Images not found intermittantly

[Luticus 13]

I keep getting temporarily broken images in Emby when I scan a library for new content. The effect is temporary as it seems to resolve itself after an extremely long time or even sometimes after restarting the server.

See this image:

[speechles 2055]

Are you being throttled by the  providers? They dislike users that hammer their website even with partner API keys. Have you been hitting limits on their services?

[Happy2Play 9780]

@Luticus Please provide a server log.  As there are serveral topic like this recently.

Are you using a VPN?

[Luticus 13]

@Happy2Play Neither the server, nor the client is going through any kind of VPN. The client is accessing the server through an Apache proxy though, but I'm not sure if that matters. Both server and client are in the local network and they both should have direct internet access though a nft powered firewall. If it were a port block though, it'd be all or nothing. It's a really weird issue that seems to have come up in the last could of server updates but I'm not entirely sure.

[Happy2Play 9780]

1 minute ago, Luticus said:

@Happy2Play Neither the server, nor the client is going through any kind of VPN. The client is accessing the server through an Apache proxy though, but I'm not sure if that matters. Both server and client are in the local network and they both should have direct internet access though a nft powered firewall. If it were a port block though, it'd be all or nothing. It's a really weird issue that seems to have come up in the last could of server updates but I'm not entirely sure.

But per the only provided image all of TMDB images are failing.  So to me that suggests failures in the server log to https://image.tmdb.org.

But we need to see the server log to possibly identify the issue.

[Happy2Play 9780]

@Luticus Seems similar/same to this topic

Are you receiving the same "The remote certificate is invalid because of errors in the certificate chain: NotTimeValid" error?

[Luke 42077]

If you're seeing the NotTimeValid error in the log then you'll want to check the date and time zone of the server machine.

[Luticus 13]

Alright, I'll peak at the logs and see if I can see anything and post anything relevant. I'll also double check the time thing. It's just weird because of how intermittent it is. I'd think if it were a time thing it would never work because the time would typically be wrong. My boxes all sync with my router which runs ntp, then that syncs up to debian time servers.

[Luke 42077]

Let us know how you get on. Thanks.

[Luticus 13]

Ok so it looks like I am seeing that in the logs:

embyserver.txt:  ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors
in the certificate chain: NotTimeValid
embyserver.txt: InnerException: System.Security.Authentication.AuthenticationException: The remote certificate is invalid because
of errors in the certificate chain: NotTimeValid

Edited November 8, 2022 by Luticus

[Luticus 13]

Timezone and date info on the server look good according to both the date and timedatectl commands.

[Happy2Play 9780]

Not sure then as the servers you are connecting to do not like something specific to your setup in reference to datetime (NotTimeValid).  Unless someone knows another meaning for that error?

[Luticus 13]

There's a possibility it could be an ntp thing, i'm doing some testing. I think it's a slim chance but worth a look.

[Luke 42077]

Let us know what you find. Thanks.

[Luticus 13]

Sadly it's still very much doing it. NTP appears to be working and the date/time appears to be spot on correct.

[Luticus 13]

    TargetSite: Void MoveNext()
    InnerException: System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: NotTimeValid
    Source: System.Private.CoreLib
    TargetSite: Void Throw()
       at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception)
       at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
       at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
       at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
    
2022-11-30 20:26:42.399 Info Server: http/1.1 Response 500 to ‌‍‍xxx.xxx.xxx.xxx. Time: 134ms. ....

[Happy2Play 9780]

I have no idea then as is suggests possibly an expired cert at source per google.

c# - The SSL connection could not be established see inner exception - Stack Overflow

But testing https://image.tmdb.org via ssllabs shows valid certs to specific servers.

SSL Server Test: image.tmdb.org (Powered by Qualys SSL Labs)

[Luticus 13]

Yea, it's really weird, I thought maybe there was an expired cert on my end, but it doesn't seem that way. Didn't even think it was using my certs for that stuff but I checked anyway and I'm good.

[Luticus 13]

Checked date/time again, as well as timezone, everything seems right, but I do get:

System.Net.Http.HttpRequestException: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
     ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: NotTimeValid

So whatever is going on, it's an ssl thing somewhere.

[Happy2Play 9780]

What do you get if you do a nslookup image.tmdb.org?

[Luticus 13]

Non-authoritative answer:
image.tmdb.org    canonical name = dsag3w1du2cu2.cloudfront.net.
Name:    dsag3w1du2cu2.cloudfront.net
Address: 13.33.4.41
Name:    dsag3w1du2cu2.cloudfront.net
Address: 13.33.4.90
Name:    dsag3w1du2cu2.cloudfront.net
Address: 13.33.4.106
Name:    dsag3w1du2cu2.cloudfront.net
Address: 13.33.4.123
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:4600:14:41bb:de80:93a1
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:8600:14:41bb:de80:93a1
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:b600:14:41bb:de80:93a1
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:e000:14:41bb:de80:93a1
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:e00:14:41bb:de80:93a1
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:1000:14:41bb:de80:93a1
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:a000:14:41bb:de80:93a1
Name:    dsag3w1du2cu2.cloudfront.net
Address: 2600:9000:24d5:4a00:14:41bb:de80:93a1

[Luticus 13]

Here's a full error for when i click on an image to download:

2022-12-01 04:32:57.769 Error Server: Error processing request
    *** Error Report ***
    Version: 4.7.10.0
    Command line: /opt/emby-server/system/EmbyServer.dll -programdata /var/lib/emby -ffdetect /opt/emby-server/bin/ffdetect -ffmpeg /opt/emby-server/bin/ffmpeg -ffprobe /opt/emby-server/bin/ffprobe -restartexitcode 3 -updatepackage emby-server-deb_{version}_amd64.deb
    Operating system: Linux version 5.10.0-12-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1
    Framework: .NET 6.0.8
    OS/Process: x64/x64
    Runtime: opt/emby-server/system/System.Private.CoreLib.dll
    Processor count: 4
    Data path: /var/lib/emby
    Application path: /opt/emby-server/system
    System.Net.Http.HttpRequestException: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
     ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: NotTimeValid
       at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception)
       at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
       at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
       at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
       --- End of inner exception stack trace ---
       at Emby.Server.Implementations.HttpClientManager.CoreHttpClientManager.SendAsyncInternal(HttpRequestOptions options, String httpMethod)
       at Emby.Server.Implementations.HttpClientManager.CoreHttpClientManager.SendAsync(HttpRequestOptions options, String httpMethod)
       at Emby.Providers.Manager.ProviderManager.SaveImageFromRemoteUrl(BaseItem item, LibraryOptions libraryOptions, String url, ImageType type, Nullable`1 imageIndex, Boolean isFallbackImage, CancellationToken cancellationToken)
       at Emby.Api.Images.RemoteImageService.DownloadRemoteImage(BaseItem item, BaseDownloadRemoteImage request)
       at Emby.Server.Implementations.Services.ServiceController.GetTaskResult(Task task)
       at Emby.Server.Implementations.Services.ServiceHandler.ProcessRequestAsync(HttpListenerHost appHost, IRequest httpReq, IResponse httpRes, RestPath restPath, String responseContentType, CancellationToken cancellationToken)
       at Emby.Server.Implementations.HttpServer.HttpListenerHost.RequestHandler(IRequest httpReq, ReadOnlyMemory`1 urlString, ReadOnlyMemory`1 localPath, CancellationToken cancellationToken)
    Source: System.Net.Http
    TargetSite: Void MoveNext()
    InnerException: System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: NotTimeValid
    Source: System.Private.CoreLib
    TargetSite: Void Throw()
       at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception)
       at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
       at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
       at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)

[Luticus 13]

To make things even weirder, the images I can't get from emby, I can use wget or curl to pull them directly to my server.

[Luke 42077]

Hi @Luticus are you still having an issue with this?

[Natilus13 14]

I was having this same issue too, but my server is on macOS. What solved the issue for me was to remove all my network shares, and then add them back. This seems to have sorted out the permission issues that had popped up and was preventing the images from being saved. Simply reapplying the permissions to my existing shares was not working. I had to remove and then add them back.

 

Hope that info helps out at least one other person