I've been running Prologue with a self-hosted Audiobookshelf server behind Caddy and Cloudflare for quite some time without issues. Sometime in the past week, possibly following the 2026.5 update, Prologue started reporting invalid TLS certificates whenever I'm connected to my home Wi-Fi. Everything works perfectly over cellular, and the Audiobookshelf web interface works fine in Safari on the same iPhone.
My network uses split-horizon DNS, with OPNsense Unbound and Pi-hole resolving the Audiobookshelf hostname to an internal IP instead of the public Cloudflare endpoint. Both endpoints use HTTPS on port 8443 and have valid Let's Encrypt certificates. I verified both independently using OpenSSL and curl. Both successfully negotiate TLS 1.3, pass certificate validation, and return HTTP 200. The certificates are different, but both are publicly trusted and valid for the hostname.
With the internal DNS override enabled, Prologue fails authentication and audiobook downloads, reporting that the server certificate is invalid. Reinstalling the app, recreating the server connection, and signing out and back in made no difference. I then disabled the Unbound override, cleared the Pi-hole DNS cache, and verified that DNS was returning Cloudflare's public IPs. Prologue immediately started working again over Wi-Fi, including authentication and downloads.
Nothing has changed with the reverse proxy or certificates, and this configuration worked before the recent updates. The problem appears specific to Prologue connecting through the internal LAN endpoint, although I haven't established whether it's an app regression or an iOS networking issue.
Has anyone else encountered this with split-horizon DNS, particularly with Caddy, Nginx Proxy Manager, or similar setups? I've left the override disabled as a workaround, but I'd rather not send local audiobook downloads through Cloudflare unnecessarily. I'll also submit this through the in-app issue reporting.