Jellyfin App Connection Issue: SSL Handshake Failure

[edwards-tomato]

Describe the bug

I can't get the Jellyfin app to connect to my server for the past few days using the same method I have in the past. Using a domain name pointed at my external IP and using https I can connect through the web UI on my phone, both on WiFi and on mobile data, but not through the app. The app will work on LAN with the server using its local IP and http. I have a reverse proxy doing SSL offloading so Jellyfin isn't set up at all for https or with any certificates, but this is usually fine with the domain name, as it works on PC and mobile both through a browser. From the logs below, it seems like somehow the SSL handshake is going wrong? No changes were made intentionally when this started, maybe something expired or the app updated?

My Jellyfin server is using the docker image from ghcr.io/linuxserver/jellyfin. The Jellyfin container has ports 8096/8920 mapped to the docker machine's local ports. I have HAProxy on pfSense accepting inbound ssh connections on 443 and doing SSL decryption, then forwarding http to the docker machine on 8096.

I have tried

• uninstalling/re-installing the app
• updating the server using the latest docker image from the source above
• forcing a renewal of my SSL cert used by HAProxy

I also have HAProxy logs if that helps (IPs replaced with descriptions);
First log is working connection from Firefox on phone (on WiFi), second is app on WiFi, third is app on cell data

Oct 2 16:42:47 haproxy[64417]: Connect from [phone-local-ip]:41790 to [jellyfin-server-local-ip]:443 (HTTPS-ALL-SSL-OFFLOAD-LOCAL/HTTP)
Oct 2 16:42:56 haproxy[64417]: [phone-local-ip]:41794 [02/Oct/2021:16:42:56.249] HTTPS-ALL-SSL-OFFLOAD-LOCAL/[jellyfin-server-local-ip]:443: SSL handshake failure
Oct 2 16:45:45 haproxy[64417]: [mobile-data-ip]:63260 [02/Oct/2021:16:45:45.465] HTTPS-ALL-SSL-OFFLOAD/[my-external-ip]:443: SSL handshake failure

logs below are from adb logcat -e jellyfin

Logs

--------- beginning of system
--------- beginning of main
10-02 16:25:53.339  1280  1483 D CodecSolution: isMaxAspectPackageEx: org.jellyfin.mobile : true(2)
10-02 16:25:53.404  1280  1485 D WindowManager: w is invisible : 37acefa org.jellyfin.mobile/org.jellyfin.mobile.MainActivity
10-02 16:25:53.404  1280  1485 D WindowManager: windowMattersToAccessibility, check : 37acefa org.jellyfin.mobile/org.jellyfin.mobile.MainActivity
10-02 16:25:53.470  1280  2040 D MdnieScenarioControlService:  packageName : org.jellyfin.mobile    className : org.jellyfin.mobile.MainActivity
10-02 16:25:59.010  1280  8907 D GameManagerService: identifyGamePackage. org.jellyfin.mobile, mCurrentUserId: 0, callerUserId: 0
10-02 16:25:59.011  1280  8907 D GamePkgDataHelper: getGamePkgData(). org.jellyfin.mobile
10-02 16:26:01.421  1280  1280 D GameManagerService: identifyGamePackage. org.jellyfin.mobile, mCurrentUserId: 0, callerUserId: 0
10-02 16:26:01.421  1280  1280 D GamePkgDataHelper: getGamePkgData(). org.jellyfin.mobile
10-02 16:26:01.425 31716 31716 V InputMethodManager: Starting input: tba=org.jellyfin.mobile ic=null mNaviBarColor 0 mIsGetNaviBarColorSuccess true , NavVisible : true , NavTrans : false
10-02 16:26:04.799 31716 31716 I ConnectFragment: checkServerUrlAndConnection https://my.domain.name
10-02 16:26:04.799 31716 31716 I ConnectFragment: Address candidates are [https://my.domain.name, https://my.domain.name:8096, https://my.domain.name:8920]
10-02 16:26:14.889 31716 31716 I ConnectFragment: No valid servers found, invalid candidates were: https://my.domain.name/null, https://my.domain.name:8096/null, https://my.domain.name:8920/null

Application version

2.3.3

Where did you install the app from?

Google Play

Device information

Samsung Galaxy S9+

Android version

Android 10

Jellyfin server version

10.7.6

Which video player implementations does this bug apply to?

• Web player (default)
• Integrated player (ExoPlayer)
• External player (VLC, mpv, MX Player)

[CarlosOlivo]

Maybe related to:

• https://www.reddit.com/r/jellyfin/comments/pybpau/lets_encrypt_users_take_note/
• https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/
• https://www.ssllabs.com/ssltest/

[edwards-tomato]

The timing would make sense. I didn't know about that 3rd link, that's really helpful, thanks! Web access works fine on the phone I'm using the app on with a mobile browser, so I'm not sure what I can do to troubleshoot/fix my server or proxy. Is there anything in that SSL Server Test that would be helpful info to post here? I've tried updating pfSense and troubleshooting that end, but it's only the app that's having issues.

[CarlosOlivo]

First log is working connection from Firefox on phone (on WiFi)

Can you check if you get the same result using Chrome on Android?
As far as I remember, Firefox for Android uses its own KeyStore.

The third link is to check if there is a problem with your certificate, for example, jellyfin.org would have the same problem, but as it has cross-signed with ISRG Root X1 there is no problem.

Check if your certificate has the alternative chain path

[edwards-tomato]

That's it! I wound up with this:

Had to manually delete the old CA from pfSense and Issue/Renew again from ACME and it pulled the new intermediate cert. All's good now.

Thanks so much for your help even though it wasn't an issue with jellyfin-android! I didn't know Firefox had its own KeyStore.