JMP 1.8.1 — ffmpeg requires TLS 1.2 to not return playback error

[snozinho]

Describe the bug
After updating to JMP 1.8.1 any attempt to play any media gives a playback error.

To Reproduce
Steps to reproduce the behavior:

1. Update to JMP 1.8.1
2. Click on any media to try and play it
3. See error

Expected behavior
Play the media as it used to on version 1.7.1

Screenshots
https://media.discordapp.net/attachments/773650260903591946/1074982167270137886/image.png

Desktop (please complete the following information):

• OS: Windows 11 22H2
• Version: 1.8.1
• Installation Method: windows installer 64 bits

Additional context

• When rollingback to 1.7.1 and unchecking the box to check for updates, the issue is resolved.
• The server is on version 10.8.9 (Docker on Synology NAS)
• All other platforms (i.e: Chrome, Brave, Jellyfin for iPhone) work as intented
  log_20230214.log

[iwalton3]

I need the log file here: https://github.com/jellyfin/jellyfin-media-player#log-file-location

[excitare]

@snozinho can you also post the Jellyfin Media Player log(s)? They are in
C:\Users\<your user>\AppData\Local\JellyfinMediaPlayer\logs

I am having the exact same issue.
In my case it seems like the build of ffmpeg does not support the TLS ciphers anymore.

The specific lines:

2023-02-14 15:30:48 [ DEBUG ] PlayerComponent.cpp @ 588 - ffmpeg: Opening https://stream.domain.tld/Videos/8a07d92892f660e9d59aa52ee5231584/stream.mkv?Static=true&mediaSourceId=8a07d92892f660e9d59aa52ee5231584&deviceId=SmVsbHlmaW5NZWRpYVBsYXllciAxLjguMSAod2luZG93cy14ODZfNjQgMTApfDE2NzYzODI4MjExMDM1&api_key=xxxxxxxxxxxxxxxxxxxx62da8a76b635&Tag=53185659350c1ab477de3b2981bca31f 
2023-02-14 15:30:48 [ INFO  ] JS: SyncPlay WrapperFactory getWrapper: htmlvideoplayer 
2023-02-14 15:30:48 [ INFO  ] JS: Requesting url without automatic networking: https://stream.domain.tld/Sessions/Playing 
2023-02-14 15:30:48 [ INFO  ] JS: nowplaying event: playbackstart 
2023-02-14 15:30:48 [ INFO  ] JS: nowplaying event: playbackstart 
2023-02-14 15:30:48 [ ERROR ] PlayerComponent.cpp @ 594 - ffmpeg: tls: A fatal alert message was received from the peer, has the peer a correct certificate? 
2023-02-14 15:30:48 [ ERROR ] PlayerComponent.cpp @ 594 - stream: Failed to open https://stream.domain.tld/Videos/8a07d92892f660e9d59aa52ee5231584/stream.mkv?Static=true&mediaSourceId=8a07d92892f660e9d59aa52ee5231584&deviceId=SmVsbHlmaW5NZWRpYVBsYXllciAxLjguMSAod2luZG93cy14ODZfNjQgMTApfDE2NzYzODI4MjExMDM1&api_key=xxxxxxxxxxxxxxxxxxxx62da8a76b635&Tag=53185659350c1ab477de3b2981bca31f. 
2023-02-14 15:30:48 [ DEBUG ] PlayerComponent.cpp @ 588 - cplayer: Opening failed or was aborted: https://stream.domain.tld/Videos/8a07d92892f660e9d59aa52ee5231584/stream.mkv?Static=true&mediaSourceId=8a07d92892f660e9d59aa52ee5231584&deviceId=SmVsbHlmaW5NZWRpYVBsYXllciAxLjguMSAod2luZG93cy14ODZfNjQgMTApfDE2NzYzODI4MjExMDM1&api_key=xxxxxxxxxxxxxxxxxxxx62da8a76b635&Tag=53185659350c1ab477de3b2981bca31f 
2023-02-14 15:30:48 [ DEBUG ] PlayerComponent.cpp @ 588 - cplayer: finished playback, loading failed (reason 4)

full media player log

Log by my reverse proxy (Traefik):
traefik | time="2023-02-14T14:34:37Z" level=debug msg="http: TLS handshake error from xxx.xxx.xxx.xxx:yyyyy: tls: no cipher suite supported by both client and server"

I am usually using the following cipher suites due to security:

  default:
      maxVersion: VersionTLS13
      cipherSuites:
      - TLS_AES_128_GCM_SHA256
      - TLS_AES_256_GCM_SHA384
      - TLS_CHACHA20_POLY1305_SHA256
    maxtls12:
      maxVersion: VersionTLS12
      cipherSuites:
      - ECDHE-ECDSA-AES128-GCM-SHA256
      - ECDHE-RSA-AES128-GCM-SHA256
      - ECDHE-ECDSA-AES256-GCM-SHA384
      - ECDHE-RSA-AES256-GCM-SHA384
      - ECDHE-ECDSA-CHACHA20-POLY1305
      - ECDHE-RSA-CHACHA20-POLY1305

Once I turn off the specific cipher suites (not sure which ones Traefik allows by default), the error does not happen and media plays as usual.

[snozinho]

I need the log file here: https://github.com/jellyfin/jellyfin-media-player#log-file-location

JellyfinMediaPlayer.log

[iwalton3]

You are indeed having the same issue. Evidently ffmpeg doesn't support the cipher suites that your reverse proxy is configured to use.

[snozinho]

Is there something we can do on our end or will a future update solve that issue? If not, does this mean we are "doomed" to keep the 1.7.1 forever?

[iwalton3]

You'll have to figure out how to reconfigure your reverse proxy to allow a supported cipher suite.

[snozinho]

@iwalton3 @1p1eq11 and anyone wondering, i found out!

In DSM 7.1, go to: Control Panel > Security > Advanced > TLS/SSL Profile Level

Set default parameters to: Modern Compatibility

Next, in Custom Settings below, set System Default to: Intermediate compatibility

I don't know why but setting only the jellyfin reverse proxy to intermediate compatibility won't work right away, but I guess letting all other settings to Modern compatibility is still a safe thing to set. If any expert can provide a better answer, I'll edit my post :)

[NotSaifA]

Error: Playback failed with error "loading failed". Retry with transcode? (Note this may hang the player.)
ffmpeg: tls: A fatal alert message was received from the peer, has the peer a correct certificate?

Workaround: Configure your web server to allow TLS 1.2 connections.

Cause: The ffmpeg library shipped with the latest MPV package does not support TLS 1.3

[NotSaifA]

Reverting MPV to the previously used version (20211212-git-0e76372) solves the issue. @iwalton3 was there a reason behind upgrading MPV to the latest version?

[iwalton3]

Yes people were asking for the upgraded version for a variety of reasons and it is usually good practice to keep up with these version changes.

[iwalton3]

I think the issue was caused by upstream changing from libressl to mbedtls. shinchiro/mpv-winbuild-cmake@358b4a3

You could test this by trying a version older than the date of the referenced commit. This doesn't make much sense to me though since they are on the latest mbedtls which support TLS 1.3. Maybe talk to upstream about why TLS 1.3 doesn't seem to work? I'd prefer not to fork upsteam to fix TLS.

[iwalton3]

I made an MPV build with libressl compiled in again: https://github.com/iwalton3/mpv-winbuild-cmake/releases/tag/v20230304-git-362256e

Please let me know if running the latest build works to resolve this issue: https://github.com/jellyfin/jellyfin-media-player/suites/11345988376/artifacts/583190784

[snozinho]

hi @iwalton3 !

I tried to revert to TLS 1.3 after installing the JMP version you sent me (https://github.com/jellyfin/jellyfin-media-player/suites/11345988376/artifacts/583190784) and it works perfectly now.

Although, I put it back to TLS 1.2 until an update is rolled out, just for convenience's sake, but problem solved, totally 👍

[iwalton3]

Sounds good. This will be fixed in the next release then.