SOLVED: Philips Android TV cannot connect via domain (works on PC and iPhone)

[itsPasci]

Hey everyone,
I'm running into a strange issue with the Jellyfin Android TV app on my Philips OLED TV and I'm hoping someone here might have an idea what I'm missing.

Environment

• Proxmox host
  
• Debian VM running Docker
  
• Jellyfin behind Traefik v3
  
• Let's Encrypt certificates via Cloudflare DNS Challenge
  
• Technitium DNS Server
  
• Tailscale with Split DNS
  
• Custom domain through Cloudflare
  
• No port forwarding
  
• Everything is intended to remain private
  

---

DNS Configuration
Technitium handles local DNS resolution.
Example:
*.mydomain.com -> 192.168.1.20

This allows me to access services locally through domains such as:
https://jellyfin.mydomain.com
https://service1.mydomain.com
https://service2.mydomain.com

All domains resolve correctly to my local server.

---

What Works
The following devices can connect to Jellyfin without any issues using:
https://jellyfin.mydomain.com

• Windows PC (Browser)
  
• iPhone (Browser)
  
• iPhone (Jellyfin App)
  
• Local access through Traefik
  
• Remote access through Tailscale Split DNS
  

Everything works exactly as expected.

---

The Issue
The only device that refuses to connect is my Philips Android TV.
When entering:
https://jellyfin.mydomain.com

into the Jellyfin Android TV app, the app automatically attempts:
https://jellyfin.mydomain.com
https://jellyfin.mydomain.com:8096
https://jellyfin.mydomain.com:8920

All attempts fail.

---

Additional Information
Direct IP access works:
http://192.168.1.20:8096

Other observations:

• The TV has a working internet connection.
  
• HTTPS websites such as Google open correctly in the TV browser.
  
• The exact same Jellyfin URL works on all other devices connected to the same network.
  
• Cloudflare Proxy (orange cloud) is disabled.
  
• No public exposure and no port forwarding are configured.
  

I also confirmed DNS resolution from another client:
nslookup jellyfin.mydomain.com 192.168.1.20

Result:
192.168.1.20

---

My Theory
At this point I'm wondering whether the Philips Android TV is:

• Ignoring the DNS server provided via DHCP
  
• Using a built-in Private DNS / DNS-over-HTTPS provider
  
• Resolving DNS differently than the browser
  
• Or whether this is a known limitation of the Jellyfin Android TV app
  

---

Questions

• Has anyone experienced similar behaviour with Philips Android TV devices?
  
• Are there any known issues with Split DNS setups and the Android TV client?
  

Any help, suggestions, or troubleshooting ideas would be greatly appreciated.
Thanks in advance!

[TheDreadPirate]

Which Let's Encrypt certificate authority is your cert issued from? And what version of Android is the TV running?

On your reverse proxy, what TLS versions and ciphers are you allowing?

[itsPasci]

Which Let's Encrypt certificate authority is your cert issued from?  And what version of Android is the TV running?

On your reverse proxy, what TLS versions and ciphers are you allowing?

Android version: Android TV 11 (Philips 65OLED856/12)

Certificate Authority:
subject=CN=[mydomain]
issuer=C=US, O=Let's Encrypt, CN=YR1

TLS versions and ciphers (Traefik v3, default config):
TLS 1.2: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS 1.3: TLS_AKE_WITH_CHACHA20_POLY1305_SHA256, TLS_AKE_WITH_AES_128_GCM_SHA256, TLS_AKE_WITH_AES_256_GCM_SHA384
All rated A, no TLS 1.0 or 1.1.

Hope this helps! I'm fairly new to homelabbing so let me know if you need any additional info or if I should run specific commands to get more details.

[TheDreadPirate]

I am 95% certain the issue is that your TV doesn't trust YR1. In your Traefik config, are you using the full chain cert? The YR root cert is cross signed by X1, which should be trusted. If you are not using the full chain cert, it would only provide the certificate for the (probably) untrusted YR1 intermediate CA.

Edit:

Including sources from Let's Encrypt.

https://letsencrypt.org/certificates/
https://letsencrypt.org/docs/certificate-compatibility/

[itsPasci]

I am 95% certain the issue is that your TV doesn't trust YR1.  In your Traefik config, are you using the full chain cert?  The YR root cert is cross signed by X1, which should be trusted.  If you are not using the full chain cert, it would only provide the certificate for the (probably) untrusted YR1 intermediate CA.

Edit:

Including sources from Let's Encrypt.

https://letsencrypt.org/certificates/
https://letsencrypt.org/docs/certificate-compatibility/

Found it! Nothing to do with TLS/certificates — it was DNS.

My router was handing out two DNS servers via DHCP: my local Technitium server (192.168.1.20) and 1.1.1.1 as a fallback. Turns out devices treat both as equally valid and can query either one at any time, not just on failure. When 1.1.1.1 got queried for jellyfin.itspasci.com, it returned NXDOMAIN (private domain, not publicly resolvable), and that got cached. The TV apparently hit this far more consistently than my other devices.

Fix: removed 1.1.1.1 from the router's DHCP/DNS settings, leaving only 192.168.1.20. Everything resolves correctly now.

Thanks for taking the time to help, the certificate questions were a reasonable lead to chase down too.

[TheDreadPirate]

5% of the time I'm right 100% of the time.