Not Trusting R11 Let's Encrypt over TLS 1.3

[war59312]

Describe the bug

Seems like Tautulli-Remote on my Galaxy S24+ doesn't trust the newer R11 certs from Let's Encrypt over TLS 1.3.

Thankfully, I can tell it to trust. But yeah, it gets old as since every 90 days when new cert, have to do it again.

Steps to Reproduce

No response

Expected Behavior

No response

Tautulli Remote Version

3.3.1

Tautulli Version

2.15.1

Mobile Device

Galaxy S24+

Mobile OS

Android 14 with Feb 2015 security updates

Additional Context

No response

[TheMeanCanEHdian]

Thanks for the bug report.

If you happen to be the person who left a 3 star review about this it would be appreciated if you removed that for now while the issue is looked into.

[TheMeanCanEHdian]

I finally have had some time to work on the app again and intend to solve this for the next release.

[TheMeanCanEHdian]

@war59312, there were some underlying base code changes with v3.4.0 due to Flutter and package upgrades. Please let me know if you still have the issue after upgrading.

[war59312]

Indeed, fixed. TY :)

[war59312]

Happening again, I'm afraid.

[TheMeanCanEHdian]

There were some large changes behind the scenes with the HTTP stack in v3.5.2. Can you test on that version and report back? I will also do some additional investigation on the side.

[TheMeanCanEHdian]

Hey @war59312,

I've been reevaluating your situation and chatting with some of the other Tautulli devs. Not sure how I overlooked it but because this isn't a self-signed cert it is not expected that you have to manually trust it.

It seems the most likely issue is an incomplete chain being served.

Can you run the following command and replace with your proper domain info?
openssl s_client -connect tautulli.domain.com:443 -servername tautulli.domain.com -showcerts </dev/null

I'd be looking for you to share the following part of the output (make sure to mask the domain info!)

 0 s:CN=domain.com                    
   i:...Google Trust Services, CN=WE1
 1 s:...WE1                           
   i:...GTS Root R4
 2 s:...GTS Root R4                   
   i:...GlobalSign Root CA
Verify return code: 0 (ok)
SAN: DNS:domain.com, DNS:*.domain.com
notBefore=Jun 2 2026 … notAfter=Sep 1 2026

If there is only the 0s line (no 1s) and the verify return code is 20 this is most certainly an incomplete chain issue.

[war59312]

Will do, when able. I've had my basement flooded. So yea going to be a while. My lab and office are all shut down at this time.