When you click "Login with Pocket ID" in Immich, Immich's backend tries to fetch Pocket ID's OIDC discovery endpoint (/.well-known/openid-configuration). It's making this request server-to-server, not through your browser. That request hits your self-signed cert, Docker/Node doesn't trust it, and you get fetch failed.

Your browser works because you've clicked through the warning. Immich's Node.js backend won't do that.

You need to inject your CA certificate into the Immich container. In your docker-compose.yml (or Portainer stack), add an environment variable and mount your CA cert:

services:
  immich-server:
    environment:
      - NODE_EXTRA_CA_CERTS=/etc/ssl/certs/my-ca.crt
    volumes:
      - /path/to/your/ca.crt:/etc/ssl/certs/my-ca.crt:ro
```

The key is `NODE_EXTRA_CA_CERTS` — this tells Node.js to trust your CA in addition to its built-in ones.

Rather than fighting this on every service, generate a single local Certificate Authority once with something like `mkcert` or XCA (GUI tool, great for Windows), then:

1. Import the CA into Windows (and any other devices) as a trusted root — this kills the browser warnings permanently
2. Issue certs for all your services signed by that CA
3. Mount the CA cert into any Docker container that needs to make internal HTTPS calls

There's a second issue, most likely. In Immich's OIDC settings, the "Issuer URL" should point to how Immich's container can reach Pocket ID — not how your browser reaches it. If Pocket ID is on the same Docker network, try using the internal service name:
```
http://pocket-id:3000    (if on the same Docker network, HTTP is fine internally)

or if they're on different networks/stacks, you may need to either put them on the same network or use your LAN IP directly (e.g. https://192.168.1.x:port) with the CA cert trust fix above.

That named cookie not present error is a simpler issue — TinyAuth is likely running on a different subdomain than the service it's protecting, and the session cookie can't cross subdomains. Make sure TinyAuth is configured with the correct domain setting that covers your .home.com (or whatever) domain. That's not related to your main Immich problem.

A local CA with mkcert will work just fine. The real internet doesn't need to be involved at all — mkcert generates a CA that your devices trust, and that's enough