Collabora private server nextcloud 26 cURL error 60: SSL certificate problem: self signed certificate

ā„¹ļø Support šŸ“„ Collabora
1

Hello,

Iā€™m quite blocked on the final configuration of a collabora server and nextcloud. When I try to set my server I get this error:

[richdocuments] Error: GuzzleHttp\Exception\RequestException: cURL error 60: SSL certificate problem: self signed certificate (see libcurl - Error Codes) for https://collabora.server.com/hosting/capabilities at <>

0. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php line 158

  • GuzzleHttp\Handler\CurlFactory::createRejection("*** sensitive parameters replaced **")
    1. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php line 110*
  • GuzzleHttp\Handler\CurlFactory::finishError([ā€œGuzzleHttp\Handler\CurlHandlerā€], "*** sensitive parameters replaced **", [ā€œGuzzleHttp\Handler\CurlFactoryā€])
    ā€¦

Nextcloud and Collabora are on a docker image behind a nginx proxy (manager), letsencrypt works ok and certificates are ok:

curl https://collabora-server.com. ā†’ I get: OK

I have a warning about WOPI:
You have not configured the allow-list for WOPI requests. Without this setting users may download restricted files via WOPI requests to the Nextcloud server. Click here for more info

but sincerely I have no idea what do.

Thanks for your help

2

Are you running that cURL test from inside of the Nextcloud container?

Essentially, make sure that your Nextcloud container is not bypassing the reverse proxy to reach the Collabora container.

Depending on what instructions you followed, it is possible for the Collabora container to have HTTPS enabled on it as well, but it would not be using the LE certs deployed on your reverse proxy.

Edit: To test my theory: IIRC thereā€™s also an app setting called disable_certificate_verification or the like (in the richdocuments app in NC). I believe something for it appears in the web UI in the settings area when youā€™ve set NC Office to use your own server (rather than the built in one) so you donā€™t need even need to do it from the CLI.

This will turn off certificate validation at the NC server level for the capabilities check. If things work you can then decide whether youā€™re comfortable with the two internal containers talking to each other without verification of certificates or not. If so, youā€™re done. If not, youā€™ll have to make adjustment to your environment so that NC is not bypassing the proxy.

3

Have you added the chain certificate as well (three certificate files).

if collabobara is set to use port 443 make sure the port is not already bound to a server.

4

Thank you for answering.

Iā€™ m not running the command inside the container. This was launched outside.

I also tried to disable the certificate as you suggested but I still getting the same error.

5

Thank you for the support.

This is my docker file. Iā€™m using port 9980

networks:
frontend:
# add this if the network is already existing!
external: true
backend:
external: true

services:
collabora:
image: collabora/code:22.05.12.2.1
container_name: collabora_app
networks:
- frontend
cap_add:
- MKNOD
ports:
- 9980
environment:
- domain=cloud.euredomain.com #Gebt hier eure Seafile Domain an
- username=admin #Nutzername eingeben
#- DONT_GEN_SSL_CERT=1
- password=test #Passwort eingeben
- ā€œextra_params=ā€“o:ssl.enable=false --o:ssl.termination=trueā€
restart: unless-stopped

6

We had to change Ngnix port from 443 since it was already occupied

Ngnix stack

version: ā€˜3ā€™
services:
app:
image: ā€˜jc21/nginx-proxy-manager:latestā€™
container_name: nginx
restart: always
ports:
- ā€˜80:80ā€™
- ā€˜81:81ā€™
- ā€˜9443:443ā€™

Collabora stack

version: ā€˜3ā€™
services:
collabora:
image: collabora/code
restart: always
container_name: collabora
ports:
- ā€˜9980:9980ā€™

environment:

  - aliasgroup1=https://xxx.com
  - dictionaries=en_GB
  - username=xxx
  - password=xxx
  
cap_add:
  - MKNOD
tty: true

networks:
default:
name: nginx_default
external: true

7

I had a similar issue, running Nextcloud on an Ubuntu server with Apache, reverse proxy, and an SSL certificate for Collabora on a Docker image. The trick for me was to add port 443.

Of course, you have to replace the nextcloud domain name with yours.

sudo docker run -t -d -p 127.0.0.1:9980:9980 -e 'domain=nextcloud\\.com:443' -e 'dictionaries=de en es sv ..' -e 'TZ=Europe/Stockholm' --restart always --cap-add MKNOD --privileged collabora/code
8

Thank you for all your help.

Unfortunately still getting the same error, also opening por 443 and adding ā€œdomain=nextcloud\.pippo\.com:443ā€ in the docker-compose file.

Any other hint or debug flag that I can sue to understand better?

Thanks

9

Could be a number of reasons.

If you are using Letā€™s Encrypt, have you installed three cert files, key, cert and chain.

You should use aliasgroup1 instead of domain.

What are your Nginx proxy manager settings.

10

I tried also with:

no luck.

here my nginx settings

2
21002Ɨ1210 100 KB

1
11004Ɨ1090 76.8 KB

11

if I launch

curl -v https://collabora.com

inside the next cloud container I get this error

curl: (60) SSL certificate problem: self signed certificate

outside the next cloud container I get:

OK

12

Shouldnā€™t proxy host settings ā€˜Schemeā€™ be set to https?

13

I changed but still same error. One question, why I do not get the lets encrypt certificate from inside the docker container?

Thanks

14

I have downloaded my domain cert and set it as a custom cert in the proxy manager.

I donā€™t need this stringā€¦

extra_params=ā€“o:ssl.enable=false --o:ssl.termination=trueā€