Jellyfin-android: Android App 2.1+ (& FireTV 4k) HTTPS can't establish server connection

[overvox]

Describe the bug
When trying to connect to a HTTPS server (using reverse proxy with nginx) the message "Could not establish connection" appears.
However connecting via HTTP works. Similar bug occurs in the FireTV app. Browsers and iOS app work fine however.

To Reproduce
Can send server details in private if necessary for testing.

Expected behavior
Connection with HTTPS server can be established. Tested in Browser and iOS apps, works perfectly.

Logs
When testing it on the dbeug version of the app on my S10 I get the following logs:

02-11 11:39:15.125 10180 10180 E TimberLogger: VolleyError com.android.volley.NoConnectionError: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.125 10180 10180 E TimberLogger: com.android.volley.NoConnectionError: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:181)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:131)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:111)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.volley.NetworkDispatcher.run(NetworkDispatcher.java:90)
02-11 11:39:15.125 10180 10180 E TimberLogger: Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:362)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1134)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1089)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:876)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:747)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:712)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:849)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(ConscryptEngineSocket.java:722)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:238)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:217)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:1450)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:1399)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.okhttp.internal.io.RealConnection.connect(RealConnection.java:1343)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.okhttp.internal.http.StreamAllocation.findConnection(StreamAllocation.java:221)
02-11 11:39:15.125 10180 10180 E TimberLogger: at com.android.okhttp.internal.http.StreamAllocation.findHealthyConnection(StreamAllocation.java:144)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.http.StreamAllocation.newStream(StreamAllocation.java:106)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:400)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:333)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:465)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:411)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponseCode(HttpURLConnectionImpl.java:542)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getResponseCode(DelegatingHttpsURLConnection.java:106)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:30)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.volley.toolbox.HurlStack.executeRequest(HurlStack.java:96)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:123)
02-11 11:39:15.126 10180 10180 E TimberLogger: ... 3 more
02-11 11:39:15.126 10180 10180 E TimberLogger: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:661)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:510)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:428)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:356)
02-11 11:39:15.126 10180 10180 E TimberLogger: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)
02-11 11:39:15.126 10180 10180 E TimberLogger: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:161)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:250)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1644)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:568)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1095)
02-11 11:39:15.126 10180 10180 E TimberLogger: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1079)
02-11 11:39:15.126 10180 10180 E TimberLogger: ... 25 more
02-11 11:39:15.126 10180 10180 E TimberLogger: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.126 10180 10180 E TimberLogger: ... 38 more
02-11 11:39:15.127 10180 10180 E ContinuationResponse: org.jellyfin.apiclient.model.net.HttpException: VolleyError com.android.volley.NoConnectionError:
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at org.jellyfin.apiclient.interaction.VolleyErrorListener.onErrorResponse(VolleyErrorListener.java:25)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.Request.deliverError(Request.java:617)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.ExecutorDelivery$ResponseDeliveryRunnable.run(ExecutorDelivery.java:104)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at android.os.Handler.handleCallback(Handler.java:938)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at android.os.Handler.dispatchMessage(Handler.java:99)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at android.os.Looper.loop(Looper.java:246)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at android.app.ActivityThread.main(ActivityThread.java:8425)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at java.lang.reflect.Method.invoke(Native Method)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:596)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1130)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: Caused by: com.android.volley.NoConnectionError: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:181)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:131)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:111)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.NetworkDispatcher.run(NetworkDispatcher.java:90)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:362)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1134)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1089)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:876)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:747)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:712)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:849)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.access$100(ConscryptEngineSocket.java:722)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:238)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:217)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:1450)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:1399)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.io.RealConnection.connect(RealConnection.java:1343)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.http.StreamAllocation.findConnection(StreamAllocation.java:221)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.http.StreamAllocation.findHealthyConnection(StreamAllocation.java:144)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.http.StreamAllocation.newStream(StreamAllocation.java:106)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:400)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:333)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:465)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:411)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponseCode(HttpURLConnectionImpl.java:542)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getResponseCode(DelegatingHttpsURLConnection.java:106)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:30)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.toolbox.HurlStack.executeRequest(HurlStack.java:96)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:123)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: ... 3 more
02-11 11:39:15.127 10180 10180 E ContinuationResponse: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:661)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:510)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:428)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:356)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:90)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngineSocket$2.checkServerTrusted(ConscryptEngineSocket.java:161)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:250)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1644)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:568)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1095)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1079)
02-11 11:39:15.127 10180 10180 E ContinuationResponse: ... 25 more
02-11 11:39:15.127 10180 10180 E ContinuationResponse: Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
02-11 11:39:15.127 10180 10180 E ContinuationResponse: ... 38 more

System (please complete the following information):

• App version: 2.1+
• Android version: Android 10
• Device manufacturer and model: Samsung Galaxy S10 & FireTV stick 4k
• Jellyfin server version: 10.6.4 running on ubuntu 20.04

[ChrisG661]

I am also having the same problem, particularly with Lets Encrypt certificate on older device. I do think this is a problem with the Lets Encrypt intermediate CA and not serving the full chain. It works on newer devices, but only on the first connection attempt. I haven't retrieved the logcat from my newer device, so I will update tomorrow.

[ChrisG661]

I found the issue.
If you are using Lets Encrypt, serve the full chain fullchain.pem or include the intermediate CA chain.pem.
The Lets Encrypt website mentions this:

When configuring a web server, the server operator configures not only the end-entity certificate, but also a list of intermediates to help browsers verify that the end-entity certificate has a trust chain leading to a trusted root certificate. Almost all server operators will choose to serve a chain including the intermediate certificate with Subject “R3” and Issuer “DST Root CA X3.”

The wiki also mentions this, although I somehow skipped it.
If not, then take a look at this for creating a fullchain certificate.

[overvox]

Hey @ChrisG661,

I just tested serving the fullchain.pem and it fixed the issue on my S10.
I can't believe I missed that as well.

Thanks a lot for finding the issue!

Not sure how to handle this issue then, since according to the documentation it's technically not a bug...but might confuse others in the future.