immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

Immich App not honouring install CA certificate #7071

New Issue
Closed
opened 2026-02-05 12:45:34 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 12:45:34 +03:00
Owner
Copy Link

Originally created by @Tupsi on GitHub (Sep 2, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

I am trying to use the automatic switching between URLs for internal and external. This works fine if I use the unencrypted http://ipadresse:2283 url for my internal. It stops working, when I switch to an URL going over my traefic install with an "Invalid SSL certificate" for the domain inside the url i use there (immich.home.arpa).

I created the certificates used for my revery proxy traefic with an internal root CA certificate in the chain (so this is NOT a self signed cert in the sense how certs work) and installed that root CA certificate in my Android device. Checking the URL in any browser on the device does NOT show an invalid certificate (as it isn't anymore after installing that root CA cert), yet immich still complains about it. So it seems, the App does not honor installed root CA certificates like the rest of the android system does.

It would be nice if you could support that, otherwise one would have to rely on unencrypted traffic inside your own network, which looking at the calendar seeing 2025 as a year there should not be longer deemed "normal" and/or ok.

I filed this under bug and not feature request, as the app behaves differently then any browser installed on the device.

The OS that Immich Server is running on

docker

Version of Immich Server

v.1.39.4

Version of Immich Mobile App

v.140.1

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

Samsung Galaxy 22 (Android 15), Pixel 10 Pro (Android 16)

Your docker-compose.yml content

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
      - /myarchive:/media/bilderarchiv:ro
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.immich.entrypoints=websecure"
      - "traefik.http.routers.immich.tls=true"
      - "traefik.http.services.immich.loadbalancer.server.port=2283"
      - "traefik.http.routers.immich.rule=Host(`immich.home.arpa`)"
      - "traefik.http.routers.immich.tls.certresolver=myresolver"
    networks:
      - proxy
networks:
  proxy:
    external: true

Your .env content

# The location where your uploaded files are stored
UPLOAD_LOCATION=./library

# The location where your database files are stored. Network shares are not supported for the database
DB_DATA_LOCATION=./postgres

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
# TZ=Etc/UTC

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

Reproduction steps

  1. install server behind reverse proxy with a certificate with is neither self signed, nor from official trust anchor
  2. install the root CA certificate of your own CA you created the cert from step 1 on your android device
  3. try to access your immich server over that url
  4. find that its not working and the errors in the logs

Relevant log output

Additional information

Invalid SSL certificate for immich.home.arpa:443

Originally created by @Tupsi on GitHub (Sep 2, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug I am trying to use the automatic switching between URLs for internal and external. This works fine if I use the unencrypted http://ipadresse:2283 url for my internal. It stops working, when I switch to an URL going over my traefic install with an "Invalid SSL certificate" for the domain inside the url i use there (immich.home.arpa). I created the certificates used for my revery proxy traefic with an internal root CA certificate in the chain (so this is NOT a self signed cert in the sense how certs work) and installed that root CA certificate in my Android device. Checking the URL in any browser on the device does NOT show an invalid certificate (as it isn't anymore after installing that root CA cert), yet immich still complains about it. So it seems, the App does not honor installed root CA certificates like the rest of the android system does. It would be nice if you could support that, otherwise one would have to rely on unencrypted traffic inside your own network, which looking at the calendar seeing 2025 as a year there should not be longer deemed "normal" and/or ok. I filed this under bug and not feature request, as the app behaves differently then any browser installed on the device. ### The OS that Immich Server is running on docker ### Version of Immich Server v.1.39.4 ### Version of Immich Mobile App v.140.1 ### Platform with the issue - [ ] Server - [ ] Web - [x] Mobile ### Device make and model Samsung Galaxy 22 (Android 15), Pixel 10 Pro (Android 16) ### Your docker-compose.yml content ```YAML services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} volumes: - ${UPLOAD_LOCATION}:/data - /etc/localtime:/etc/localtime:ro - /myarchive:/media/bilderarchiv:ro env_file: - .env ports: - '2283:2283' depends_on: - redis - database restart: always healthcheck: disable: false labels: - "traefik.enable=true" - "traefik.http.routers.immich.entrypoints=websecure" - "traefik.http.routers.immich.tls=true" - "traefik.http.services.immich.loadbalancer.server.port=2283" - "traefik.http.routers.immich.rule=Host(`immich.home.arpa`)" - "traefik.http.routers.immich.tls.certresolver=myresolver" networks: - proxy networks: proxy: external: true ``` ### Your .env content ```Shell # The location where your uploaded files are stored UPLOAD_LOCATION=./library # The location where your database files are stored. Network shares are not supported for the database DB_DATA_LOCATION=./postgres # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List # TZ=Etc/UTC # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release ``` ### Reproduction steps 1. install server behind reverse proxy with a certificate with is neither self signed, nor from official trust anchor 2. install the root CA certificate of your own CA you created the cert from step 1 on your android device 3. try to access your immich server over that url 4. find that its not working and the errors in the logs ### Relevant log output ```shell ``` ### Additional information Invalid SSL certificate for [immich.home.arpa:443](http://immich.home.arpa:443/)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#7071
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?