š„²Please help me check this problem
33 Replies
:wave: Hey @HZH,
Thanks for reaching out to us. Please carefully read this message and follow the recommended actions. This will help us be more effective in our support effort and leave more time for building Immich :immich:.
References
- Container Logs:
docker compose logs docs
- Container Status: docker ps -a docs
- Reverse Proxy: https://immich.app/docs/administration/reverse-proxy
- Code Formatting https://support.discord.com/hc/en-us/articles/210298617-Markdown-Text-101-Chat-Formatting-Bold-Italic-Underline#h_01GY0DAKGXDEHE263BCAYEGFJA
Checklist
I have...
1. :blue_square: verified I'm on the latest release(note that mobile app releases may take some time).
2. :blue_square: read applicable release notes.
3. :blue_square: reviewed the FAQs for known issues.
4. :blue_square: reviewed Github for known issues.
5. :blue_square: tried accessing Immich via local ip (without a custom reverse proxy).
6. :blue_square: uploaded the relevant information (see below).
7. :blue_square: tried an incognito window, disabled extensions, cleared mobile app cache, logged out and back in, different browsers, etc. as applicable
(an item can be marked as "complete" by reacting with the appropriate number)
Information
In order to be able to effectively help you, we need you to provide clear information to show what the problem is. The exact details needed vary per case, but here is a list of things to consider:
- Your docker-compose.yml and .env files.
- Logs from all the containers and their status (see above).
- All the troubleshooting steps you've tried so far.
- Any recent changes you've made to Immich or your system.
- Details about your system (both software/OS and hardware).
- Details about your storage (filesystems, type of disks, output of commands like fdisk -l and df -h).
- The version of the Immich server, mobile app, and other relevant pieces.
- Any other information that you think might be relevant.
Please paste files and logs with proper code formatting, and especially avoid blurry screenshots.
Without the right information we can't work out what the problem is. Help us help you ;)
If this ticket can be closed you can use the /close command, and re-open it later if needed.We gave you the solution last time? Your reverse proxy isnāt passing the cert properly
This isnāt related to immich
There is no problem with the certificate. It can be accessed through the browser and ios application. The browser shows that the certificate was issued by an official organization.
It's just that the Android app cannot be linked. It's impossible that just because the Android app cannot be linked means that there is a problem with the certificate... After all, ios apps and browsers can be accessed normally
This is the domain name
https://nas.hyining.life:9527/
Hello,both
wget and curl are extremely widespread URL client/libraries. Until they work without issue, we will not be able to help as this is well beyond an Immich issue. You can test this on your local side.
As you can see the certificate is untrusted by both major URL clients
Perhaps the cert issuer is one that is trusted by your operating system, but it is not one of the major global certificate authorities and thus it will not workSee if you can get a Letās Encrypt certificate. Theyāre free and trusted by everything
I would just try caddy.
This is my entire caddyfile for immich and it works perfectly with the automatic HTTPS.
https://immich.app/docs/administration/reverse-proxy/#caddy-example-config
Way easier than nginx IMO
Hello, thank you for your suggestion. The certificate I obtained through win-acme seems to be from Let's Encrypt
thank you very much
May I ask if the cadyfile container should also be written in immich's docker-composi.yml? Then run <docker compose up -d>?
Or create a dorker container for caddyfile independently or install it directly on the device?
Thank you very much for your help. I can successfully get the results by running the [wget curl] command through a windows server. Is it because you are not in China? This server is not an intranet server.
(See screenshot for details)
My certificate was obtained through win-acme, which also belongs to Let's Encrypt. I'm trying some other methods to see if caddyfile can solve my problem.
Sorry to bother you so many times, thank you very much.
Potentially, are you currently in China?
Maybe itās using a certificate that is only trusted on Chinese devices
Let's encrypt only gives out globally trusted certificates
Iām thinking the Chinese GFW may be doing some shenanigans potentially
Like was already mentioned before: The reverse proxy is not sending the full certificate chain
But my Android device was also visited in China...:Cryge:
For comparison:
Ah makes sense
What probably is happening is the ACME tool gives you both the single cert and the chained cert
OP probably just imported the wrong one
@HZH can you screenshot the list of files win-acme generated?
Which one are you using on the site?
That is the issue, crt only sends the certificate itself, not the chain of trust
you most likely need the -chain file
Switch to another certificate? The next two?
hyining.life-chain-only.pem
hyining.life-chain.pem
no, key is fine, just replace crt with chain
or may need to concatenate if you are running a different version
First try chain before trying anything else though
For this area, it is my knowledge blind spot...
Is it okay to modify this?
yes
That looks right
If that doesnāt work I have another idea
You may (probably?) also need to restart Nginx after saving config change
It should work in the same file, but I would move it to a seperate one.
If you update the docker compose file, when a new version releases, you would have to re-add it every time. With a seperate stack you don't have to do that.
In my setup Immich and Caddy are running on entirely different Servers and are connected via tailscale, to basically "obfuscate" my Home servers IP Address, as I also hit the same problem as a lot of other people with Cloudflares 100mb uplaod limit.
Or, depending on your setup, you don't need docker for caddy at all. On my "proxy" server I just have caddy running bare metal
My God...
There are still mistakes
Android still cannot access...
Still says invalid cert, @bo0tzz can you rerun OpenSSL?
Off topic but whare are you using for your posts on your website? @bo0tzz
Please ask this in off-topic if you know this is off-topic
:(