Immich HTTPS server fails on Android (app/browsers)

[BlacFyre777]

Immich server works over ​HTTP​ on all devices (http://<my_ip>:2283). After switching to ​HTTPS​ (https://www.yujianliu.cn), it remains accessible on desktop browsers (Edge) but ​fails on Android​ (both app and mobile browsers) with Server is not reachable.

Environment:
Immich server version: v1.126.1 and deployed on Tencent cloud
Immich android app version: v1.126.1
HTTPS: self-signed certificate (from Tencent cloud)
Firewall: all 443, 80 and 127.0.0.1:2283 allowed

docker-compose.yml

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - '127.0.0.1:2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - /home/ubuntu/immich-data/model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/redis:6.2-alpine@sha256:905c4ee67b8e0aa955331960d2aa745781e6bd89afc44a8584bfd13bc890f0ae
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    healthcheck:
      test: >-
        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1;
        Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align
        --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')";
        echo "checksum failure count is $$Chksum";
        [ "$$Chksum" = '0' ] || exit 1
      interval: 5m
      start_interval: 30s
      start_period: 5m
    command: >-
      postgres
      -c shared_preload_libraries=vectors.so
      -c 'search_path="$$user", public, vectors'
      -c logging_collector=on
      -c max_wal_size=2GB
      -c shared_buffers=512MB
      -c wal_compression=on
    restart: always

volumes:
  model-cache:

HTTPS config:

server {
    listen 443 ssl;
    server_name www.yujianliu.cn;

    ssl_certificate     /etc/ssl/immich/yujianliu.cn_bundle.crt;
    ssl_certificate_key /etc/ssl/immich/yujianliu.cn.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    client_max_body_size 50000M;

    proxy_set_header Host              $http_host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_http_version 1.1;
    proxy_set_header   Upgrade    $http_upgrade;
    proxy_set_header   Connection "upgrade";
    proxy_redirect     off;

    proxy_read_timeout 600s;
    proxy_send_timeout 600s;
    send_timeout       600s;

    location / {
        proxy_pass http://localhost:2283;  # 指向 Immich 实际端口
    }
}

server can be connected on desktop browsers

but can't be connected on android app or android browsers

And here's the settings and logs

MESSAGE: Error while checking server availability

ApiException 400: Socket operation failed: GET /server/ping (Inner exception: ClientException with SocketException: Connection reset by peer (OS Error: Connection reset by peer, errno = 104), address = www.yujianliu.cn, port = 54264, uri=https://www.yujianliu.cn/api/server/ping)

#0      IOClient.send (package:http/src/io_client.dart:154)
<asynchronous suspension>
#1      BaseClient._sendUnstreamed (package:http/src/base_client.dart:93)
<asynchronous suspension>
#2      ApiClient.invokeAPI (package:openapi/api_client.dart:101)
<asynchronous suspension>
#3      ServerApi.pingServer (package:openapi/api/server_api.dart:492)
<asynchronous suspension>
#4      Future.timeout.<anonymous closure> (dart:async/future_impl.dart:963)
<asynchronous suspension>
#5      ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart:107)
<asynchronous suspension>
#6      ApiService.resolveEndpoint (package:immich_mobile/services/api.service.dart:88)
<asynchronous suspension>
#7      ApiService.resolveAndSetEndpoint (package:immich_mobile/services/api.service.dart:70)
<asynchronous suspension>
#8      AuthService.validateServerUrl (package:immich_mobile/services/auth.service.dart:51)
<asynchronous suspension>
#9      LoginForm.build.getServerAuthSettings (package:immich_mobile/widgets/forms/login/login_form.dart:100)
<asynchronous suspension>

FROM ApiService

#0      ApiClient.invokeAPI (package:openapi/api_client.dart:104)
<asynchronous suspension>
#1      ServerApi.pingServer (package:openapi/api/server_api.dart:492)
<asynchronous suspension>
#2      Future.timeout.<anonymous closure> (dart:async/future_impl.dart:963)
<asynchronous suspension>
#3      ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart:107)
<asynchronous suspension>
#4      ApiService.resolveEndpoint (package:immich_mobile/services/api.service.dart:88)
<asynchronous suspension>
#5      ApiService.resolveAndSetEndpoint (package:immich_mobile/services/api.service.dart:70)
<asynchronous suspension>
#6      AuthService.validateServerUrl (package:immich_mobile/services/auth.service.dart:51)
<asynchronous suspension>
#7      LoginForm.build.getServerAuthSettings (package:immich_mobile/widgets/forms/login/login_form.dart:100)
<asynchronous suspension>

[mmomjian]

Self signed certs don’t typically work well: #15230