SOLVED: Android App not connecting anymore

[holger_kuehn]

Hi folks,

I've noticed that a few days ago the Jellyfin Android App stopped working on my phone, checked two tablets as well, same here too. The Android TV app on my ShieldTV still works fine, so does any Windows client.

Setup is the following:

Server:

Windows 11 Pro 64bit
Jellyfin V10.8.13
Apache 2.4.58 Reverse Proxy

Clients

Windows - Jellyfin Media Player 1.9.1 - working
Android TV 0.16.7 - working
Kodi JellyCon 0.8.0 py3 - working
Jellyfin Android App 2.6.0 - not connecting


Interestingly the Android devices can connect via browser without any trouble, so the reverse proxy seems to work just fine. I had checked the config and reset it to the template provided on the forums here. When connecting via app, I think I can see the library for a very short time and then the app logs out again.

The only thing happend a few days ago on all affected devices seems to be an update to Android 14. The Shield is still on Android 11.

Are there any logs for the Android app, I can check? On the server logs I can't find any obvious hints.
Any additional info I should provide?

Holger

[TheDreadPirate]

Can you repeat the access attempt on the phone and then check the log to check if the connection attempt made it to Jellyfin? Or did the connection attempt fail at Apache? Did your cert recently update?

[holger_kuehn]

Can you repeat the access attempt on the phone and then check the log to check if the connection attempt made it to Jellyfin?

I've cleared the log on the server, and done 5 attempts to connect, seems not to reach the server ...

Code:

[2024-03-22 22:05:12.939 +01:00] [INF] [10] Emby.Server.Implementations.ScheduledTasks.TaskManager: Queuing task "PluginUpdateTask"
[2024-03-22 22:05:12.943 +01:00] [INF] [7] Emby.Server.Implementations.ScheduledTasks.TaskManager: Executing "Aktualisiere Plugins"
[2024-03-22 22:05:12.999 +01:00] [INF] [1] Emby.Server.Implementations.ApplicationHost: Executed all post-startup entry points in 0:00:00.758954
[2024-03-22 22:05:13.000 +01:00] [INF] [1] Main: Startup complete 0:00:24.3585816
[2024-03-22 22:05:28.402 +01:00] [INF] [10] Emby.Server.Implementations.ScheduledTasks.TaskManager: "Aktualisiere Plugins" Completed after 0 minute(s) and 15 seconds
[2024-03-22 22:05:28.413 +01:00] [INF] [10] Emby.Server.Implementations.ScheduledTasks.TaskManager: ExecuteQueuedTasks

Or did the connection attempt fail at Apache?

The access-log shows this from the app (not connecting):

Code:

192.168.22.213 - - [22/Mar/2024:22:15:40 +0100] "GET /System/Info/Public HTTP/1.1" 200 219 "-" "Ktor client"
fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:15:43 +0100] "GET / HTTP/1.1" 302 - "-" "Mozilla/5.0 (Linux; Android 14; SM-F731B Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/122.0.6261.120 Mobile Safari/537.36"
192.168.22.213 - - [22/Mar/2024:22:15:54 +0100] "GET /System/Info/Public HTTP/1.1" 200 219 "-" "Ktor client"
fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:15:58 +0100] "GET / HTTP/1.1" 302 - "-" "Mozilla/5.0 (Linux; Android 14; SM-F731B Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/122.0.6261.120 Mobile Safari/537.36"
192.168.22.213 - - [22/Mar/2024:22:16:37 +0100] "GET /System/Info/Public HTTP/1.1" 200 219 "-" "Ktor client"
fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:16:41 +0100] "GET / HTTP/1.1" 302 - "-" "Mozilla/5.0 (Linux; Android 14; SM-F731B Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/122.0.6261.120 Mobile Safari/537.36"

and this from the browser (same device and network) connecting

Code:

fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:18:38 +0100] "GET /web/index.html HTTP/1.1" 200 1994 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36"
fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:18:38 +0100] "GET /Trickplay/ClientScript HTTP/1.1" 200 18547 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36"
fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:18:38 +0100] "GET /web/assets/img/icon-transparent.png HTTP/1.1" 200 23534 "https://jellyfin.domain.tld/web/index.html" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36"
fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:18:38 +0100] "GET /web/main.jellyfin.bundle.js?d5f64bca077b6d6aaf33 HTTP/1.1" 200 453748 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36"
fd11:f0d8:a7bb:135d:4c61:2421:7249:115d - - [22/Mar/2024:22:18:38 +0100] "GET /web/config.json HTTP/1.1" 200 417 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36"
....

Did your cert recently update?

The certificate is still valid for 3 months.

Code:

Server Key and Certificate #1
Subject *.domain.tld
Fingerprint SHA256: 3cf4023913ae9df46cb0e3a21a3fa93635046f2ecb0a65200ca24d7558b3aaaf
Pin SHA256: EvvP2Ko2oL8jYeE9TCo8QruJXxgSy3FC6a2BPNVeqzI=
Common names *.domain.tld
Alternative names *.domain.tld domain.tld
Serial Number 00f2e77f9bbde5b429f2059c709cc0a5ce
Valid from Tue, 06 Jun 2023 00:00:00 UTC
Valid until Sat, 06 Jul 2024 23:59:59 UTC (expires in 3 months and 14 days)
Key RSA 4096 bits (e 65537)
Weak key (Debian) No
Issuer Sectigo RSA Domain Validation Secure Server CA
AIA: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
Signature algorithm SHA256withRSA
Extended Validation No
Certificate Transparency Yes (certificate)
OCSP Must Staple No
Revocation information OCSP
OCSP: http://ocsp.sectigo.com
Revocation status Good (not revoked)
DNS CAA Yes
policy host: domain.tld
issuewild: sectigo.com flags:0
issue: sectigo.com flags:0
Trusted Yes
Mozilla  Apple  Android  Java  Windows


Additional Certificates (if supplied)
Certificates provided 2 (3402 bytes)
Chain issues None
#2
Subject Sectigo RSA Domain Validation Secure Server CA
Fingerprint SHA256: 7fa4ff68ec04a99d7528d5085f94907f4d1dd1c5381bacdc832ed5c960214676
Pin SHA256: 4a6cPehI7OG6cuDZka5NDZ7FR8a60d3auda+sKfg4Ng=
Valid until Tue, 31 Dec 2030 23:59:59 UTC (expires in 6 years and 9 months)
Key RSA 2048 bits (e 65537)
Issuer USERTrust RSA Certification Authority
Signature algorithm SHA384withRSA

[TheDreadPirate]

I edited your post to remove your actual domain.

Can you share your apache config via sourcebin? Replace your domain with something like "domain.tld"

[holger_kuehn]

Have done some tests with an older Apache version from December, its the same, only the Android App does not connect.
I'm a bit out of ideas, what might have changed?

The reverse-proxy httpd-ssl.conf is this, SSLCipherSuite, SSLHonorCipherOrder, SSLProtocol are outside of virtual host, as these are valid for all hosts:
https://srcb.in/4WXeYPjoJf

The httpd.conf is here:
https://srcb.in/2gy1cWFt23

The other config files are the Apache original ones.

[TheDreadPirate]

Ah. I finally remembered. Make sure at least one of the certs in your config is a "fullchain" file.

[holger_kuehn]

Make sure at least one of the certs in your config is a "fullchain" file.

I've changed the certs to a full chain file and changed the config to this:

Code:

    SSLEngine on
  #SSLCertificateFile "${SRVROOT}/conf/ssl.crt/server.crt"
    SSLCertificateFile "${SRVROOT}/conf/ssl.fullchain/fullchain.pem"
    SSLCertificateKeyFile "${SRVROOT}/conf/ssl.key/server.key"
  #SSLCACertificateFile "${SRVROOT}/conf/ssl.crt/ca-bundle.crt"
  #SSLCertificateChainFile "${SRVROOT}/conf/ssl.fullchain/fullchain.pem"

SSLLabs state this as valid, but the Android app still refuses to connect.
I had to remove the crt file, as including this resulted in cert chain error (wrong order, to many certs).

[TheDreadPirate]

Sorry to ask the obvious, but did you restart apache? Are you able to check Android's cert store to verify that it trusts all certs in the chain?

[holger_kuehn]

Sorry to ask the obvious, but did you restart apache?

Yes, and I get to see them on https://www.ssllabs.com/ssltest/ as sent by the server.

Code:

1 Sent by server *.domain.tld
Fingerprint SHA256: 3cf4023913ae9df46cb0e3a21a3fa93635046f2ecb0a65200ca24d7558b3aaaf
Pin SHA256: EvvP2Ko2oL8jYeE9TCo8QruJXxgSy3FC6a2BPNVeqzI=
RSA 4096 bits (e 65537) / SHA256withRSA
2 Sent by server Sectigo RSA Domain Validation Secure Server CA
Fingerprint SHA256: 7fa4ff68ec04a99d7528d5085f94907f4d1dd1c5381bacdc832ed5c960214676
Pin SHA256: 4a6cPehI7OG6cuDZka5NDZ7FR8a60d3auda+sKfg4Ng=
RSA 2048 bits (e 65537) / SHA384withRSA
3 Sent by server USERTrust RSA Certification Authority
Fingerprint SHA256: 68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b
Pin SHA256: x4QzPSC810K5/cMjb05Qm4k3Bw5zBn4lTdO/nEW/Td4=
RSA 4096 bits (e 65537) / SHA384withRSA
4 In trust store AAA Certificate Services  Self-signed
Fingerprint SHA256: d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4
Pin SHA256: vRU+17BDT2iGsXvOi76E7TQMcTLXAqj0+jGPdW7L1vM=
RSA 2048 bits (e 65537) / SHA1withRSA
Weak or insecure signature, but no impact on root certificate

Are you able to check Android's cert store to verify that it trusts all certs in the chain?

Can you point me to a guide how to do that? On any Webbrowser, I see them as valid. Just found some programming pages on how to validate certs on android ...




As a side note, I just tested the findroid app from the very same phone, worked as expected and connected without trouble.

[TheDreadPirate]

Clear the app cache for the official app? I don't see a mention of that in your prior posts. I'm running out of ideas.