Hi, guys! I am at a loss. Two days ago, my clients stopped working. I updated my Nextcloud AIO to Nextcloud Hub 26 Winter (33.0.6), as well as the client. However, the client no longer connects to the server and requests a client TLS certificate. Access via the browser works fine. Where do I get that certificate? Thanks for the help. (Oh and I am on Linux)
What result do you get if you test with https://www.ssllabs.com/ssltest/?
The striking feature, at least in my view, is in the first picture:
- this server works only in browsers with sni support
The message “This server works only in browsers with SNI support” is a standard informational warning from SSL testing tools (like SSL Labs) indicating that your web server uses Server Name Indication (SNI) to host multiple SSL certificates on a single IP address and it cannot identify the correct certificate if a connecting client fails to send the hostname during the TLS handshake
Hi Adelaar! Thanks for this. The server uses a wildcard cert from the hosting company, and, to my understanding, AIO uses its own Let’s Encrypt cert. So, multiple certs are in place. However, that combination worked just fine a week ago (prior to the update).
Cheers.
Michael
Yes, I wrote my comment partly because, as I understand it, you shifted the focus with the following sentence:
the lines marked in red in the second image, which relate to the outdated versions of Safari. However, these are outdated and are therefore no longer in use today; this also applies to other outdated versions of browsers.
As you’re using Linux, it’s relatively easy for you to test other versions of the client. Unfortunately, you haven’t specified exactly which client you’re currently using. Are you using a client that came with your Linux distribution, or an AppImage? In any case, it would also be useful to know the exact version of the client.
If you switch clients, you won’t lose your credentials, as these are stored in the file /home/<username>/.config/Nextcloud/nextcloud.cfg and are retained even if, for example, you switch from the client’s Debian DEB packages to AppImage and vice versa. I did so for testing several times.
Hi Adelaar!
Sorry for this: Nextcloud-desktop (4.0.6-1). And I installed it via apt install. The .config is gone (it is on a newly installed machine). And I did get rid of the wildcard cert. Unfortunately, the same issue persists.
A simple curl -v https://yourserver.example.com/status.php works?
Hi mritzmann!
Jup. Works.
- TLSv1.3 (IN), TLS handshake, Server hello (2):
- TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
- TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
- TLSv1.3 (IN), TLS handshake, Certificate (11):
- TLSv1.3 (IN), TLS handshake, CERT verify (15):
- TLSv1.3 (IN), TLS handshake, Finished (20):
- TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
- TLSv1.3 (OUT), TLS handshake, Finished (20):
- SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / id-ecPublicKey
I’m using a different server setup to you (no AIO, no Apache – I’m using nginx instead). So I can’t quite understand your problem.
However, I’ve noticed that the version of the client you’ve recently installed (4.0.6) is already half a year old. The current version is 4.0.11 (at least as an AppImage).
So I’d suggest testing the AppImage (4.0.11 and/or 34.0.0). If the error still occurs with that, you’ll at least know that the cause of the problem lies on the server side. If the problem goes away, it’s probably a bug in the client.
Hi Guys! For whatever reason, it suddenly works again. Thanks for reaching out, but it seems there was a Gremlin at work. I’ll keep my eyes open.
Cheers
Michael
would you mind translating Thread title to english, please?
@mhengst
Hi Jimmy!
Sorry for the late reply. Done…