/chunks/CGUdWDT-.js"> <link rel="modulepreload" href="/_app/immutable/chunks/DIeogL5L.js"> <link rel="modulepreload" href="/_app/immutable/chunks/CYgJF_JY.js"> <link rel="modulepreload" href="/_app/immutable/entry/app.6B4UViqF.js"> <link rel="modulepreload" href="/_app/immutable/chunks/CmsKOCeN.js"> <link rel="modulepreload" href="/_app/immutable/chunks/CpqwS_fC.js"> <link rel="modulepreload" href="/_app/immutable/chunks/Bx69Licq.js"> <link rel="modulepreload" href="/_app/immutable/chunks/D0HzCejU.js"> <link rel="modulepreload" href="/_app/immutable/chunks/BNcurJab.js"> <link rel="modulepreload" href="/_app/immutable/chunks/BDr9Qe-U.js"> <link rel="modulepreload" href="/_app/immutable/chunks/DKiUovez.js"> <link rel="modulepreload" href="/_app/immutable/chunks/DxWCKSWV.js"> <style> /* prevent FOUC */ html { height: 100%; width: 100%; } body, html { margin: 0; padding: 0; } @keyframes delayedVisibility { to { visibility: visible; } } @keyframes loadspin { 100% { transform: rotate(360deg); } } #stencil { --stencil-width: 150px; display: flex; width: var(--stencil-width); margin-left: auto; margin-right: auto; margin-top: calc(50vh - var(--stencil-width) / 2); margin-bottom: 100vh; place-items: center; justify-content: center; overflow: hidden; visibility: hidden; animation: 0s linear 0.3s forwards delayedVisibility, loadspin 8s linear infinite; } .bg-immich-bg { background-color: white; } .dark .dark\:bg-immich-dark-bg { background-color: black; } </style> <script> /** * Prevent FOUC on page load. */ const colorThemeKeyName = 'color-theme'; let theme = localStorage.getItem(colorThemeKeyName); if (!theme) { theme = { value: 'light', system: true }; } else if (theme === 'dark' || theme === 'light') { theme = { value: theme, system: false }; localStorage.setItem(colorThemeKeyName, JSON.stringify(theme)); } else { theme = JSON.parse(theme); } let themeValue = theme.value; if (theme.system) { if (window.matchMedia('(prefers-color-scheme: dark)').matches) { themeValue = 'dark'; } else { themeValue = 'light'; } } if (themeValue === 'light') { document.documentElement.classList.remove('dark'); } else { document.documentElement.classList.add('dark'); } </script> <link rel="stylesheet" href="/custom.css" /> </head> <noscript class="absolute z-[1000] flex h-screen w-screen place-content-center place-items-center bg-immich-bg dark:bg-immich-dark-bg dark:text-immich-dark-fg"> To use Immich, you must enable JavaScript or use a JavaScript compatible browser. </noscript> <body class="bg-immich-bg dark:bg-immich-dark-bg"> <div id="stencil"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 792 792"> <style type="text/css"> .st0 { fill: #fa2921; } .st1 { fill: #ed79b5; } .st2 { fill: #ffb400; } .st3 { fill: #1e83f7; } .st4 { fill: #18c249; } </style> <g> <path class="st0" d="M375.48,267.63c38.64,34.21,69.78,70.87,89.82,105.42c34.42-61.56,57.42-134.71,57.71-181.3 c0-0.33,0-0.63,0-0.91c0-68.94-68.77-95.77-128.01-95.77s-128.01,26.83-128.01,95.77c0,0.94,0,2.2,0,3.72 C300.01,209.24,339.15,235.47,375.48,267.63z" /> <path class="st1" d="M164.7,455.63c24.15-26.87,61.2-55.99,103.01-80.61c44.48-26.18,88.97-44.47,128.02-52.84 c-47.91-51.76-110.37-96.24-154.6-110.91c-0.31-0.1-0.6-0.19-0.86-0.28c-65.57-21.3-112.34,35.81-130.64,92.15 c-18.3,56.34-14.04,130.04,51.53,151.34C162.05,454.77,163.25,455.16,164.7,455.63z" /> <path class="st2" d="M681.07,302.19c-18.3-56.34-65.07-113.45-130.64-92.15c-0.9,0.29-2.1,0.68-3.54,1.15 c-3.75,35.93-16.6,81.27-35.96,125.76c-20.59,47.32-45.84,88.27-72.51,118c69.18,13.72,145.86,12.98,190.26-1.14 c0.31-0.1,0.6-0.2,0.86-0.28C695.11,432.22,699.37,358.52,681.07,302.19z" /> <path class="st3" d="M336.54,510.71c-11.15-50.39-14.8-98.36-10.7-138.08c-64.03,29.57-125.63,75.23-153.26,112.76 c-0.19,0.26-0.37,0.51-0.53,0.73c-40.52,55.78-0.66,117.91,47.27,152.72c47.92,34.82,119.33,53.54,159.86-2.24 c0.56-0.76,1.3-1.78,2.19-3.01C363.28,602.32,347.02,558.08,336.54,510.71z" /> <path class="st4" d="M617.57,482.52c-35.33,7.54-82.42,9.33-130.72,4.66c-51.37-4.96-98.11-16.32-134.63-32.5 c8.33,70.03,32.73,142.73,59.88,180.6c0.19,0.26,0.37,0.51,0.53,0.73c40.52,55.78,111.93,37.06,159.86,2.24 c47.92-34.82,87.79-96.95,47.27-152.72C619.2,484.77,618.46,483.75,617.57,482.52z" /> </g> </svg> </div> <div> <script> { __sveltekit_1n953bm = { base: "" }; const element = document.currentScript.parentElement; Promise.all([ import("/_app/immutable/entry/start.Dti-NM25.js"), import("/_app/immutable/entry/app.6B4UViqF.js") ]).then(([kit, app]) => { kit.start(app, element); }); } </script> </div> </body> </html> * Connection #0 to host nas.****.life left intact ` > 你好 > > 这很可能是反向代理配置的问题 - 例如，它可能没有发送整个链，而只是链的一部分。请分享完整的 URL（这里或我们的 Discord），以便有人可以检查所提供的证书。 > > 请在命令行上使用 curl 进行测试：并在此处发布输出`curl -vL https://immich.domain.tld:9527`
OVERLORD commented 2026-02-05 11:35:56 +03:00
Author
Owner
Copy Link

@zhz-we commented on GitHub (Mar 13, 2025):

🙏I'm sorry, this is a photo album service for a friend. His Android machine cannot be accessed. In the future, the service for a friend cannot be maintained, and it is inconvenient to disclose the domain name.

Image

@zhz-we commented on GitHub (Mar 13, 2025): 🙏I'm sorry, this is a photo album service for a friend. His Android machine cannot be accessed. In the future, the service for a friend cannot be maintained, and it is inconvenient to disclose the domain name. ![Image](https://github.com/user-attachments/assets/3267160f-11f5-49d2-9e05-b77e9b8d9099)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#5607
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?