SSL working everywhere but in Kodi

[MrOrange]

Hello,
I've been configuring NextPVR Server to use https instead of simply http with a certificate I created for it (I manage my DNS server and my certificates' infrastructure for many services), and everything seems to be working fine except with the Kodi add-on.
Scenario:
Windows 11 with both NextPVR and Kodi.
NextPVR launched not as a service but as a scheduled task, with the PFX and the pvt.key's password passed as parameters.
NextPVR is fully functional via browser (FireFox) using https; channels can be watched without problems (after granting audio+video permission)
After enabling the corresponding setting, NextPVR works as a M3U provider via https to clients such as VLC. NOTE: VLC for Android was not capable of verifying the certificate's chain because Android installs users' CA certificates (like mine) apart from the system ones, and not all apps are configured to check at both sites (this has happened to me already in the past with other apps; fortunately VLC pops up a warning giving the option of trusting the certificate anyway, but this is 100% a VLC thing)
But when it came to Kodi with the NextPVR add-on (after tuning the settings.xml file - in fact I also tuned the "instance-settings-1.xml" file), Kodi shows the following message on the top-right corner: "PVR Manager is starting up 0%" and stays there forever. NOTE: Despite being both Kodi and NextPVR running on the same PC, the add-on is not configured with "localhost" or 127.0.0.1 but with the URI associated with the certificate. This should not be the problem as my switch is capable of managing loopbacks in the domain (in fact, it is also how I checked via browser, also on the same Windows PC, which worked perfectly).

These are the versions I'm running:
NextPVR: 7.1.1.260616
Kodi: 21.3.0
add-on: 21.3.2

PS: I've noticed that it is encouraged to use a reversed proxy instead of using SSL directly on NextPVR; however, any help would be highly appreciated.

Thank you very much in advance

[mvallevand]

Manually editing the instance xml files (not settings.xml) to use https is the only thing you need to do for the addon.

You still need to get Kodi to accept self signed certificate which is not trivia. You need to configure the Kodi side https://kodi.wiki/view/SSL_certificates and AI might help you.

If you feel you have done that we'd need to see the debug Kodi logs.

Martin

[MrOrange]

wow, thanks a lot Martin, that's what I call a quick answer!!!!

And you were right, I though that Kodi would be able to search the root CA at the Windows repository of certificates... But unfortunately it is not; instead, it has its own trusted root CAs all together in a .PEM file, I simply added mine at the end of the file and now everything works fine through SSL: web, add-on, M3U

I can understand that https and certificates was kind of a niche feature in the past, but nowadays I think it's become quite standard, and given that all the backend has been developed and works perfectly well, I encourage the NextPVR team to consider:
1) add-on: make the https toggle available through the settings in Kodi, without having to manually modify the xml file
2) NextPVR: integrate https directly in the service, making it possible to enable it through the configuration portal (as well as the certificate/pvt.key+its pwd) so there's no need of a scheduled task.

I honestly think that these additions would be the top cherry of a fantastic feature that is already there.
Nevertheless, thanks a lot for your work and your help!!!!!

[mvallevand]

If I make https a toggle I feel that users will think that is all that is required and question why it doesn'twork. Typically https on a home LAN is not that important, and for WAN use (which is far from the standard use case) importantly it doesn't actually harden the system so I personally prefer the users understand what they are doing and not just toggling buttons.

Martin

[MrOrange]

If I make https a toggle I feel that users will think that is all that is required and question why it doesn'twork.  Typically https on a home LAN is not that important, and for WAN use (which is far from the standard use case) importantly it doesn't actually harden the system so I personally prefer the users understand what they are doing and not just toggling buttons.

Martin

I get your point... Maybe making it available only under "Expert" and with a confirmation message, something like "enabling https requires previous configuration on NextPVR server, otherwise the add-on won't work. Are you sure you want to proceed?" (and don't forget about the suggestions for NextPVR server/service 
Furthermore, after dealing with Kodi for Android and its "special://home/" requirement in order to access the XML   now I think it's more necessary.
Which leads me to the following: I am afraid I started celebrating too soon just because I managed to make it work in a Windows environment. In Android, after configuring the add-on settings in the XML file, I proceeded to adding my CA into Kodi's repoository of trusted roots. However, the Windows folder where the PEM file is located does not even exist in Android (at least Kodi's file manager - the only one that can access Kodi's folder - does not show it). According to google's AI what had to be done in Windows is not needed in Android as long as you added your certificate into the OS repository (which I did long time ago: it's the same CA that signed all my other certificates for my other services - Home Assistant, my NAS, ...), which sounded like good news. But after trying I got in the same scenario as before (the "PVR Manager is starting up 0%" message). I checked the Kodi logs and this is what I found:
2026-08-06 20:43:14.427 T:28266  error <general>: CCurlFile::CReadState::FillBuffer - (0xb400007ccbb9fb00) Failed: SSL peer certificate or SSH remote key was not OK(60)
2026-08-06 20:43:14.428 T:28266  error <general>: CCurlFile::Open - <https://nextpvr.home.internal:8866/service?method=session.initiate&ver=1.0&device=xbmc> Failed with code 0:
                                                  

However, if I copy that URL and paste it on a browser on the very same Android device I get the following XML (which I guess it indicates everything went fine).
<rsp stat="ok">
<sid>16d7c82168e94ccf9487d616be9bfab9</sid>
<salt>7a4996f6-0b26-4f5d-bb59-b6298387abe1</salt>
</rsp>

It looks to me that google's AI was hallucinating when it provided that answer .
I know this is totally a Kodi thing and not a NextPVR one, but if anyone knows how to add trusted root CA into Kodi's certificates repository please let me know (I am afraid that the wiki page does not provide useful information for this scenario).

btw. versions are
Kodi v21.3.0 (APK downloaded from Kodi's web)
NextPVR add-on v21.3.2

Thank you again.

[mvallevand]

I expected Android was going to fail for you if you used it, another reason this is not trivial. Maybe this will help https://forums.nextpvr.com/showthread.ph...#pid573365

All the addon really can do is change http to https, TK won't let me change system variables or make the trust easier to configure.

Martin

[MrOrange]

I expected Android was going to fail for you if you used it, another reason this is not trivial. Maybe this will help https://forums.nextpvr.com/showthread.ph...#pid573365

All the addon really can do is change http to https, TK won't let me change system variables or make the trust easier to configure.

Martin

You are a genius!!!!!!
I took the PEM I already modified for Windows, just in case I changed CRLF to just LF, I created the advancedsettings.xml file with the content (also LF only) and I passed both files to kodi using its embedded file manager (the only difference is that I copied both the XML and the PEM into special://home/userdata/, making sure that the XML pointed there too... just for not having related files scattered across different folders). I still think it's a pity all this not being integrated in the nextPVR and Kodi interfaces because it can be discouraging to setup (and imho I think it should not)... but anyway, now I can finally celebrate it .

EDIT: Ok, now I've found out that masterprfile is a shortcut to home/userdata

Thanks a lot Martin for your (extremely quick) help, really really appreciated.

[mvallevand]

Glad it worked. As I said TK won't allow my to change advancedsettings or update system files so nothing the addon can do for that. It also doesn't address how to keep cacert.pem current for other https files (it has been updated twice in the last year so it is not static, and a few will expire in 2027)

There is a workaround in pvr.nextpvr that someone (not me) could PR to modify all the calls to NextPVR disable security with |verifypeer=false which kind of makes the whole value of https moot, you still can't

Martin