Android App Connection Issues via Reverse Proxy

[amingle4]

Describe the bug

I have my Jellyfin server setup behind an NGINX reverse proxy.

On my phone, through the web browser, I am able to access https://jellyfin.MYDOMAIN.com

When I go to Connect to Server in the Android app, it says it is "Unable to reach server".

Logcat is pasted below, but all it says is "HTTP request timed out" after 5 seconds. No errors or access requests are showing up in the NGINX reverse proxy logs for these requests, while I do see normal access requests in the logs when accessing via the web browser. It is almost as if requests through the app are not hitting the reverse proxy at all. Of note, I also use an internal DNS server to resolve my domain, so if the app is going external for DNS, that would be a problem (i.e. it will never resolve via an external DNS server).

This reverse proxy has been set up for awhile and is used for numerous other applications. In the reverse proxy setup, SSL is offloaded and uses a ZeroSSL certificate. I ran SSL check via testssl.sh (it is an internal-only site, so cannot check with SSL Labs), and nothing abnormal shows up.

Logs

Logcat

07-22 01:18:52.336 16030 16030 I ConnectFragment: checkServerUrlAndConnection https://jellyfin.<MYDOMAIN>.com
07-22 01:18:52.338 16030 16030 I ConnectFragment: Address candidates are [https://jellyfin.<MYDOMAIN>.com, https://jellyfin.<MYDOMAIN>.com:8096, https://jellyfin.<MYDOMAIN>.com:8920]
07-22 01:18:54.395  1260  2008 D MdnieScenarioControlService:  packageName : org.jellyfin.mobile    className : org.jellyfin.mobile.MainActivity
07-22 01:18:57.815 16030 16030 I ConnectFragment: No valid servers found, invalid candidates were: https://jellyfin.<MYDOMAIN>.com/Failure(org.jellyfin.sdk.api.client.exception.TimeoutException: HTTP request timed out), https://jellyfin.<MYDOMAIN>.com:8096/Failure(org.jellyfin.sdk.api.client.exception.ApiClientException: Unknown error occurred!), https://jellyfin.<MYDOMAIN>.com:8920/Failure(org.jellyfin.sdk.api.client.exception.ApiClientException: Unknown error occurred!)

Results of https://jellyfin.MYDOMAIN.com/system/info/public
(The reverse proxy is set up to go Jellyfin via a standard HTTP connection - is that a conflict with the fact that the LocalAddress shown below is https? No certificate information is set up in Jellyfin.)

{"LocalAddress":"https://172.18.0.10:8920","ServerName":"jellyfin","Version":"10.8.1","ProductName":"Jellyfin Server","OperatingSystem":"Linux","Id":"3884546a3c324cd88ad1730c943afafe","StartupWizardCompleted":true}

Application version

2.4.4

Where did you install the app from?

Google Play

Device information

Samsung Galaxy S21

Android version

Android 12

Jellyfin server version

10.8.1

Which video player implementations does this bug apply to?

• Web player (default)
• Integrated player (ExoPlayer)
• External player (VLC, mpv, MX Player)

[nielsvanvelzen]

Of note, I also use an internal DNS server to resolve my domain, so if the app is going external for DNS, that would be a problem (i.e. it will never resolve via an external DNS server).

Did you configure you device to use this internal DNS server?

[amingle4]

Of note, I also use an internal DNS server to resolve my domain, so if the app is going external for DNS, that would be a problem (i.e. it will never resolve via an external DNS server).

Did you configure you device to use this internal DNS server?

Yes, that is done via the DHCP server. And this is proven to work on my phone since I can access the Jellyfin server via a web browser. I am just wondering if there's something off with how the Jellyfin Android app is trying to resolve the hostname.

[nielsvanvelzen]

The app uses our SDK (https://github.com/jellyfin/jellyfin-sdk-kotlin) for connection, the SDK uses the platform API's for networking (including DNS), we do not change this behavior.

[amingle4]

Thank you. That makes sense, and what I would have expected. So - something else is causing it to not find the host on the app although the device itself is able to find the host via a browser. Are there other logs I can pull that would help provide insight?

[gurudave]

I'm also having the same problem. Access to my jellyfin instance works fine in the web browser but the app just refuses to see it. Works fine over plain HTTP directly to the docker container, but fails as soon as I put the reverse proxy in front of it. Tried both nginx and traefik.

As in @amingle4's case, DNS is provided locally. SSL certificates are from Let's Encrypt and at least the browser is happy with them.

I can also pull logs and try suggestions if they would provide any guidance on tracking down the root cause.

[amingle4]

I realized after reading @gurudave's post - I didn't specify. I'm running this via Docker as well. So it seems like my setup is exactly the same.

[Charliecoop]

I'm having the same issue too when using my usual domain to login with Nginx and running via Docker. Seemed to happen with the latest version 10.8.1. Clients (including Android TV) that are already logged into the server work fine, however if I log out, I THINK I remember it saying a few times "connection refused"' when I try to login again. After reinstalling the app it says 'unable to connect' on Android TV and Android Phone.

Login via browser works fine tho. And the app works fine if I'm using the local IP address inside my local network.

When I use autodiscovery on the app I'm getting http://172.17.0.6:8096 appear which fails saying 'unable to connect'. I have to use real IP of the server (http://192.168.1.159:8096) to get in via the app.

[smomop]

I'm also having the same problem.But, everything is fine on my ios client.

[Charliecoop]

Might be helpful (devs): I've noticed that when using Chrome, Jellyfin loads slow generating slow http errors even when I'm connected to the home server via wifi. If I use the IP address, it's much faster. Happened around the same time this started happening.

[gurudave]

Hey guys, I think I found the cause (for me anyway, hopefully the same for you). As discussed in #571, android doesn't have the intermediate certificate for Let's Encrypt so it can't verify the TLS cert (which desktop browser can because it has the root and intermediate certs bundled). In traefik, the solution for me was to was the fullchain.cer file instead of the .cer file and then everything started working!

[amingle4]

I thought that might be it for me too, but best I can tell, I am actually using the full chain. (I use NGINX and ZeroSSL, so a slightly different setup, but came concept). The certificate file I am using in my NGINX config has 3 certificate sections - the main certificate, what I believe is the intermediate, and what I believe is the root certificate. But I'm struggling to verify this on an internal-only website, because all the tools people recommend to check SSL configuration are for external resources anyway. Unless someone knows of another option, I may need to temporarily make my website external-facing to check its configuration.

[amingle4]

I was able to run an SSL verification using OpenSSL (already installed on one of my servers):
`sudo openssl s_client -verify 100 -CAfile -connect :

This did in fact throw an error:
"verify error:num=2:unable to get issuer certificate"

So, I downloaded a new full chain certificate, and ran the OpenSSL verify again. The error went away, and I updated my NGINX configuration to that new certificate and restarted NGINX, but Jellyfin Android is still not happy.

@gurudave Do you have any SSL settings set within the Jellyfin server? I currently do not, so am basically treating the Jellyfin server as http-only.

[gurudave]

@amingle4 nothing in Jellyfin, it's also http only for me. I'm using traefik as my reverse proxy - found it to be a lot more intuitive than nginx (was using that before). FWIW, I'm using acme.sh to issue Let's Encrypt certs, and I dropped the "fullchain.cer" file it produced into my traefik config.

So I don't know if it might be an nginx peculiarity, but it was jellyfin that prompted me to try traefik after I couldn't figure out the nginx config. Might be worth giving traefik a shot? Feel free to message me if you need a hand with it.

[amingle4]

@gurudave That's all really helpful, thank you. I may need to take the time to make the switch. I'm using acme.sh with ZeroSSL and also had been using the fullchain.cer. So when I have time I'll try switching and seeing how it works. Lots of similarities between our setups so I should be able to get there.