Emby unable to get pictures from FanArt.tv on Ubuntu

[Vidman 589]

i have just noticed I'm no longer getting images from fanart.tv too . I'm running on freeNAS/trueNAS Core emby server plugin 4.6.4.0. I'm not sure when this started tho

[Luke 37062]

Hi there @Vidman can we please look at an example? 

Please attach the emby server log from a fanart attempt. Thanks.

[Vidman 589]

see attached log . Restarted server and tried to add images for dexter new blood - no results from fanart.tv

embyserver.txt

[Luke 37062]

How did you install emby server?

[Vidman 589]

it's install via freenas/truenas plugin page

[wbali 1]

Hi, I have the same problem.

I think it can be related to this? DST Root CA X3 Expiration

I deleted wrong certificate from

/usr/local/openssl/cert.pem
/usr/local/etc/ssl/cert.pem

but it didn't help. 

[FrogMaster 24]

Hello Friends,

I encountered this after updating my Emby Plugin to the latest available version in the TrueNAS Community Plugins. The problem is related to FanArt.tv's Let's Encrypt certificate. Its DST_Root_CA_X3 cert expired at the end of September to be replaced by the ISRG Root X1 certificate which validates it now since October 2021.  The Authentication error thrown by mono is caused by the former DST Root CA X3 still being present in the CRT Files. We have to substitute it with the new ISRG Root X1 certificate. 

I've managed to resolve this issue by performing the following:
If you're using the Emby Plugin like I was; I'd suggest manually updating it so you're running the latest available version of Emby Server.

Here is a step by step solution to resolve the issue if you're encountering it. 

Connect to your Emby Server Jail
1) Connect to your Emby-Server jail from the TrueNAS Core Shell or VIA SSH

# From the TrueNAS Core Shell / SSH Terminal
# Make note of the <ID> for your emby-server jail
jls

# Connect to the Emby Server Jail
jexec <ID> tcsh

Update the Emby Plugin
2) Actually Updating the Plugin
 2a) Run the following commands to stop the Emby Server. (Make sure you're not copying and pasting the # Comments)
 NOTE: replace "emby-server" with the name of your Plugin

# Stop the emby server and update the packages
service emby-server stop
pkg update -f
pkg upgrade

# Install the latest mono version as per requirements
pkg install mono6.8

# Install the latest version of Emby available from https://github.com/MediaBrowser/Emby.Releases/releases
pkg add -f https://github.com/MediaBrowser/Emby.Releases/releases/download/4.7.0.15/emby-server-freebsd12_4.7.0.15_amd64.pkg

# Lock the emby package so you don't get dependency errors
pkg lock emby-server

# Install mono 5.2 over mono 6.8
pkg install mono5.20-5.20.1.34

# Unlock the Emby package so you can update later / Start the Emby Service
pkg unlock emby-server
service emby-server start

Fixing the SSL Certificate Errors

# Perform the necessary certificate update
cert-sync /usr/local/share/certs/ca-root-nss.crt

# Download the new ISRG Root X1 Cert
cd /usr/local/share/certs/
fetch https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem
cat isrg-root-x1-cross-signed.pem >> ca-root-nss.crt
cert-sync /usr/local/share/certs/ca-root-nss.crt

# Check for the Expired Cert to ensure we're removing the correct CERT
cd /usr/local/mono/new-certs/Trust
grep -i "DST Root CA X3" *

# EXAMPLE OUTPUT:
# 2e5ac55d.0:        Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3
# 2e5ac55d.0:        Subject: O=Digital Signature Trust Co., CN=DST Root CA X3
# This filename "2e5ac55d.0" may differ for you, if it does ensure to change the below command to match

# Remove the Expired / Invalid CERT
mv 2e5ac55d.0 ~/

Finally, restart your Emby Jail and the Emby Plugin. You'll find that you should now be able to retrieve Metdata from FanArt.tv again. 

Edited November 8, 2021 by FrogMaster

[Luke 37062]

@FrogMaster that's great info, thanks for sharing !

[Vidman 589]

will there be a simpler solution than this in the future?

Edited November 9, 2021 by Vidman

[alucryd 216]

@VidmanThere is now, the latest betas contain a fix to use our own up to date cert bundle instead of relying on the outdated system bundle. Upgrading to it should automatically import them (reinstalling over the same version won't, if you already have 4.7.0.17 installed, please uninstall it first).

[Carlo 4330]

What is the recommended method to install this in a jail @alucryd?

I've got 17 running in a jail but the trust issue is still present.

[Vidman 589]

any idea when the fix will be pushed to the freenas emby server plugin? 

 

Edit: I guess whenever 4.7 stable is finally released

Edited November 11, 2021 by Vidman

[arron1985 2]

I have the same problem. I'm not the best with truenas and learning as I go along. I'm hoping the will be a simple plugin update soon.

[Luke 37062]

30 minutes ago, Vidman said:

any idea when the fix will be pushed to the freenas emby server plugin? 

 

Edit: I guess whenever 4.7 stable is finally released

I've replaced the 4.6.4 pkg's with patched version so please try that. Thanks.

[arron1985 2]

I tried the update on truenas and it says there's no update.  

[Carlo 4330]

If you installed Emby via plugin vs the directions on the download site this will probably not work for you. It doesn't for me when testing.
One is using the host environment during setup and one is using the jailed OS which are likely very different.

The jailed OS has issues of mismatched software that makes the process of upgrading the certs a lot harder.
If you installed via plugin this version

The process @FrogMaster posted above will work but you can change the build to the newly posted 17 beta release.  I'll post the full script below that I've used 5+ times in testing that work.

I've been looking at this trying to find the best approach for upgrading these jailed plugin installed versions and came to almost identical solution as what FrogMaster posted a couple of days ago. So here is the basically the same directions updated for the latest beta build.

Goto Jails menu.  Right click the arrow next to your Emby jail to expand it.  Click the shell menu item which will log you in as root.  Run the following command in order line by line skipping the comment lines starting with a #.  You can copy/paste this into the terminal windows.  To paste use <CTRL><SHIFT>V
Some of the command might tell you it's up to date already which is fine.

# Stop the emby server and update the packages
service emby-server stop
pkg update -f
pkg upgrade

# Install the latest mono version as per requirements
pkg install mono6.8

# Install the latest version of Emby available from https://github.com/MediaBrowser/Emby.Releases/releases
pkg add -f https://github.com/MediaBrowser/Emby.Releases/releases/download/4.7.0.17/emby-server-freebsd12_4.7.0.17_amd64.pkg

# Lock the emby package so you don't get dependency errors
pkg lock emby-server

# Install mono 5.2 over mono 6.8
pkg install mono5.20-5.20.1.34

# Unlock the Emby package so you can update later / Start the Emby Service
pkg unlock emby-server
service emby-server start

# Perform the necessary certificate update
cert-sync /usr/local/share/certs/ca-root-nss.crt

# Download the new ISRG Root X1 Cert
cd /usr/local/share/certs/
fetch https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem
cat isrg-root-x1-cross-signed.pem >> ca-root-nss.crt
cert-sync /usr/local/share/certs/ca-root-nss.crt

# Check for the Expired Cert to ensure we're removing the correct CERT
cd /usr/local/mono/new-certs/Trust
grep -i "DST Root CA X3" *

# EXAMPLE OUTPUT:
# 2e5ac55d.0:        Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3
# 2e5ac55d.0:        Subject: O=Digital Signature Trust Co., CN=DST Root CA X3
# This filename "2e5ac55d.0" may differ for you, if it does ensure to change the below command to match

# Remove the Expired / Invalid CERT
mv 2e5ac55d.0 ~/

Restart the Emby Jail.

 

[arron1985 2]

Ok thank you so much. I will give it a go   

[Carlo 4330]

Let us know how you make out!

[Vidman 589]

at the stage of installing the latest emby version it failed due to missing dependency 'tesseract'

[alucryd 216]

@Vidman Yeah that's a new dep you should install as well. Our instructions are being updated to include it (along with intel-media-sdk if you don't have it already).

[arron1985 2]

Sorry for the delay in responding but thank you Cayars ever so much. It worked like a charm and nice clear instructions too. I cant Thank you enough 

[Vidman 589]

didn't work for me

[Vidman 589]

On 11/12/2021 at 2:49 AM, Luke said:

I've replaced the 4.6.4 pkg's with patched version so please try that. Thanks.

So I should just install a new version of the plugin from the truenas repository and fanart should be working?

[Vidman 589]

I finally got it to work ...running 4.7.0.17

[Luke 37062]

54 minutes ago, Vidman said:

I finally got it to work ...running 4.7.0.17

Thanks for the feedback. What exactly did you do?