Invalid certificate chain with certificate in signature

[HadriMX]

Hi! I'm getting the following error when trying to install the app. This is a brand new QN90D TV, I have never installed Jellyfin. Any idea?

Thanks for the help!

Transferred the package: /home/developer/Jellyfin.wgt -> /home/owner/share/tmp/sdk_tools/tmp
Installing the package...
--------------------
Platform log view
--------------------
install AprZAARz4r.Jellyfin
package_path /home/owner/share/tmp/sdk_tools/tmp/Jellyfin.wgt
app_id[AprZAARz4r.Jellyfin] install start
app_id[AprZAARz4r.Jellyfin] installing[9]
app_id[AprZAARz4r.Jellyfin] installing[19]
app_id[AprZAARz4r.Jellyfin] install failed[118, -12], reason: Check certificate error : :Invalid certificate chain with certificate in signature.:<-3>
spend time for wascmd is [6758]ms
Failed to install Tizen application.
Total time: 00:00:10.277

[Tntdruid]

Delete the app on the TV and try again.

[HadriMX]

Delete the app on the TV and try again.

Hey, thank you for the reply.
The thing is I don't have it installed, so I'm kinda lost.

[baduhai]

Getting the same error here. I also don't have the app installed.

[Georift]

I've encountered this before, I've never had the time to dig into it, I think perhaps the builds for that day may have had an issue. Typically this will go away after a while.

If anyone has a moment to look into it I'd appreciate it.

[baduhai]

I've encountered this before, I've never had the time to dig into it, I think perhaps the builds for that day may have had an issue. Typically this will go away after a while.

I thought this was the case too, so I tried installing older builds, and I get the same error with all of them. For the record, my TV is a QN55Q60, running software version 1310.

[kalua85]

I have the same issue, brand new TV from the box (S95D). Could it be that tizen version is too new?

[calebadcock]

I had to create a Samsung certificate myself. I'm guessing some TV models require this instead of a Tizen certificate.

[kalua85]

Created my own samsung certificate and added my DUID to it and then building manually, installation worked without issue. So I guess this can be closed as I don't see how this can be automated.

[Georift]

Delete the app on the TV and try again.

This would be my current best advice ☝️ Is it still present for you both after trying this?

EDIT: This advice changes after version 2024-05-20. See this comment from jeppevinkel

[kalua85]

Delete the app on the TV and try again.

This would be my current best advice ☝️ Is it still present for you both after trying this?

EDIT: This advice changes after version 2024-05-20. See this comment from jeppevinkel

That is not a solution as the app was not even installed. It seems newer TV's do not work anymore with a generic Tizen certificate. I had to create a Samsung certificate and add my DUID to the distributor certificate, then I re-signed the package and could install without any issue.

[Georift]

Hmm @jeppevinkel do you know anything about this?

[jeppevinkel]

Hmm @jeppevinkel do you know anything about this?

Unfortunately no. I don't have any newer TV's to test this on, but if they really need a certificate specifically for the DUID of the TV, then we are in trouble since there's no way to really automate that afaik.

[Georift]

@kalua85 can you share the model number of your TV? Just wondering when this came into effect.

[kalua85]

@Georift it is an S95D, the new 2024 model. Exact modelcode is QE65S95DATXXN

[willmaddrey]

Any update on the workaround for this? Getting this issue on du7200d still

[jeppevinkel]

Any update on the workaround for this? Getting this issue on du7200d still

The only solution I currently know of that might work is to create your own Samsung certificate and build Jellyfin-Tizen. The problem is I can't make this kind of certificate automatically since it's tied to your specific TV. jeppevinkel/jellyfin-tizen-builds#39 (comment)

[Georift]

That's incredibly frustrating. I'm keen to continue to collect a list of TV model names in this issue so we can document the TV's we won't be able to install Jellyfin on automatically.

ℹ️ If you can't install Jellyfin on your TV, and you've tried uninstalling + reinstalling it, and this issue still persists, please drop your TV's make and model here.

[willmaddrey]

Yeah, I had to manually install it with new Samsung certificates on my Crystal UHD DU7200D. It wasn't too hard, just annoying that it rejected the existing certs. I also plugged in my DUID (whatever Samsung calls their IDs) into the cert too.

It worked once I did that, but I had to just follow the jellyfin-tinzen repo guide.

[amigacli]

Hi, I just tried to install the app on a new TV and it is currently NOT installed, I also get the same error, TV 75" model is Q60D

[BurningCubez]

Hi, I also had this issue with model QA55LS03DAWXXY (55' The Frame).
As stated by others, I was getting "install failed[118, -12], reason: Check certificate error : :Invalid certificate chain with certificate in signature.:<-3>" without ever having installed the Jellyfin app.

Took me a while but finally managed to get it installed after building with a new security profile/certificate.

I think it could be possible to import an existing security profile and add a TV DUID, then resign a built jellyfin webapp but I haven't tested this to confirm.

[kalua85]

I think it could be possible to import an existing security profile and add a TV DUID, then resign a built jellyfin webapp but I haven't tested this to confirm.

I actually do this now. Download the compiled app and resign with my own certificate as described in https://developer.tizen.org/development/tizen-studio/web-tools/cli#Pack_tizen_app

It has an example how to resign with your own certificate. Works perfectly and also updating works without issues, it is just a small manual step in the process.

[nicovillanueva]

Battling with this issue too. It's a Samsung TQ65S95DATXXC

Time to learn about Samsung certs I guess 🫠

[SayantanRC]

Same issue here. Man, f*** samsung.

Edit: Samsung TV model: UA55DU8300ULXL

[kbekkering]

Same issue: QE55LS03DAUXXN

[kbekkering]

I think it could be possible to import an existing security profile and add a TV DUID, then resign a built jellyfin webapp but I haven't tested this to confirm.

I actually do this now. Download the compiled app and resign with my own certificate as described in https://developer.tizen.org/development/tizen-studio/web-tools/cli#Pack_tizen_app

It has an example how to resign with your own certificate. Works perfectly and also updating works without issues, it is just a small manual step in the process.

I'm stuck there, would you mind writing down the steps as it applies to Jellyfin.wgt?

[kbekkering]

I fixed it. Here's what you should do:

1. generate a certificate in Tizen Studio's certificate manager
2. download a build from https://github.com/jeppevinkel/jellyfin-tizen-builds
3. re-sign the build so the certificate matches your TV
   tizen package --type wgt --sign PROFILE_NAME -- ./JELLYFIN_BUILD.wgt
4. install the re-signed jellyfin build
   tizen install -n JELLYFIN_BUILD.wgt -t YOUR_TV_ID

[SayantanRC]

It took me several SEVERAL hours to get it working. But here is a noob friendly guide - including how to setup tizen studio.
https://gist.github.com/SayantanRC/57762c8933f12a81501d8cd3cddb08e4

[kimtiago]

Same here...

Model: UN65DU7700GXZD

[valentin2105]

Got it on LS32DM700UUXEN too.

Someone have find a fix ?

[Tntdruid]

Been using this for many years docker run --rm ghcr.io/georift/install-jellyfin-tizen tviphere

[GabrielFleury]

Same issue here with a QN55S90DAFXZC (aka the 55" S90D)

It took me several SEVERAL hours to get it working. But here is a noob friendly guide - including how to setup tizen studio. https://gist.github.com/SayantanRC/57762c8933f12a81501d8cd3cddb08e4

I finally got it to install by following this.
At the end of the day it wasn't too bad, installing Tizen Studio was the more confusing part.
If it can save someone a headache, you don't need to install the Jellyfin TV app from the same computer as the one Jellyfin is hosted on. However you DO need to install from a computer on the same Wi-Fi as the TV. My Jellyfin is hosted on a Synology NAS which is only a wired LAN connection, and I installed the app from my Laptop to my TV, both on Wi-Fi.

[nworbneb]

I've been running the docker build for a while and worked with no issue. But last week TV updated to latest Samsung firmware and Jellyfin had disappeared. Running the docker gives the "Invalid certificate chain" error message present when trying to re-install. Looks like this will affect all TV's that update to latest firmware.

[danielospina-b]

Although certificate creation probably can not be automated, once you have the .p12 certificate files, these files can be used to sign the .wgt file. If the certificate files are mounted to the container, we can automate the signing process.

I created a PR with some proposed changes. #49

[ailison]

It took me several SEVERAL hours to get it working. But here is a noob friendly guide - including how to setup tizen studio. https://gist.github.com/SayantanRC/57762c8933f12a81501d8cd3cddb08e4

I followed the tutorial from this guy here and it was flawless. I also left a comment there on how to install from windows, since you will have to create the certificate anyways. I used this tutorial process to install Moonlight (for streaming games from your PC to the TV) as well.