Can't Encrypt New E2EE Subfolder

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 32.0.1
  • Operating system and version (e.g., Ubuntu 24.04):
    • Debian 13/Testing
  • Web server and version (e.g, Apache 2.4.25):
    • Apache 2.4.65
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • N/A
  • PHP version (e.g, 8.3):
    • 8.4
  • Is this the first time you’ve seen this issue? (Yes / No):
    • Yes
  • When did this problem seem to first start?
    • From Initial Setup
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Community Edition, Bare Metal, Web-Installer
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

I have successfully setup a new NC instance with E2EE. I have tested the encryption and it generally works. However, in the NC desktop client (win10, v4.0.1), it would seem that I cannot encrypt any sub-folders. Only the top-level folders in any given sync-connection give me the right-click → “Encrypt” option (I have made sure that the folders in question are empty). I’ve searched the docs (the server and user manuals for v32/stable have nothing about E2EE, while the client manual has very little – I have to dig into the E2E app page to get a link to the GitHub to get any more, and it’s outdated) and forums and Google and can find no mention of this being an acknowledged limitation, and it surely cannot be by design, so: what am I missing?

Steps to replicate it:

  1. New NC 32 install.

  2. Setup E2EE, and enable it in client.

  3. ???

  4. Notable lack of profit.

Log entries

Given the issue in question, I can think of no relevant logs to provide initially. I have checked NC, webserver, and browser console/network logs and can see nothing of remote relevance.

Configuration

Nextcloud

Nextcloud Config
{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***[Base Domain]***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "version": "32.0.1.2",
        "overwrite.cli.url": "***[Base Domain]***",
        "htaccess.RewriteBase": "\/",
        "dbtype": "mysql",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "dbpersistent": true,
        "mysql.utf8mb4": true,
        "default_phone_region": "GB",
        "default_locale": "en_GB",
        "default_language": "en_GB",
        "default_timezone": "Europe\/London",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0
        },
        "installed": true,
        "maintenance": false,
        "maintenance_window_start": 1,
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "app_install_overwrite": [],
        "mail_smtpauth": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "twofactor_enforced_excluded_groups": [],
        "theme": "",
        "loglevel": 2
    }
}

Apps

App List
Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - bruteforcesettings: 5.0.0-dev.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.0.6
  - contactsinteraction: 1.13.1
  - dav: 1.34.2
  - encryption: 2.20.0
  - end_to_end_encryption: 1.18.0
  - federatedfilesharing: 1.22.0
  - files: 2.4.0
  - files_accesscontrol: 3.0.1
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - group_default_quota: 0.1.12
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0-dev.0
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - quota_warning: 1.22.0
  - related_resources: 3.0.0-dev.0
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - sharereview: 1.5.0
  - support: 4.0.0-dev.0
  - suspicious_login: 10.0.0-dev.0
  - systemtags: 1.22.0
  - text: 6.0.1
  - theming: 2.7.0
  - theming_customcss: 1.19.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_totp: 14.0.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - app_api: 32.0.0 (installed 32.0.0)
  - dashboard: 7.12.0 (installed 7.12.0)
  - federation: 1.22.0 (installed 1.22.0)
  - firstrunwizard: 5.0.0-dev.0 (installed 5.0.0-dev.0)
  - recommendations: 5.0.0-dev.0 (installed 5.0.0-dev.0)
  - survey_client: 4.0.0-dev.0 (installed 4.0.0-dev.0)
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - unroundedcorners: 1.1.5 (installed 1.1.5)
  - user_ldap: 1.23.0
  - weather_status: 1.12.0 (installed 1.12.0)

Screenshots

Windows Client

Empty sub-folder, but no Encryption option. Top-level folders above it successfully encrypted.

I doubted this would work, but a just-in-case – I tried making sure that even the root folder of the to-be-encrypted subfolder was also empty.

So, this is going well.

Aside from the above issue, you also can’t encrypt entire shares. Top-level directories is all you get. Despite the fact that, once encrypted, sub-folders are indeed also properly encrypted.
Auto-upload also appears to be completely unsupported.
I also can’t download encrypted directories on Android. I can do one-off downloads of individual files, but the sync/download option is completely missing on folders. I also can’t sync back anything encrypted to the server from Android.
Syncing stuff to the server from Windows in the first place also took numerous attempts, as it kept erroring out on random files – which had to be renamed, deleted, and then replaced.

None of this is made clear up-front. The manual has next to nothing, the GH page is outdated. We seem expected to pre-emptively search through a mass-forum with a terrible search function – in which, most topics end up just getting closed without any resolution anyway.

(The Android app itself is also a mess. It needs regularly restarted just browsing normal remote directories because it eventually decides to stop actually getting directory listings. Further, local file browsing is slow to the point of hanging because *checks logcat* oh, it’s polling the entire directory tree for metadata on every change of directory. Right. Very sane.)


Your definition of “production ready” needs some revision. This is not a serious organization.

I have the same issue using Nextcloud AIO docker. Nextcloud server 32.0.3 and linux client AppImage version 4.0.4. In the linux client only root folders can be encrypted, the subfolder do not have the encrypt option in the menu. Surprinsingly, on the android app (version 3.34.1), the encrypt option is available for empty folders, but then there is some syncing issue when adding files into this new folder from the desktop. Encryption is enabled on the server and all clients.