TL;DR: When I start the Android app with no Wi-Fi connection (only mobile net), there is a 10-second delay before the app initiates an HTTPS connection. I have 4 users, all with Android devices, and I have been able to reproduce this issue on all devices.
When connected to a Wi-Fi network, there is no delay, and the app connects right away.
Network infrastructure
- I have openHAB installed on a physical server (Dell PowerEdge R330) on Ubuntu 24.04, using the DEB package.
- I have an internal public key infrastructure, the CA (certification authority) issues all my certificates (both server certificates and client certificates). The root CA and intermediate CA certificates are trusted by all Android devices.
- I have Nginx installed on the same server as openHAB, which acts as a reverse proxy for internal clients (i.e. connecting from the internal network). It requires client certificate (mTLS) authentication, but no basic authentication (username/password). It proxies traffic to openHAB directly on TCP/8080.
- I have a separate server running Nginx, which is exposed to the Internet, and acts as reverse proxy for multiple services, including openHAB. Remote users connect through this. It requires client certificate (mTLS) authentication, as well as basic authentication (username/password). It proxies traffic to openHAB directly on TCP/8080.
Issue description
As mentioned in the TL;DR, when an Android device is only connected through the cellular network, and not through Wi-Fi, whenever the app is started, every time it takes exactly 10 seconds to load the sitemap.
I tried removing the local server configuration from the app, so that it would connect to the remote address not matter if on Wi-Fi or not, but this didn’t make a difference: mobile net –> 10 sec delay, Wi-Fi –> no delay.
I checked the log in the app (see below), but I didn’t find anything interesting. It seems like it’s not doing anything for 10 seconds. (It’s between 11:52:15 and 11:52:25; there are two debug-level log entries in those 10 seconds, but to me they don’t indicate anything connection-related. I might be wrong, though.)
Also tried running tcpdump on the public Nginx, but there was absolutely no traffic from my cell phone before or during those 10 seconds. I saw the first SYN - SYN/ACK - ACK (i.e. TCP handshake) right after those 10 seconds elapsed, and afterwards everything worked quickly.
Has anyone else come across this, too? Any solutions to this?
I tried searching the Community for this, but no luck.
03-19 11:52:15.603 23334 23363 D ConnectionFactory: checkAvailableConnection: found types [ConnectionType(type = Mobile, network=109)]
03-19 11:52:15.603 23334 23391 I okhttp.OkHttpClient: <-- HTTP FAILED: java.io.IOException: Canceled
03-19 11:52:15.603 23334 23406 I okhttp.OkHttpClient: --> GET https://<openhab-remote-address-openHAB>/api/v1/settings/notifications
03-19 11:52:15.604 23334 23406 I okhttp.OkHttpClient: User-Agent: Mozilla/5.0 (Linux; Android 4.0.4; Galaxy Nexus Build/IMM76B) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.133 Mobile Safari/535.19
03-19 11:52:15.604 23334 23406 I okhttp.OkHttpClient: Cache-Control: no-cache
03-19 11:52:15.604 23334 23406 I okhttp.OkHttpClient: --> END GET
03-19 11:52:15.604 23334 23363 D ServerConfiguration: load: ServerConfiguration(id=1, name=openHAB, localPath=ServerPath(url=https://<openhab-local-address-openHAB>/, userName=<none>, password=<none>), remotePath=ServerPath(url=https://<openhab-remote-address-openHAB>/, userName=<redacted>, password=<redacted>), sslClientCert=[myCertName], defaultSitemap=DefaultSitemap(name=default, label=Debug), wifiSsids=[], restrictToWifiSsids=false, frontailUrl=null, mainUiStartPage=null)
03-19 11:52:15.604 23334 23363 D ConnectionFactory: Connecting to remote URL
03-19 11:52:15.689 23334 23334 D AbstractBaseActivity: Show snackbar with tag connectionEstablished
03-19 11:52:18.709 23334 23334 D AbstractBaseActivity: No next snackbar to show
03-19 11:52:20.442 23334 23410 D ProfileInstaller: Skipping profile installation for org.openhab.habdroid
03-19 11:52:25.310 23334 23399 D ClientKeyManager: chooseClientAlias - alias: [myCertName]
03-19 11:52:25.311 23334 23399 D ClientKeyManager: getPrivateKey
03-19 11:52:25.333 23334 23399 D ClientKeyManager: getCertificateChain
03-19 11:52:25.333 23334 23399 D ClientKeyManager: java.lang.Throwable
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at org.openhab.habdroid.core.connection.ConnectionFactory$ClientKeyManager.getCertificateChain(SourceFile:506)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.NativeSsl.setCertificate(NativeSsl.java:241)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.NativeSsl.chooseClientCertificate(NativeSsl.java:226)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngine.clientCertificateRequested(ConscryptEngine.java:1651)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:571)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1092)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1076)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:873)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:744)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:709)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.processDataFromSocket(ConscryptEngineSocket.java:907)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngineSocket$SSLInputStream.-$$Nest$mprocessDataFromSocket(Unknown Source:0)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngineSocket.doHandshake(ConscryptEngineSocket.java:242)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at com.android.org.conscrypt.ConscryptEngineSocket.startHandshake(ConscryptEngineSocket.java:224)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.RealConnection.connectTls(SourceFile:379)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.RealConnection.establishProtocol(SourceFile:337)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.RealConnection.connect(SourceFile:209)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.ExchangeFinder.findConnection(SourceFile:226)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(SourceFile:106)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.ExchangeFinder.find(SourceFile:74)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.RealCall.initExchange$okhttp(SourceFile:255)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.ConnectInterceptor.intercept(SourceFile:32)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:109)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.cache.CacheInterceptor.intercept(SourceFile:95)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:109)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.http.BridgeInterceptor.intercept(SourceFile:83)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:109)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(SourceFile:76)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:109)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.logging.HttpLoggingInterceptor.intercept(SourceFile:221)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.http.RealInterceptorChain.proceed(SourceFile:109)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(SourceFile:201)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at okhttp3.internal.connection.RealCall$AsyncCall.run(SourceFile:517)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1154)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:652)
03-19 11:52:25.333 23334 23399 D ClientKeyManager: at java.lang.Thread.run(Thread.java:1563)
03-19 11:52:25.498 23334 23399 I okhttp.OkHttpClient: <-- 200 https://<openhab-remote-address-openHAB>/rest/ (10329ms)
03-19 11:52:25.498 23334 23399 I okhttp.OkHttpClient: date: Thu, 19 Mar 2026 10:52:24 GMT
03-19 11:52:25.498 23334 23399 I okhttp.OkHttpClient: content-type: application/json
03-19 11:52:25.498 23334 23399 I okhttp.OkHttpClient: vary: Accept-Encoding, User-Agent
03-19 11:52:25.498 23334 23399 I okhttp.OkHttpClient: access-control-allow-origin: *
03-19 11:52:25.498 23334 23399 I okhttp.OkHttpClient: access-control-allow_credentials: true
03-19 11:52:25.499 23334 23399 I okhttp.OkHttpClient: access-control-allow-headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
03-19 11:52:25.499 23334 23399 I okhttp.OkHttpClient: access-control-allow-methods: GET,POST,OPTIONS,PUT,DELETE,PATCH
03-19 11:52:25.499 23334 23399 I okhttp.OkHttpClient: <-- END HTTP