immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

[Android] LetsEncrypt Wild Card Cert "Invalid SSL certificate" #7993

New Issue
Closed
opened 2026-02-05 13:27:23 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 13:27:23 +03:00
Owner
Copy Link

Originally created by @stratus-ss on GitHub (Dec 5, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

This is similar to this discussion
However, in my case, immich works fine in the browser. I am presenting a letsencrypt wild card

Image

I am using a wild card cert for 5 different vhosts on this server. I am using Apache reverse proxy

<VirtualHost pictures.mydomain.com:80>
    ServerName pictures.mydomain.com
    Redirect permanent / https://pictures.mydomain.com/
</VirtualHost>

<VirtualHost pictures.mydomain.com:443>
    ServerName pictures.mydomain.com

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
    
    
    # Preserve original host information
    ProxyPreserveHost On
        ProxyRequests Off
        
    # Essential headers
    RequestHeader set "X-Forwarded-Proto" "https"
            RequestHeader set "X-Forwarded-Host" "pictures.mydomain.com"
        RequestHeader set "X-Real-IP" "%{REMOTE_ADDR}s"
        RequestHeader set "X-Forwarded-For" "%{REMOTE_ADDR}s"
        
        
        
        RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*)           ws://localhost:2283/$1 [P,L]
    RewriteCond %{HTTP:Upgrade} !=websocket [NC]
    RewriteRule /(.*)           http://localhost:2283/$1 [P,L]
    
    # Standard proxy configuration
        ProxyPass / http://localhost:2283/
    ProxyPassReverse / http://localhost:2283/
            
</VirtualHost>

I had to uninstall the app and reinstall it because the "Self Signed Cert" option was greyed out. Toggling this, allows the app to function again.

The other vhosts do not have this problem using a wild card cert so I don't think it is specifically an android problem.

Is this expected behaviour? If not, how can I proceed to troubleshoot this

The OS that Immich Server is running on

Docker on RHEL 9

Version of Immich Server

2.3.1

Version of Immich Mobile App

2.3.0.build.3027

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

Pixel 6a running GrapheneOS

Your docker-compose.yml content

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-cuda
      file: hwaccel.ml.yml
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false
    environment:
      - EXTRA_ARGS=--disable-cuda-graph

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always

volumes:
  model-cache:

Your .env content

not relevant

Reproduction steps

  1. Download App from Play Store
  2. Attempt to login
  3. Fail to login
    ...

Relevant log output

2025-12-05 10:57:28.205050 | severe   | ApiService           | Error while checking server availability | ApiException 400: TLS/SSL communication failed: GET /server/ping (Inner exception: HandshakeException: Handshake error in client (OS Error: 
	CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate(handshake.cc:297)))

#0      _SecureFilterImpl._handshake (dart:io-patch/secure_socket_patch.dart:101)
#1      _SecureFilterImpl.handshake (dart:io-patch/secure_socket_patch.dart:146)
#2      _RawSecureSocket._secureHandshake (dart:io/secure_socket.dart:1009)
#3      _RawSecureSocket._tryFilter (dart:io/secure_socket.dart:1139)
<asynchronous suspension>
 |
#0      ApiClient.invokeAPI (package:openapi/api_client.dart:111)
<asynchronous suspension>
#1      ServerApi.pingServer (package:openapi/api/server_api.dart:672)
<asynchronous suspension>
#2      Future.timeout.<anonymous closure> (dart:async/future_impl.dart:1061)
<asynchronous suspension>
#3      ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart:124)
<asynchronous suspension>
#4      ApiService.resolveEndpoint (package:immich_mobile/services/api.service.dart:109)
<asynchronous suspension>
#5      ApiService.resolveAndSetEndpoint (package:immich_mobile/services/api.service.dart:85)
<asynchronous suspension>
#6      AuthService.validateServerUrl (package:immich_mobile/services/auth.service.dart:59)
<asynchronous suspension>
#7      LoginForm.build.getServerAuthSettings (package:immich_mobile/widgets/forms/login/login_form.dart:100)
<asynchronous suspension>

2025-12-05 10:57:28.204860 | severe   | HttpSSLCertOverride  | Invalid SSL certificate for pictures.mydomain.com:443 |
2025-12-05 10:57:28.180402 | severe   | HttpSSLCertOverride  | Invalid SSL certificate for pictures.mydomain.com:443 |
2025-12-05 10:56:39.162871 | severe   | SplashScreenPage     | Missing crucial offline login info - Logging out completely |

Additional information

No response

Originally created by @stratus-ss on GitHub (Dec 5, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug This is similar to this [discussion](https://github.com/immich-app/immich/discussions/23575) However, in my case, immich works fine in the browser. I am presenting a letsencrypt wild card <img width="799" height="948" alt="Image" src="https://github.com/user-attachments/assets/447fdca8-22aa-49ae-a414-1cfe08e96ccd" /> I am using a wild card cert for 5 different vhosts on this server. I am using Apache reverse proxy ``` <VirtualHost pictures.mydomain.com:80> ServerName pictures.mydomain.com Redirect permanent / https://pictures.mydomain.com/ </VirtualHost> <VirtualHost pictures.mydomain.com:443> ServerName pictures.mydomain.com SSLEngine on SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem # Preserve original host information ProxyPreserveHost On ProxyRequests Off # Essential headers RequestHeader set "X-Forwarded-Proto" "https" RequestHeader set "X-Forwarded-Host" "pictures.mydomain.com" RequestHeader set "X-Real-IP" "%{REMOTE_ADDR}s" RequestHeader set "X-Forwarded-For" "%{REMOTE_ADDR}s" RewriteEngine On RewriteCond %{HTTP:Upgrade} =websocket [NC] RewriteRule /(.*) ws://localhost:2283/$1 [P,L] RewriteCond %{HTTP:Upgrade} !=websocket [NC] RewriteRule /(.*) http://localhost:2283/$1 [P,L] # Standard proxy configuration ProxyPass / http://localhost:2283/ ProxyPassReverse / http://localhost:2283/ </VirtualHost> ``` I had to uninstall the app and reinstall it because the "Self Signed Cert" option was greyed out. Toggling this, allows the app to function again. The other vhosts do not have this problem using a wild card cert so I don't *think* it is specifically an android problem. Is this expected behaviour? If not, how can I proceed to troubleshoot this ### The OS that Immich Server is running on Docker on RHEL 9 ### Version of Immich Server 2.3.1 ### Version of Immich Mobile App 2.3.0.build.3027 ### Platform with the issue - [ ] Server - [ ] Web - [x] Mobile ### Device make and model Pixel 6a running GrapheneOS ### Your docker-compose.yml content ```YAML name: immich services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} volumes: - ${UPLOAD_LOCATION}:/data - /etc/localtime:/etc/localtime:ro env_file: - .env ports: - '2283:2283' depends_on: - redis - database restart: always healthcheck: disable: false immich-machine-learning: container_name: immich_machine_learning image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-cuda file: hwaccel.ml.yml volumes: - model-cache:/cache env_file: - .env restart: always healthcheck: disable: false environment: - EXTRA_ARGS=--disable-cuda-graph redis: container_name: immich_redis image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa healthcheck: test: redis-cli ping || exit 1 restart: always database: container_name: immich_postgres image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} POSTGRES_INITDB_ARGS: '--data-checksums' volumes: - ${DB_DATA_LOCATION}:/var/lib/postgresql/data shm_size: 128mb restart: always volumes: model-cache: ``` ### Your .env content ```Shell not relevant ``` ### Reproduction steps 1. Download App from Play Store 2. Attempt to login 3. Fail to login ... ### Relevant log output ```shell 2025-12-05 10:57:28.205050 | severe | ApiService | Error while checking server availability | ApiException 400: TLS/SSL communication failed: GET /server/ping (Inner exception: HandshakeException: Handshake error in client (OS Error: CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate(handshake.cc:297))) #0 _SecureFilterImpl._handshake (dart:io-patch/secure_socket_patch.dart:101) #1 _SecureFilterImpl.handshake (dart:io-patch/secure_socket_patch.dart:146) #2 _RawSecureSocket._secureHandshake (dart:io/secure_socket.dart:1009) #3 _RawSecureSocket._tryFilter (dart:io/secure_socket.dart:1139) <asynchronous suspension> | #0 ApiClient.invokeAPI (package:openapi/api_client.dart:111) <asynchronous suspension> #1 ServerApi.pingServer (package:openapi/api/server_api.dart:672) <asynchronous suspension> #2 Future.timeout.<anonymous closure> (dart:async/future_impl.dart:1061) <asynchronous suspension> #3 ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart:124) <asynchronous suspension> #4 ApiService.resolveEndpoint (package:immich_mobile/services/api.service.dart:109) <asynchronous suspension> #5 ApiService.resolveAndSetEndpoint (package:immich_mobile/services/api.service.dart:85) <asynchronous suspension> #6 AuthService.validateServerUrl (package:immich_mobile/services/auth.service.dart:59) <asynchronous suspension> #7 LoginForm.build.getServerAuthSettings (package:immich_mobile/widgets/forms/login/login_form.dart:100) <asynchronous suspension> 2025-12-05 10:57:28.204860 | severe | HttpSSLCertOverride | Invalid SSL certificate for pictures.mydomain.com:443 | 2025-12-05 10:57:28.180402 | severe | HttpSSLCertOverride | Invalid SSL certificate for pictures.mydomain.com:443 | 2025-12-05 10:56:39.162871 | severe | SplashScreenPage | Missing crucial offline login info - Logging out completely | ``` ### Additional information _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#7993
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?