[mTLS] Notifications containing an image/HLS stream fail to load

[baurmatt]

Preflight checks

• I am using the experimental mTLS feature
• I have reproduced this issue at least once after restarting the app

App platform

iOS

Device and app information

Model Name: iPhone 13
OS Version: 26.2
App Version: 2026.3.0 (2026.1826)

Home Assistant environment

Home Assistant Core Version: 2026.2.3
Installation Type: Container
Host OS: Ubuntu
Reverse Proxy: Traefik
TLS Termination Point: Proxy

mTLS setup details

Client certificate source: mkcert
Client certificate format: PKCS#12
Certificate validity window: ? Long
Signing CA type: self-signed
Server cerificate issuer: mkcert development CA
Full chain served by server? yes

Failure symptoms

Exact error message shown in app:

Translated error: URLSessionTask failed with error: The server xxxxxxxx requires a client certificate.
When does it fail? On loading the notification picture
Frequency: Always
Time of most recent failure: This morning, UTC+1

Steps to reproduce

1. Get a notification containing a image/HLS

Expected vs actual behavior

Expected: Image is show
Actual: SSL error

Additional context

This is how the notification is send:

  - action: notify.mobile_app_iphone_von_matthias
    data:
      title: Saugroboter Vacum
      message: >-
        Die Reinigung wurde um {{ now().strftime('%-H:%M') }} Uhr erfolgreich
        abgeschlossen.
      data:
        image: /api/camera_proxy/camera.vacum_camera
        entity_id: camera.vacum_camera
        priority: high
        url: /lovelace/
        clickAction: /lovelace/
        channel: Valetudo Success

[baurmatt]

Ah, interesting! I have another notification which sends an actual image:

- id: 5ecfb7ff-446c-47fa-abff-2e313acbeeb4
  alias: Valetudo Filter Replacement
  trigger:
    - platform: numeric_state
      entity_id: sensor.valetudo_vacum_main_filter
      below: 1
  action:
    - action: notify.mobile_app_iphone_von_matthias
      data:
        title: Saugroboter Vacum
        message: "Bitte den Filter austauschen und State resetten."
        data:
          image: /local/img/valetudo/filter.png
    - action: persistent_notification.create
      data:
        title: Saugroboter Vacum
        message: "Bitte den Filter austauschen und State resetten.\n![image](/local/img/valetudo/filter.png)"

This one works!

Image Request: GET /local/img/valetudo/filter.png
HLS (?) Request: Not logged since TLS error failed before HTTP request.