[BUG] Unacceptable TLS certificate on Device tab

[leandrotoledo]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The initial connection validation (likely a simpler HTTP check) succeeds, but the persistent connection fails during the full TLS handshake on the dedicated Device tab.

The Selkies container's internal certificate trust store is missing or out-of-date, preventing it from recognizing the ZeroSSL intermediate CA.

Expected Behavior

The Device tab should securely connect to the Klipper host and display the Moonraker Welcome page, consistent with the successful connection test.

Steps To Reproduce

1. In OrcaSlicer, navigate to the Prepare tab for a new printer Connection.
2. Add a new connection:
   • Host Type: Klipper
   • Host/IP/URL: https://klipper.mydomain:7130/
3. Click the "Test" button.
4. Success message displayed: "Connection to OctoPrint is working correctly."
5. Click OK or Save to confirm the connection.
6. Navigate to the main OrcaSlicer Device tab.
7. A persistent error message is displayed: "Unacceptable TLS certificate".

---

Troubleshooting

1. Accessing https://klipper.mydomain:7130/ is fully accessible and trusted by Chrome/Firefox on my desktop.
2. The Firefox instance running inside the Selkies container fails when accessing the same URL, displaying the error: Error code: SEC_ERROR_UNKNOWN_ISSUER.
3. As a client-side test, the Intermediate CA certificate (ZeroSSL ECC Domain Secure Site CA) was downloaded and manually configured within the OrcaSlicer connection settings as the HTTPS CA File. The connection error persisted.

Environment

- OS: Debian GNU/Linux 13 (trixie)
- How docker service was installed: apt via Docker repository

CPU architecture

x86-64

Docker creation

services:
  orcaslicer:
    image: linuxserver/orcaslicer:latest
    container_name: orcaslicer
    hostname: orcaslicer
    restart: unless-stopped
    environment:
      - TZ=America/New_York
      - PUID=1000
      - PGID=1000
    volumes:
      - /srv/docker/orcaslicer/config:/config
    networks:
      - reverse-proxy-network
    shm_size: "1gb"

networks:
  reverse-proxy-network:
    external: true
    name: reverse-proxy-network

Container logs

[migrations] started
[migrations] no migrations found
usermod: no changes
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────
Linuxserver.io version: v2.3.1-ls107
Build-date: 2025-11-04T12:27:25+00:00
───────────────────────────────────────

[custom-init] No custom files found, skipping...
_XSERVTransmkdir: Owner of /tmp/.X11-unix should be set to root
screen 0 shmid 0
xsettingsd: Loaded 5 settings from /config/.xsettingsd
[ls.io-init] done.
The XKEYBOARD keymap compiler (xkbcomp) reports:
> Warning:          Could not resolve keysym XF86CameraAccessEnable
> Warning:          Could not resolve keysym XF86CameraAccessDisable
> Warning:          Could not resolve keysym XF86CameraAccessToggle
> Warning:          Could not resolve keysym XF86NextElement
> Warning:          Could not resolve keysym XF86PreviousElement
> Warning:          Could not resolve keysym XF86AutopilotEngageToggle
> Warning:          Could not resolve keysym XF86MarkWaypoint
> Warning:          Could not resolve keysym XF86Sos
> Warning:          Could not resolve keysym XF86NavChart
> Warning:          Could not resolve keysym XF86FishingChart
> Warning:          Could not resolve keysym XF86SingleRangeRadar
> Warning:          Could not resolve keysym XF86DualRangeRadar
> Warning:          Could not resolve keysym XF86RadarOverlay
> Warning:          Could not resolve keysym XF86TraditionalSonar
> Warning:          Could not resolve keysym XF86ClearvuSonar
> Warning:          Could not resolve keysym XF86SidevuSonar
> Warning:          Could not resolve keysym XF86NavInfo
Errors from xkbcomp are not fatal to the X server
xsettingsd: Created window 0x200001 on screen 0 with timestamp 1247755603
xsettingsd: Selection _XSETTINGS_S0 is owned by 0x0
xsettingsd: Took ownership of selection _XSETTINGS_S0
19
20
INFO:data_websocket:pcmflux library found. Audio capture is available.
INFO:data_websocket:pixelflux library found. Striped encoding modes available.
INFO:root:Expected C js_config_t size (from ctypes): 1354 bytes
INFO:main:Upload directory ensured: /config/Desktop
INFO:main:Starting Selkies (WebSocket Mode) with settings: {'audio_enabled': (True, False), 'microphone_enabled': (True, False), 'gamepad_enabled': (False, False), 'clipboard_enabled': (True, False), 'command_enabled': (True, False), 'file_transfers': ['upload', 'download'], 'encoder': 'x264enc', 'framerate': (8, 120), 'h264_crf': (5, 50), 'jpeg_quality': (1, 100), 'h264_fullcolor': (False, False), 'h264_streaming_mode': (False, False), 'use_cpu': (False, False), 'use_paint_over_quality': (True, False), 'paint_over_jpeg_quality': (1, 100), 'h264_paintover_crf': (5, 50), 'h264_paintover_burst_frames': (1, 30), 'second_screen': (True, False), 'audio_bitrate': '320000', 'is_manual_resolution_mode': (False, False), 'manual_width': 0, 'manual_height': 0, 'scaling_dpi': '96', 'enable_binary_clipboard': (False, False), 'use_browser_cursors': (False, False), 'use_css_scaling': (False, False), 'ui_title': 'Selkies', 'ui_show_logo': (True, False), 'ui_show_core_buttons': (True, False), 'ui_show_sidebar': (True, False), 'ui_sidebar_show_video_settings': (True, False), 'ui_sidebar_show_screen_settings': (True, False), 'ui_sidebar_show_audio_settings': (True, False), 'ui_sidebar_show_stats': (True, False), 'ui_sidebar_show_clipboard': (True, False), 'ui_sidebar_show_files': (True, False), 'ui_sidebar_show_apps': (True, False), 'ui_sidebar_show_sharing': (True, False), 'ui_sidebar_show_gamepads': (False, False), 'ui_sidebar_show_fullscreen': (True, False), 'ui_sidebar_show_gaming_mode': (True, False), 'ui_sidebar_show_trackpad': (True, False), 'ui_sidebar_show_keyboard_button': (True, False), 'ui_sidebar_show_soft_buttons': (True, False), 'port': 8082, 'dri_node': '', 'audio_device_name': 'output.monitor', 'watermark_path': '', 'watermark_location': -1, 'debug': (False, False), 'enable_sharing': (True, False), 'enable_collab': (True, False), 'enable_shared': (True, False), 'enable_player2': (False, False), 'enable_player3': (False, False), 'enable_player4': (True, False)}
INFO:main:Initial Encoder: x264enc, Framerate: 60
INFO:main:SelkiesStreamingApp initialized: encoder=x264enc, display=1024x768
INFO:main:All main components initialized. Running server...
INFO:webrtc_input:System DPI detected as ~96. Cursor size cap set to 32x32px.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:webrtc_input:Clipboard monitor running (binary mode: False)
INFO:webrtc_input:Found XFIXES version 4.0
INFO:webrtc_input:starting cursor monitor
INFO:webrtc_input:watching for cursor changes
WARNING:data_websocket:Cannot broadcast cursor data: no clients connected or server not ready.
INFO:data_websocket:Data WebSocket Server listening on port 8082
INFO:webrtc_input:Initializing 4 persistent gamepad instances...
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js0): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js0.sock, EVDEV socket: /tmp/selkies_event1000.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 0 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js0.sock, EVDEV: /tmp/selkies_event1000.sock).
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js1): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js1.sock, EVDEV socket: /tmp/selkies_event1001.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 1 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js1.sock, EVDEV: /tmp/selkies_event1001.sock).
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js2): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js2.sock, EVDEV socket: /tmp/selkies_event1002.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 2 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js2.sock, EVDEV: /tmp/selkies_event1002.sock).
INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js3): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js3.sock, EVDEV socket: /tmp/selkies_event1003.sock. Using fixed config: Microsoft X-Box 360 pad
INFO:webrtc_input:Initialized and started persistent gamepad instance for index 3 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js3.sock, EVDEV: /tmp/selkies_event1003.sock).
INFO:selkies_gamepad:Gamepad /tmp/selkies_js0.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js0.sock
INFO:selkies_gamepad:Gamepad /tmp/selkies_js1.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js1.sock
INFO:selkies_gamepad:Gamepad /tmp/selkies_js2.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js2.sock
INFO:selkies_gamepad:Gamepad /tmp/selkies_js3.sock: Event processor started.
INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js3.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1000.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1001.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1002.sock
INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1003.sock
dbus-daemon[276]: [system] Activating service name='org.freedesktop.hostname1' requested by ':1.11' (uid=1000 pid=357 comm="/opt/orcaslicer/bin/orca-slicer") (using servicehelper)
dbus-daemon[276]: [system] Activated service 'org.freedesktop.hostname1' failed: Failed to execute program org.freedesktop.hostname1: Permission denied
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 48634)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 48634)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Registering new client for display: primary
INFO:data_websocket:Applying and sanitizing client settings for 'primary' (initial=True)
INFO:webrtc_input:Binary clipboard setting changing to: True. Restarting monitor.
INFO:webrtc_input:Stopping clipboard monitor
INFO:webrtc_input:Clipboard monitor task cancelled.
INFO:webrtc_input:Clipboard monitor stopped
INFO:data_websocket:DPI changed from None to 96. Applying system-level change.
INFO:gst_app_resize:Openbox detected. Applying xrdb for DPI 96.
INFO:gst_app_resize:Wrote 'Xft.dpi:   96' to /config/.Xresources.
INFO:webrtc_input:Clipboard monitor running (binary mode: True)
INFO:gst_app_resize:Successfully loaded /config/.Xresources using xrdb.
INFO:gst_app_resize:Wrote font and DPI settings to /config/.xsettingsd.
INFO:gst_app_resize:Found xsettingsd process with PID: 270.
xsettingsd: Reloading configuration
xsettingsd: Loaded 5 settings from /config/.xsettingsd
INFO:gst_app_resize:Sent SIGHUP to xsettingsd process 270 to reload config.
INFO:data_websocket:Initial setup or dimensional change detected for 'primary'. Performing full display reconfiguration.
INFO:data_websocket:Starting display reconfiguration...
INFO:data_websocket:Calculating new extended desktop layout from ALL clients...
INFO:data_websocket:Layout calculated: Total Size=3440x1270. Layouts: {'primary': {'x': 0, 'y': 0, 'w': 3440, 'h': 1270}}
INFO:data_websocket:Mode 3440x1270 not found. Creating it.
INFO:data_websocket:Defining logical monitors for the window manager...
INFO:data_websocket:Starting separate capture instances for each ACTIVE display region...
INFO:data_websocket:Client 'primary' is active. Starting its capture.
INFO:data_websocket:Preparing to start capture for display='primary': Res=3440x1270, Offset=0x0
INFO:data_websocket:Video chunk sender started for display 'primary'.
INFO:data_websocket:SUCCESS: Capture started for 'primary'.
INFO:data_websocket:New frame backpressure task started for display 'primary'.
INFO:data_websocket:Broadcasting primary stream resolution to all clients: {"type": "stream_resolution", "width": 3440, "height": 1270}
INFO:data_websocket:Broadcasting display config update: DISPLAY_CONFIG_UPDATE,{"type": "display_config_update", "displays": ["primary"]}
INFO:data_websocket:Display reconfiguration finished successfully.
INFO:data_websocket:Reconfiguration process complete (state unlocked).
INFO:data_websocket:Initial client settings message processed by ws_handler.
INFO:data_websocket:Initial setup: Primary client connected, audio not active, attempting start.
INFO:data_websocket:Starting pcmflux audio pipeline...
INFO:data_websocket:pcmflux settings: device='output.monitor', bitrate=320000, channels=2
[pcmflux] Attempting to connect to PulseAudio device: output.monitor...
INFO:data_websocket:Frame-based backpressure logic task started for display 'primary'.
INFO:data_websocket:Client settings received, proceeding with backpressure loop for 'primary'.
INFO:data_websocket:pcmflux audio capture started successfully.
INFO:data_websocket:pcmflux audio chunk broadcasting task started.
X Shared Memory Extension available.
XShm setup complete for 3440x1270.
CPU cores available: 4
Stream settings active -> Res: 3440x1270 | FPS: 60.0 | Stripes: 1 | Mode: H264 (CPU) FullFrame | CRF: 25 | PaintOver CRF: 18 (Burst: 5f) | Colorspace: I420 (Limited Range) | Damage Thresh: 10f | Damage Dur: 20f
[pcmflux] SUCCESS: Connected to PulseAudio.
[pcmflux] SUCCESS: Opus encoder created.
[pcmflux] Capture loop started. Device: output.monitor, Rate: 48000, Channels: 2, Bitrate: 320 kbps, VBR: On, Silence Gate: Off, Debug Logging: Off, PCM Chunk: 3840 bytes
INFO:data_websocket:Received START_AUDIO command from client for server-to-client audio.
INFO:data_websocket:START_AUDIO: pcmflux audio pipeline already active.
INFO:data_websocket:Received redundant resize request for primary (3440x1270). No action taken.
[pcmflux] First non-silent audio chunk detected! Encoding...
INFO:data_websocket:Received STOP_VIDEO for 'primary'. Stopping stream.
INFO:data_websocket:Stopping all streams for display 'primary'...
INFO:data_websocket:Backpressure logic task for 'primary' cancelled.
INFO:data_websocket:Backpressure logic task for 'primary' finished.
INFO:data_websocket:Backpressure task for 'primary' was stopped. Resetting its frame IDs.
INFO:data_websocket:Resetting frame IDs for display 'primary'.
INFO:data_websocket:Broadcasting primary pipeline reset to all 1 clients: PIPELINE_RESETTING primary
Capture loop stopped. X resources released.
INFO:data_websocket:Successfully stopped all streams for display 'primary'.
INFO:data_websocket:Video chunk sender for 'primary' cancelled.
INFO:data_websocket:Video chunk sender for 'primary' finished.
INFO:webrtc_input:Set clipboard content, length: 65112
INFO:data_websocket:Received START_VIDEO for 'primary'. Starting its stream.
INFO:data_websocket:Found existing layout for 'primary'. Starting capture with: {'x': 0, 'y': 0, 'w': 3440, 'h': 1270}
INFO:data_websocket:Preparing to start capture for display='primary': Res=3440x1270, Offset=0x0
INFO:data_websocket:Video chunk sender started for display 'primary'.
INFO:data_websocket:SUCCESS: Capture started for 'primary'.
INFO:data_websocket:New frame backpressure task started for display 'primary'.
INFO:data_websocket:Frame-based backpressure logic task started for display 'primary'.
INFO:data_websocket:Client settings received, proceeding with backpressure loop for 'primary'.
X Shared Memory Extension available.
XShm setup complete for 3440x1270.
CPU cores available: 4
Stream settings active -> Res: 3440x1270 | FPS: 60.0 | Stripes: 1 | Mode: H264 (CPU) FullFrame | CRF: 25 | PaintOver CRF: 18 (Burst: 5f) | Colorspace: I420 (Limited Range) | Damage Thresh: 10f | Damage Dur: 20f
INFO:webrtc_input:Set clipboard content, length: 65112
dbus-daemon[276]: [system] Activating service name='org.freedesktop.login1' requested by ':1.18' (uid=1000 pid=999 comm="/usr/lib/firefox/firefox") (using servicehelper)
dbus-daemon[276]: [system] Activating service name='org.freedesktop.timedate1' requested by ':1.18' (uid=1000 pid=999 comm="/usr/lib/firefox/firefox") (using servicehelper)
dbus-daemon[276]: [system] Activated service 'org.freedesktop.login1' failed: Failed to execute program org.freedesktop.login1: Permission denied
dbus-daemon[1076]: Failed to write data to pipe!
INFO:data_websocket:Received STOP_VIDEO for 'primary'. Stopping stream.
INFO:data_websocket:Stopping all streams for display 'primary'...
INFO:data_websocket:Backpressure logic task for 'primary' cancelled.
INFO:data_websocket:Backpressure logic task for 'primary' finished.
INFO:data_websocket:Backpressure task for 'primary' was stopped. Resetting its frame IDs.
INFO:data_websocket:Resetting frame IDs for display 'primary'.
INFO:data_websocket:Broadcasting primary pipeline reset to all 1 clients: PIPELINE_RESETTING primary
Capture loop stopped. X resources released.
INFO:data_websocket:Successfully stopped all streams for display 'primary'.
INFO:data_websocket:Video chunk sender for 'primary' cancelled.
INFO:data_websocket:Video chunk sender for 'primary' finished.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[leandrotoledo]

The root cause is a missing Certificate Authority (CA) in the linuxserver/orcaslicer image, specifically impacting validation for domains secured by ZeroSSL (via Caddy).

Steps to Workaround:

1. Downloaded the Intermediate CA certificate (ZeroSSL ECC Domain Secure Site CA.crt) from Chrome desktop.
2. Copied the file into the container's trust directory:
   $ cp "ZeroSSL ECC Domain Secure Site CA.crt" /usr/local/share/ca-certificates/
3. Updated the trust store:
   $ sudo update-ca-certificates

This confirms the ZeroSSL ECC Domain Secure Site CA is missing from the base image used for this container.

ZeroSSL ECC Domain Secure Site CA.zip

[thespad]

The Ubuntu ca-certificates package, in common with many, does not include intermediate certificates. It's expected that webservers should be properly configured to send any intermediate certificates as part of their response to TLS requests, rather than assuming clients will already have them all locally.

[leandrotoledo]

Thanks @thespad, that makes sense.

For anyone else encountering this, the issue was resolved by ensuring Moonraker serves the full certificate chain.

The acme.sh installation command was updated to use --fullchain-file for the target certificate path:

acme.sh --install-cert -d klipper.mydomain \
--fullchain-file /home/klipper/printer_data/certs/moonraker.cert \
--key-file       /home/klipper/printer_data/certs/moonraker.key \
--reloadcmd      "systemctl restart moonraker"