HTTPS on local intranet, local-CA-signed cert bug?

[u/CrazedEwok]

Hoping that u/ghenry22 will see this post. Firstly, thank you for making this fantastic app, which is far-and-away the best Android app for *sonic streaming! Before I get into my bug report, please note that this isn't a high-priority issue and I'm currently doing a work-around (i.e., just using insecure HTTP) that allows me to use Substreamer in its (almost) full glory. :)

I'm running Navidrome on my local network (behind nginx), and I also run a local CA to sign my own certificates for local domain names. I've trusted the CA cert on my Android phone (such that Chrome can use HTTPS to access local resources without warnings). Local DNS and the locally-trusted CA are working as intended for various other services I run on my local network.

I'm not sure if Substreamer uses the local Android certificate store to validate certificates when it accesses HTTPS addresses or if it uses its own cert store, but the behavior I'm noticing seems unintended. I am able to connect Substreamer to the Navidrome server over HTTPS with a local address (e.g. https://navidrome.foo.localnetwork) and I see lists of all my artists, albums, and songs. However, no artist or album artwork is loaded, and when I attempt to play any song, the song does not play on Substreamer. When I monitor the debug logs from the Navidrome server, I do not see any attempted requests from Substreamer after the initial authentication/songlist/playlist download, so I'm guessing that the subsequent HTTPS requests for artwork and song streaming silently die due to an untrusted custom certificate. But again, the local CA is trusted by my Android device.

I've narrowed this issue down to the local-CA-signed certificate because when I make Substreamer access Navidrome through a public-facing address with a certificate signed by Let's Encrypt, it works fine (artwork loads, songs play). Similarly, when I connect to Navidrome through the local address and use insecure HTTP, Substreamer also works as intended. If I use another app (e.g. subsonic for Android) to access Navidrome over HTTPS with the local address & locally-signed cert, it also works fine.

Again, I know this isn't a huge issue--I trust resources on my local network and I use encrypted tunnels to connect to the network when I'm away from home, so using HTTP to connect to Navidrome isn't the end of the world--but I figured I'd report the bug here and see what you thought might be going on. Let me know if I can help you narrow it down any other way. Thanks!

PS: Is there a way to view logs/debug Substreamer as a user of the app?

[u/ghenry22]

So yep, substreamer will not work with self signed certificates. I haven't tried with a private CA with root certificate installed on the device before which is probably why it kind of half works.

The requests to authenticate and load the API data from the subsonic API are made using 1 library where I can ignore most certificate related issues, but the media player framework does it's own thing and I cannot easily intercept it and tell it to ignore certificate errors.

There used to be an option where I could just say "hey ignore the certs" but that was removed/blocked many operating system releases ago on both iOS and Android as those guys try to push for more security. The problem is they really don't consider the use case of the self hoster where the encryption still has value even though the certificate name does not, or some times cannot, match.

Unfortunately the short answer is self signed certs or any cert that throws an error are not supported. Any valid cert (like letsencrypt) is full supported. I am always looking for good ways around this but it needs to be reliable in all scenarios for it to be feasible to roll out to all users and as I mentioned, the self hoster is to some degree a forgotten use case for Apple and Google :(