-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[BUG] No remote movie can be played on Immich Mobile using a Self Signed CA and a proxy in front of IMMICH server/microservices #5553
Comments
Did you change anything relating in the transcoding video settings? |
Yes, target resolution is 4k. It was the same before, when I was able to play them from Immich Android app. However, I highlight it again, from browser it's fine. |
Did you change the codec? Can you post the screenshot of transcoding settings? |
Can you try revert the transcoding settings to default, then record and upload a new videos and see if it works on your phone? |
I suppose you want to identify where is the issue. I will record a video, upload and then play. Can you remind me what was the default resolution? 1440p or 1024p? |
The default is 720p.There is also a button to reset to default at the bottom left corner |
Test 1: I opened immich Android app and uploaded. Playing is fine. Test 2: Test 3: My conclusion, maybe yours is different: As long the the movie is on my local Gallery it works, if I delete the streaming from server doesn't work. Can you please try on your side as well? |
I also reset all values from Transcoding section to default. Did the same as in previous tests and the same behaviour. |
What are the movie settings on your phone's camera? |
4k |
Do you see any logs in the server container when you are trying to stream the video on the mobile app? |
As said in the description no logs on server side (server or microservices) and on mobile app logs. By the way, I mentioned that the issue is on two distinct Android phones: Huawei Mate Pro and a Samsung A somthing (do not remember). If I login to immich from browsers on both phones it plays the videos OK. |
Mobile app (android S23 Ultra) v. 1.90.2 build.2114 Transcoding OFF It looks like there is an issue with playing HEVC media, H.264 is fine. |
I understand that the application (web or mobile) streams the transcoded video file and play it on the device. In your case maybe would be a different issue! My videos are encoded in HEVC (camera calls it Efficient Video Format) and the video player that Immich Android App is using, does't have any issue to play it as long as it is on local disk. I checked the format of my video with `ffmpeg -i video_1.mp4'. Something is wired - at least an INFO, better an exception ! |
Yes, I've just recreated exact same case. When HEVC file is locally available player works otherwise doesn't. Logs from immich_server: I've been logged in by external IP (port 2283 and 5432 are forwarded to local IP). I've decided to log in by local IP and then HEVC files started been playing.. Relogin helped? Missing forwarded ports to local IP? |
OK, I tested also connecting with Immich mobile app using directly the FQDN behind the proxy (http://immich-server.svc.local:3001/api) and started being playing the videos. As mentioned already everything is working fine through the proxy when accessing the application through browser, using the last URL provided above. So, the bug is in Immich Mobile App or in a dependency library (flutter videoplayer plugin). ... Later on after a bit of investigation: Please note I am using my own PKI. I have installed the private root CA into Android (User Certificates), so it's in trust store of Android. I checked this in every browser I have on my mobile to see if my ROOT CA certificate is considers, and indeed no more SSL warnings/errors. In Immich App I enabled Self-Signed cert. All functionality except videoplayer flutter plugin is working fine. I saw the error message in Caddy: Unknown certificate but only when I try to play a movie. For the rest of Immich API calls I do not get SSL error. For more info please check a bit the code for videoplayer flutter plugin here. In my opinion Immich should trust as well the certificates user adds in Android trust store and probably no need to specify "Allow Self Signed Certificates". This option is a security issue - to trust every Self Signed Certificate. This could be an option only in a DEV environment. I will amend the description with my findings. |
I found the same issue when I changed the transcode setting to HEVC and re-transcode all the videos today. All the video just cannot playback. Version of Immich Server Version of Immich Mobile App |
This is NOT an issue of transcoding. Please read well the thread. This is SSL issue related to flutter videoplayer that IMMICH mobile app is using to play videos on Android mobile. |
I can confirm this bug. I run my server on a Synology NAS behind their proxy server using Tailscale to connect from the outside because no public IPv4 (provider only serves DS_Lite). I had everything running via HTTP but eventually switched to HTTPS using a self-signed cert (can only be self-signed because as mentioned it's running inside a Tailscale network and is therefore not reachable from the outside). Since switching to that self-signed certificate I can't playback videos or live photos on mobile. I can however play them back on web. |
I'm seeing the same thing on my environment:
nginx is configured like this:
I've tried a handful of different reverse proxy configs, but based on the nginx logs and the behavior of the app, it feels like it's failing at the TLS session whenever a video is requested for playback on the phone (i.e. no actual HTTP request makes it into the nginx logs - it just fails silently) |
AFAIK the image and video players in flutter don't use the http interceptor that has been added to solve the issue with self-signed certificates elsewhere. |
I also have a selfsigned certificate, the problem happens in the immich app and Chromium based browsers, in Firefox it works well. |
Here to confirm i have the same issue with the updated version of the app on android with a valid cert and CA added to the android local store |
Also confirming this issue. Video clips in Immich show this behavior:
Also this user provides some code to check whether a certificate is really a trusted user certificate (instead of allowing all certificates, as far as I understand the Immich HTTP interceptor). |
Probably related: I use a reverse proxy with a Let's Encrypt certificate, which works without adding it to the CA store. However, due to the lack of mTLS support, I have configured Basic Authentication, i.e. my endpoint is The error reported in the app logs is |
Confirming this issue for iPhone 14 Pro as well. Using HAProxy loaded with a self-signed certificate to reverse proxy immich. |
The bug
Please NOTICE
This is NOT an issue of transcoding. Please read well the thread.
This is SSL issue related to flutter videoplayer that IMMICH mobile app is using to play remote videos on Android mobile.
Trusted Self signed certificates (registered in Android) should be valid also for playing videos as it is for images or other API calls to IMMICH server.
I cleanly install Immich mobile on two Android phones (Samsung & Huawei - no relevance as long as it worked on previous versions of Immich Mobile 1.89.0).
On one phone I had it already installed, version 1.89.0. I cleanup cache and data for Immich Mobile App and then re-authenticated.
On the second phone I installed for the first time.
Movies don't play on both mobile devices in Android Immich App.
All images and movies previews looks OK. Seeing a full picture works. Playing an existing movie doesn't work. It is stuck on loading the stream. I tried random movies and have the same issue.
Previous to version 1.89.0 I could play movies. I remember that I didn't tried to play a movie with version 1.89.0, but for sure with the previous versions.
In Immich Mobile logs I could not find any INFO, WARNING or ERROR.
On the server side (server or microservices) no INFO, WARNING or ERROR.
On Immich Web (mobile or desktop browser) playing movies works fine.
The OS that Immich Server is running on
Fedora 38
Version of Immich Server
v1.90.1
Version of Immich Mobile App
v1.90.0
Platform with the issue
Your docker-compose.yml content
N/A (Everything works fine on Web)
Your .env content
Reproduction steps
Please see in the description.
Additional information
Please note I am using my own PKI. I have installed the private root CA into Android (User Certificates), so it's in trust store of Android. I checked this in every browser I have on my mobile to see if my ROOT CA certificate is considers, and indeed no more SSL warnings/errors.
In Immich App I enabled Self-Signed cert. All functionality except videoplayer flutter plugin is working fine.
It seems that the videoplayer plugin uses its own SSLSocket.
I saw the error message in Caddy: Unknown certificate but only when I try to play a movie. For the rest of Immich API calls I do not get SSL error.
For more info please check a bit the code for videoplayer flutter plugin here.
In my opinion Immich should trust as well the certificates user adds in Android trust store and probably no need to specify "Allow Self Signed Certificates". This option is a security issue - to trust every Self Signed Certificate. This could be an option only in a DEV environment.
The text was updated successfully, but these errors were encountered: