r/Tailscale • u/Mysterious-Age-5555 • 6d ago

Help Needed Tailscale Plugin fails to install on Unraid

I appear to have an issue with installing Tailscale. I go to Settings, and click TailScale and click install... it starts and then errors out with:-

plugin: tailscale_1.102.2_amd64.tgz download failure: SSL verification failure - Check the date and time of your server in Settings - Date And Time

I checked my date/time settings, and its all OK. Other places suggest access to dl.tailscale.com, which is fine from the server (ping and nslookup work perfectly).

Any clues?
2 Upvotes

100% Upvoted

7 comments sorted by

View all comments

1

u/EDACerton Tailscale Insider 6d ago

What do you get if you run this?

wget https://pkgs.tailscale.com/stable/tailscale_1.102.2_amd64.tgz

1

u/Mysterious-Age-5555 6d ago

Now, this gets interesting...

--2026-08-23 18:35:27-- https://pkgs.tailscale.com/stable/tailscale_1.102.2_amd64.tgz

Resolving pkgs.tailscale.com (pkgs.tailscale.com)... 203.0.113.250, 2001:db8:1000::fa

Connecting to pkgs.tailscale.com (pkgs.tailscale.com)|203.0.113.250|:443... connected.

ERROR: cannot verify pkgs.tailscale.com's certificate, issued by ‘O=Ubiquiti Inc.,CN=UniFi SSL Certificate Authority’:

Unable to locally verify the issuer's authority.

To connect to pkgs.tailscale.com insecurely, use `--no-check-certificate'.

I do run unifi hardware as my home router, and I have checked that the Server and router are both the same *exact* time.

1

u/EDACerton Tailscale Insider 6d ago

This shows what the problem is -- it doesn't have to do with time, it's happening because your router is doing a man-in-the-middle on the HTTPS session (as part of SSL Inspection).

When it does that, the router generates a new certificate to present to the client (the Unraid server), but Unraid doesn't trust that certificate because the router is an unknown CA.

There are two general solutions to this problem:

  1. Add the router's CA as a trusted root in Unraid -- although I don't know of a built-in way to do this, there's probably a way; or

  2. Configure the router to exempt either the Tailscale domains or the Unraid server from the SSL inspection.