[Bug]: self signed certificates are no longer accepted since 3.17.

[hubertmeier]

⚠️ Before submitting, please verify the following: ⚠️

• This is a bug, not a question or a configuration issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server and Desktop Client are up to date. See Server Maintenance and Release Schedule and Desktop Releases for supported versions.
• I agree to follow Nextcloud's Code of Conduct

Bug description

self signed certificates are no longer accepted since 3.17.

is there meanwhile a solution? All installations on windows and now on linux too show certificate errors, on windows i downgraded to 3.16. and that works, but that can't be a solution.

the configuration ist a nextcloudpi where the port 443 is forwarded as a port 8443 on a router with a dynamic name server, here "xxxx.myfritz.net:8443"

On all installations, i had to accept the first time the certificate and that's it.

If there are stronger mechanisms in 3.17., at the settings (perhaps per account) should be the option to use it like in v 3.16.

Nextcloud is so often used in this configuration at homes.

...

Steps to reproduce

all versions since 3.17.x show this described behaviour
...

Expected behavior

show an option to accept the certificate
...

Which files are affected by this bug

desktop client windows, linux

Operating system

Windows

Which version of the operating system you are running.

Windows 10, 11, Mint all versions

Package

Official Linux AppImage

Nextcloud Server version

all versions

Nextcloud Desktop Client version

3.17.x

Is this bug present after an update or on a fresh install?

Updated from a minor version (ex. 3.16.1 to 3.16.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

Are you using an external user-backend?

• Default internal user-backend
• LDAP/ Active Directory
• SSO - SAML
• Other

Nextcloud Server logs

Additional info

No response

[Rello]

Hello,

please check if your server has HSTS enabled. if so, it needs to be disabled. If the server tells the client to be strict, we are enforcing it.
#8654

closing here for now

[hubertmeier]

Hello, i disabled the HSTS Header in the apache-config /etc/apache2/sites-available/001-nextcloud.conf:

I commented the line with the header out with #:

### DO NOT EDIT! THIS FILE HAS BEEN AUTOMATICALLY GENERATED. CHANGES WILL BE OVERWRITTEN ###

<IfModule mod_ssl.c>
  <VirtualHost _default_:443>
    DocumentRoot /var/www/nextcloud
    CustomLog /var/log/apache2/nc-access.log combined
    ErrorLog  /var/log/apache2/nc-error.log
    SSLEngine on
    SSLProxyEngine on
    SSLCertificateFile   /etc/ssl/certs/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

    # For notify_push app in NC21
    ProxyPass /push/ws ws://127.0.0.1:7867/ws
    ProxyPass /push/ http://127.0.0.1:7867/
    ProxyPassReverse /push/ http://127.0.0.1:7867/
  </VirtualHost>

  <Directory /var/www/nextcloud/>
    Options +FollowSymlinks
    AllowOverride All
    <IfModule mod_dav.c>
      Dav off
    </IfModule>


<IfModule mod_ssl.c>
  <VirtualHost _default_:443>
    DocumentRoot /var/www/nextcloud
    CustomLog /var/log/apache2/nc-access.log combined
    ErrorLog  /var/log/apache2/nc-error.log
    SSLEngine on
    SSLProxyEngine on
    SSLCertificateFile   /etc/ssl/certs/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

    # For notify_push app in NC21
    ProxyPass /push/ws ws://127.0.0.1:7867/ws
    ProxyPass /push/ http://127.0.0.1:7867/
    ProxyPassReverse /push/ http://127.0.0.1:7867/
  </VirtualHost>
  <Directory /var/www/nextcloud/>
    Options +FollowSymlinks
    AllowOverride All
    <IfModule mod_dav.c>
      Dav off
    </IfModule>
    LimitReque    LimitRequestBody 0
    SSLRenegBufferSize 10486000
  </Directory>
  <IfModule mod_headers.c>
    # Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains"
  </IfModule>
</IfModule>

The header seems correctly not to be sent:

The client shows always the same message:

Choose another URL / try over HTTP (unsecure) / configure client certificate

These are no real options, another URL does not exist, HTTP is unsecure, How can i configure a client certificate???

Please keep in mind that accessing through any browser is always possible, with HSTS or without, Firefox, Chrome, all without problems, only the client shows these problems. The browsers show the "unsecure website message", but i can use them. What is also missing? A nexctcloud instance with self-signed certificate is very very often used,..

The changes made in client 3.17. are not really clear for me, the problem with deactivated HSTS-Header remains. The acces per browser works (unsecure, with accepting the self signed certificate). So we need a nextcloupi-configuration which works with self-signed certificates and forwarded ports.

Is it possible that the portforwarding (intern 443, extern 8445) causes these problems?

Thank you

[tschenkelz]

Hello.

I use nextcloud AIO and I dont see a reasonable way to deal with this issue.
I cannot connect to my nextcloud with my nextcloud desktop app anymore.

I use my own CA at my nextcloud. Worked before, now I cant get it back to work.

• I am asking to re-open this issue -