SSL certificate problem: unable to get local issuer certificate

[webmilio]

Steps to reproduce

1. Install AIO as a docker image.
2. Use NGINX as reverse proxy
3. Try to validate the domain in the New AIO instance

Expected behavior

Certificate should validate correctly.

Actual behavior

Certificate is said to be invalid.
NOTICE: PHP message: The error message was: SSL certificate problem: unable to get local issuer certificate

Host OS

Windows Server 2019.
Docker 20.10.21

Nextcloud AIO version

7.7.1

Current channel

Not sure. Image is nextcloud/all-in-one:latest, so latest ?

Other valuable info

I've tried following the steps in this bug here to no avail, since I cannot find occ even with find -name occ.

What I tried

I've tried using update-ca-certificates in various combinations of ways. Some notes before listing what I tried:

• When I say I 'copy' a file, I mean into /usr/local/share/ca-certificates
• When I say 'error is empty', I mean I get this: NOTICE: PHP message: The error message was:

Attemps

1. Copied my certificate's ca-bundle: WARNING: ca-cert-STAR_....com.ca-bundle.pem does not contain exactly one certificate or CRL: skipping
2. Opened my certificate's ca-bundle with notepad++, created two individual certificates since there were two in there. First attempt with file extension .cer, second with .pem. Error is empty.
3. Copy my actual certificate in there. Error is empty.

[szaimen]

Hi, see https://github.com/nextcloud/all-in-one/blob/main/local-instance.md

[webmilio]

Why are your replies always being marked as answers, I'll mark the answer when the problem is solved.
I've already followed the entire debugging procedure, EXCEPT FOR point 5 because I don't understand it. I've also tried with step 13 and of course it works, however I do not wish to disable domain validation.

You can access this temporarily with this link and see that the certificate is valid.

[szaimen]

This is exactly your problem. You pointed the reverse proxy at the aio interface and not at the chosen APACHE_PORT.

[webmilio]

Pointing my reverse proxy towards the APACHE_PORT (11000) means I cannot access the AIO interface to configure it. AIO is in a docker container that binds to port 5000. The domaincheck container is using port 11000 so I cannot tell the AIO docker container to bind to port 11000. Am I missing a step or am I supposed to reverse proxy to the domaincheck ?

I still feel like I'm having a certificate authority issue. This file does not contain my intermediate authority, Sectigo RSA Domain Validation Secure Server CA.

[webmilio]

I've just tried changing the APACHE_PORT to 5001 and accessing the AIO interface locally instead of via the domain. I've changed my reverse proxy to point to the APACHE_PORT port as well, nothing changed.

Restarted from complete scratch, followed all steps without modifying much of anything for Windows and reverse proxy. Same error. Trying to access said website via https://nc-domain:8443 gives me

{"level":"error","ts":1701635392.078927,"logger":"tls.obtain","msg":"will retry","error":"[webmilio.com] Obtain: [webmilio.com] solving challenge: webmilio.com: [webmilio.com] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - 76.68.184.231: Fetching http://webmilio.com/.well-known/acme-challenge/hxKYxuq5ToOggH1MZtrS6Uq8pJhqUxcXNnRT35SekIE: Timeout during connect (likely firewall problem) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":2,"retrying_in":120,"elapsed":80.8783691,"max_duration":2592000}

As szaimen said, the reverse proxy had to point to 11000 which means you must configure Nextcloud locally first. I was able to circumvent the NGINX/Nextcloud issue of the 11000 not displaying anything by making a clean config of NGINX. Turns out accessing the :8443 domain was not necessary. I was able to fix the local issuer error by extracting the two certificates in the ca-bundle, saving them as .cer files, putting them in /usr/local/share/ca-certificates and running update-ca-certificates.

[JuSenshi]

@webmilio Where did you put what certificates? I currently run into the same issue where i get the local issuer error when my reverse proxy is pointing to 11000. In my reverse proxy i configured the certificate of my own domain, which nextcloud doesn't seem to like. I can't put it in the domaincheck-container because it's alpine and i haven't yet figured out how to do the equivalent of "update-ca-certificates". Altough i just checked the file you linked and it contains my Root CA.