Baseurl not working on Android clients ?

[etiennec78]

Hello !
I recently decided to place Jellyfin behind an nginx reverse proxy, with everything running in docker.
Since I wanted to use a subdirectory, I added a baseurl in my config.
It works great on any browser or desktop app.
However, each android client can't connect to the server.
I checked on the networking page, and nothing tells that baseurl breaks Android clients.

So I displayed nginx logs but nothing happens when I try to connect.
Does anybody know what could cause this issue ?
Thanks for the help !

[etiennec78]

Weird... I just tried disabling SSL and Android clients can now connect easily.
Could this be an issue with my certificates not being accepted at all by Android ?
I am currently using Let's encrypt to generate them.

[TheDreadPirate]

What kind of Android devices and which version of Android are they running? Did you configure Nginx to only offer certain versions of TLS?

[etiennec78]

Hello, I started a new Qualyss SSL server test, and I got the following error : "This server's certificate chain is incomplete"
So I read my nginx configuration again and noticed that I was using chain.pem for ssl_trusted_certificate, instead of fullchain.pem.

I applied the fix and now Android devices can connect too !

[etiennec78]

Nevermind, I tested this configuration on another device and the connection failed.
I thought it was working on my phone but I had previously entered the HTTP adress to check if it worked without SSL.
When I logged out and logged back in with SSL activated and HTTPS entered in the adress, it worked perfectly.

However, if I connect a new device through HTTPS, it doesn't work. I need to use HTTP the first time, then change it to HTTPS after it connected successfully.

@TheDreadPirate to answer your question, I'm trying it on my phone running Android 12 and my TV running Android 7.1.1.
In my nginx config, I accept TLSv1 TLSv1.1 TLSv1.2 TLSv1.3

[TheDreadPirate]

Can you share your nginx config on sourcebin? Censor the domain name in the server_name and cert path.

[etiennec78]

It turned out I had put cert.pem as my ssl_certificate, but I had to use fullchain.pem instead (which I had put in ssl_trusted_certificate)
I checked on multiple Android devices and they all work now !