Unable to connect via HTTPS #17

New Issue

2026-04-24T23:02:24+02:00

adam commented

2026-04-24 23:02:24 +02:00

Originally created by @elmodor on GitHub (Nov 7, 2021).

I'm unable to connect to the audiobookshelf server which is behind a Caddy reverse proxy.
All I get is an "Invalid Server" error. I guess the ssl certificate validation does not work correctly?

I'm able to connect via the app when using http.
I'm able to connect to the website with https and listening works as well.
The self signed ssl certificate is installed on my Android 10 device and the certificate validation works in other applications.

Caddyfile:
https://ip:port {
reverse_proxy audiobookshelf:80
}

Originally created by @elmodor on GitHub (Nov 7, 2021). I'm unable to connect to the audiobookshelf server which is behind a Caddy reverse proxy. All I get is an "Invalid Server" error. I guess the ssl certificate validation does not work correctly? I'm able to connect via the app when using http. I'm able to connect to the website with https and listening works as well. The self signed ssl certificate is installed on my Android 10 device and the certificate validation works in other applications. Caddyfile: https://ip:port { reverse_proxy audiobookshelf:80 }

adam closed this issue

2026-04-24 23:02:25 +02:00

adam commented

2026-04-24 23:02:27 +02:00

@advplyr commented on GitHub (Nov 7, 2021):

Are you able to connect to the website on your phone and listen to an audiobook? The web doesn't require a socket connection to connect to the server, but it does require it to listen to an audiobook. The app requires it to connect.

On the socket.io website they have an example caddy config: https://socket.io/docs/v3/reverse-proxy/#caddy-2

I still need to add a page in the documentation for this, so if you solve the issue please follow up so I can add your solution.

@advplyr commented on GitHub (Nov 7, 2021): Are you able to connect to the website on your phone and listen to an audiobook? The web doesn't require a socket connection to connect to the server, but it does require it to listen to an audiobook. The app requires it to connect. On the socket.io website they have an example caddy config: https://socket.io/docs/v3/reverse-proxy/#caddy-2 I still need to add a page in the documentation for this, so if you solve the issue please follow up so I can add your solution.

adam commented

2026-04-24 23:02:27 +02:00

@elmodor commented on GitHub (Nov 7, 2021):

Yes, I'm able to connect to the website on my phone (via https) and listen to an audiobook (tested on Firefox).

I think the certificate validation is the issue here.
I changed Caddy to proxy http (instead of https). And using the Caddy reverse proxy on http I can connect via the app. So the Caddyfile should be correct. When I change the proxy to https, it doesn't work (even when using some header_up properties).

The certificate on caddy is a self signed certificate from caddy itself, not one from let's encrypt or similar. However, the certificate is installed on my android device so the validation should still work.

@elmodor commented on GitHub (Nov 7, 2021): Yes, I'm able to connect to the website on my phone (via https) and listen to an audiobook (tested on Firefox). I think the certificate validation is the issue here. I changed Caddy to proxy http (instead of https). And using the Caddy reverse proxy on http I can connect via the app. So the Caddyfile should be correct. When I change the proxy to https, it doesn't work (even when using some header_up properties). The certificate on caddy is a self signed certificate from caddy itself, not one from let's encrypt or similar. However, the certificate is installed on my android device so the validation should still work.

adam commented

2026-04-24 23:02:27 +02:00

@advplyr commented on GitHub (Nov 7, 2021):

What is throwing me off is that it works on the mobile browser, because the app is running the same code when it comes to making requests.
I did find one post with this same issue and the only response was to get a different certificate from LetsEncrypt or something. Working with self-signed certificates has always been a pain for me.

A lot of users have gotten this setup already over ssl, not with caddy specifically, but hopefully they can offer a better answer than I can.

@advplyr commented on GitHub (Nov 7, 2021): What is throwing me off is that it works on the mobile browser, because the app is running the same code when it comes to making requests. I did find one post with this same issue and the only response was to get a different certificate from LetsEncrypt or something. Working with self-signed certificates has always been a pain for me. A lot of users have gotten this setup already over ssl, not with caddy specifically, but hopefully they can offer a better answer than I can.

adam commented

2026-04-24 23:02:28 +02:00

@elmodor commented on GitHub (Nov 7, 2021):

Well firefox has it's own certificate storage. So it takes the validation from those instead from the android system.

So it probably is the self signed certificate. However, when added to the android trusted certificates, the app should be able to access those and validate my connection. Sadly I'm not really familiar how the implementation works. I just know that it does work on other apps (same certificate, and validations is successful). I was hoping that this would be something android would just do for you but it seems like it does. I can see why this is a pain to deal with.

It might be an option to add the option to skip the ssl validation / to accept "untrusted" certificates.
However, I would rather like my certificate to work, because it should be trusted.

@elmodor commented on GitHub (Nov 7, 2021): Well firefox has it's own certificate storage. So it takes the validation from those instead from the android system. So it probably is the self signed certificate. However, when added to the android trusted certificates, the app should be able to access those and validate my connection. Sadly I'm not really familiar how the implementation works. I just know that it does work on other apps (same certificate, and validations is successful). I was hoping that this would be something android would just do for you but it seems like it does. I can see why this is a pain to deal with. It might be an option to add the option to skip the ssl validation / to accept "untrusted" certificates. However, I would rather like my certificate to work, because it should be trusted.

adam commented

2026-04-24 23:02:28 +02:00

@elmodor commented on GitHub (Nov 7, 2021):

This might be the issue:
According to
https://developer.android.com/training/articles/security-config#base-config
The default certification trust level is set to "system"

Defined via:
https://developer.android.com/training/articles/security-config#certificates

My certificate is added into the android system as "user" certificate.
Maybe something liek this could work:

<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
           <certificates src="system" />
           <certificates src="user" />
        </trust-anchors>
    </base-config>
</network-security-config>

I don't have any android development setup, so I can't test this sadly.

@elmodor commented on GitHub (Nov 7, 2021): This might be the issue: According to https://developer.android.com/training/articles/security-config#base-config The default certification trust level is set to "system" Defined via: https://developer.android.com/training/articles/security-config#certificates My certificate is added into the android system as "user" certificate. Maybe something liek this could work: ``` <network-security-config> <base-config cleartextTrafficPermitted="false"> <trust-anchors> <certificates src="system" /> <certificates src="user" /> </trust-anchors> </base-config> </network-security-config> ``` I don't have any android development setup, so I can't test this sadly.

adam commented

2026-04-24 23:02:28 +02:00

@advplyr commented on GitHub (Nov 7, 2021):

I included this in release v0.9.18-beta that will be available on the play store in an hour or so. Hopefully that works.

@advplyr commented on GitHub (Nov 7, 2021): I included this in release `v0.9.18-beta` that will be available on the play store in an hour or so. Hopefully that works.

adam commented

2026-04-24 23:02:29 +02:00

@elmodor commented on GitHub (Nov 7, 2021):

Awesome, that did the trick! Connecting and listening works :)

Thanks for the fast reply and implementation. Glad you noticed to set cleartextTrafficPermitted="true" tho.
After I saw how you did the implementation I looked at the other apps (e.g. jellyfin) and saw that they did the exact same thing.

@elmodor commented on GitHub (Nov 7, 2021): Awesome, that did the trick! Connecting and listening works :) Thanks for the fast reply and implementation. Glad you noticed to set cleartextTrafficPermitted="true" tho. After I saw how you did the implementation I looked at the other apps (e.g. jellyfin) and saw that they did the exact same thing.

adam commented

2026-04-24 23:02:29 +02:00

@advplyr commented on GitHub (Nov 8, 2021):

Nice! Good find on that config, had no idea about that.

@advplyr commented on GitHub (Nov 8, 2021): Nice! Good find on that config, had no idea about that.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/audiobookshelf-app#17