Self-signed certificates

[tedstriker]

Would it be possible to load a self-signed CA certificate into the app or at least ignore the validation. The reason is, that Android TV doesn't allow to import root certificates.
What do you guys think?

[nielsvanvelzen]

No, we will not add such feature to the app because it is unsafe. You can add your own certificates to the Android certificate store or get a free one from services like Let's Encrypt.

[anionDev]

because it is unsafe

No. Using your own certificate is not unsafe, especially inside your home-net which is probably the usual setup for most users. Your browser may mark it as unsafe as long as there is no root-certificate which is added to the machine's ca-certificate-store. But if you trust your self-signed certificate there is nothing wrong about using it. It is much better than falling back to unencrypted protocols like HTTP anyway.

get a free one from services like Let's Encrypt

If your jellyfin-server is accessed through the internet then yes, this the (usual) solution.
But if your jellyfin-server is in the same local network than in your android-tv then using Let's Encrypt is more like a workaround than a solution. It should not be required. The design and purpose of PKI is that everyone is able to use his own CA-certificate in his own network. Therefore the certificate must be installed on the clients belonging to the network.

You can add your own certificates to the Android certificate store

While I agree and endorse that adding your own CA-certificate to the machine's ca-certificate-store would be the properly solution for this issue we see: this is not a doable solution unfortunately because there is no other way to achieve this than using lowlevel-debug-tools like adb. Not a solution for a normal user.

[ChekhWasTaken]

No, we will not add such feature to the app because it is unsafe.

unsafe is not whitelisting user certificates for the app, which forces into using http connection for android clients.
iOS provides ability to trust to the certificate on system level, making it trusted for all installed apps.

i mean lets pause and think about it for a moment: network administrators have an ability to create custom root CAs for their private networks. otherwise, that feature should not be shipped with every single major OS.
i don't see this shouldn't be respected for an app, where l belive not a small chunk of users run it in local or otherwise private networks. the fact that i'm running on private network doesn't mean i shouldn't be able to use the benefits of TLS.

[tedstriker]

As far as I know, Android TV doesn't allow users to add their own CA.
Hence my question, to allow adding the CA cert to the app instead of the system.

But if you know a way to do add it to the TV itself, I'd be more than happy to go that route.

Let's Encrypt only works, if you expose a host to the internet. This hasn't happens yet.

Also I'm curious to learn how a skipped certificate validation is more unsafe than the already implemented way to connect without any encryption at all. Honestly I never understood that idea.

[tedstriker]

@nielsvanvelzen would you mind to give me a hint? Others might benefit from it as well.

[thornbill]

You do not need a publicly accessible website to get a valid certificate from Let's Encrypt: https://letsencrypt.org/docs/challenge-types/

[tedstriker]

It still seems like I either open ports 80 (HTTP-01) or 443 (TLS-ALPN-01) for the LE-bot or I need to buy a domain, use one of the supported DNS providers (DNS-01) and move the generated certificate to a directory, where Jellyfin can use it. How this is better than trusting my own, self-signed certificate is beyond my understanding.

As I lack the skills to change the app on my own, I'd be the beggar here. So I admit defeat. I asked what you guys think and you kindly let me know.

Meanwhile I just opened the unencrypted http port for my TV, so I can use the app. Entering credentials on an unencrypted channel feels wrong, but I'm not dying on that hill.

Thanks for your time and patience.

[Gylesie]

Hello @tedstriker, I have the same set-up as you and I understand the struggle. In the end, I concluded to the same workaround - having to have an unsecure connection for android tv clients. It is a pity that there is no way to force trust a certain certificate in the jellyfin client. Even more so, that there is no proper way to download a certificate into the trust store of an android tv itself. Don't get me wrong, I don't mean to criticize the devs, because most people probably wouldn't benefit from this.

[rvrosm]

use this method successfully installed root ca on android tv:

openssl x509 -inform PEM -subject_hash_old -in root.crt | head -1
Subject hash old = 9a5ba575
adb push root.crt /sdcard/Download/

adb root
adb shell
mount -o rw,remount /
cp /sdcard/Download/root.crt /system/etc/security/cacerts
cd /system/etc/security/cacerts
mv root.crt 9a5ba575.0
chmod 644 9a5ba575.0
reboot

this root.crt is caddyserver's ACME Server's root CA. I use caddyserver to serve jellyfin on https://jellyfin.lan

[gbakeman]

I believe this requires having root?

[dgmora]

But if you trust your self-signed certificate there is nothing wrong about using it. It is much better than falling back to unencrypted protocols like HTTP anyway.

Indeed, trying to make this "safer" and not allowing self signed certificates is making people waste time in useless hops or falling back to http. If browsers let you use self signed certificates with a warning, I don't see why should the jellyfin app behave differently. This is making things unsafer, rather than safer.

[superboo07]

I agree, this has actually forced me to be less secure. I don't like having someones arbitrary restrictions dictate how unsecure my server is. There should be a box that says "allow ssl cert" ffs

[gbakeman]

This issue is especially important to me now as I no longer have a public domain (which I was only using for internal services, anyways.) I've already rolled a PKI including self-signed CA and a couple of TLS Server certs. These install just fine on every device I own except the SHIELD. As far as I can tell, there is no way to install your certificate without rooting it, and I'm reading conflicting info that this may break Widevine DRM for other services. So rooting is out of the question. Thus far I've disabled HTTPS redirecting on my proxy server, so I've directed Jellyfin to go straight to HTTP. But it would be nice to have Jellyfin whitelist/accept our self-signed cert. and connect using HTTPS. I know it's annoying putting a workaround like this into your app when the OS should be handling it, unfortunately AndroidTV and SHIELD in particular seem lacking in the area of custom PKI.

Related issues

• Ignore SSL trust errors #1127
• Option to ignore selfsigned TSL certificate #3385
• Fails to connect to server (SSL handshake failure) #4811
• Self signed TLS didn't work on android tv app #4231

[thornbill]

I'm just going to lock this discussion. There is nothing productive coming out of this hostility on a closed three year old discussion.