Issue with TLS 1.3 and older devices

[Luke 42077]

That's strange. I don't see anything obvious. Can you try sideloading the latest build?

https://emby.media/emby-for-android.html

Thanks.

 

[PutzJimmy 6]

A friend tried that now, still the same error on playback This is really sad as i so far love Emby and the polish on functions compared to Jellyfin but i still want to cover the refund policy and i would call this a case for refund if this wont get solved as almost all my family/friends use the mi box 3 or 4

[Luke 42077]

32 minutes ago, PutzJimmy said:

A friend tried that now, still the same error on playback This is really sad as i so far love Emby and the polish on functions compared to Jellyfin but i still want to cover the refund policy and i would call this a case for refund if this wont get solved as almost all my family/friends use the mi box 3 or 4

Can you sideload the latest version and provide a log from the android app by following the instructions here:

While you're at it please also attach the corresponding emby server log in case it is needed. Thanks.

[PutzJimmy 6]

I connected my daughters mi box 3 to my phones hotspot so it acts like it does for the others outside my network, sent you a PM with a video of it cause nothing shows up in logs and i did turn that on before testing with few movies.

[Luke 42077]

7 hours ago, PutzJimmy said:

I connected my daughters mi box 3 to my phones hotspot so it acts like it does for the others outside my network, sent you a PM with a video of it cause nothing shows up in logs and i did turn that on before testing with few movies.

Can you please supply the android app log using the instructions that I linked to above? thanks.

[PutzJimmy 6]

Now it worked for some reason. Dunno if they contain any more sensitive information other then my server address so sent them to you in a PM. Also this time Emby started it asked me to accept my ssl cert, never seen that before but i accepted it but didn't help

Edited December 29, 2023 by PutzJimmy

[Luke 42077]

So now you can play in the standard app?

[PutzJimmy 6]

No the logging worked in the phone app

[ebr 16169]

Hi.  It looks like the device is rejecting your SSL certificate.  Is it valid?

[PutzJimmy 6]

It is, and working everywhere else apart from these devices discussed. 

[ebr 16169]

You are sure it is completely valid all the way down the chain?  Some devices are much more strict on this than others.

Where did it come from?

[PutzJimmy 6]

Yes. Its from lets encrypt via synologys reverse proxy. Did a ssl test and got good scores there and jellyfin has no problems on those problem devices

Edited December 30, 2023 by PutzJimmy

[PutzJimmy 6]

Could this have something to do with it https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ and https://github.com/jellyfin/jellyfin-android/issues/537

I did try to renew cert but didn't help and i also tried removing and getting a new cert without luck.

[PutzJimmy 6]

For testing purpose I reinstalled Jellyfin on one Mi Box 3 and now its clearly saying its a ssl error trying to connect again. Is newer (or more up to date boxes) like the nvidia shield using some other part of the ssl then the ones not working?

[Luke 42077]

The box could have an outdated certificate store. That’s always possible. Does it get regular OS updates?

[PutzJimmy 6]

They did update to android tv 9 but that was like two years ago or so, that would explain why nvidia shield, mi box 4 v2 and that boxer tv box works, nvidia updates now and then and the two others are newish on the market.

[Luke 42077]

On 12/30/2023 at 12:39 PM, PutzJimmy said:

Yes. Its from lets encrypt via synologys reverse proxy. Did a ssl test and got good scores there and jellyfin has no problems on those problem devices

What TLS protocols do you have enabled? You might have to allow some older ones for the old mi box to be able to connect.

 

[PutzJimmy 6]

I have no idea how to do that

[rbjtech 5284]

Enable TLS 1.2 - Enforcing TLS 1.3 is very strict and may be the issue.

Only TLS 1.0 and TLS 1.1, SSL2 and SSL 3 should be disabled.

You can still get an A+ with this config.

Edited January 8, 2024 by rbjtech

[PutzJimmy 6]

FINALLY! Found where to change that for Emby in DSM and now the old devices work too with TLS 1.2. https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_advanced?version=7