Ways to debug cert errors

[smaktacular]

Hi,

I am running jellyfin behind traefik with ssl and a self signed cert, including ca, intermediate and self hosted acme (via step-ca).
All my jellyfin clients (Web, Kodi, IOS) have my custom ca installed and work fine using https, except for the FireTvStick.

I get
javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found

I installed the ca and intermediate ca on the FTV using these instructions. After that the Jellyfin server was reachable in the FTV browser but still not using the app.

Any ideas where to look what is keeping the app from accepting the cert my rev proxy provides?

[Maxr1998]

It's possible your certificate doesn't contain the whole certificate chain. I suggest looking at #571 and read my suggestion + linked serverfault thread there. Hopefully, that'll help resolve the issue for you!

[smaktacular]

Full chain refers to ca + intermediate ca + cert or just to ca + intermediate ca ?

[Maxr1998]

I think you need all of them. I'm not 100% sure though since I haven't worked with self-signed certificates with custom CAs yet.

[smaktacular]

After some testing and researching in other places, there seems to be no way to install non ca certs to firetv atm which for the moment makes jellyfin on ftv unusable in my setup. Is there any way to disable ssl verification that one would know of?