# Configuration problems, reverse proxy and Office **URL:** \ **Category:** ℹ️ Support\ **Tags:** snap, curl\_err\_28, self-signed-certificate, collabora-built-in\ **Created:** [December 30, 2024, 3:41pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687 "2024-12-30T15:41:22Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [December 30, 2024, 3:41pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/1 "2024-12-30T15:41:22Z")
I’m running Nextcloud as a Snap on Ubuntu 24.04, behind a HAProxy which is running on the same system. My instance is accessible from LAN. It is listening on ports that are not the default HTTP and HTTPS ports. I have a custom certificate for the instance, signed by my own certificate authority. That is working, as I can access my instance at [https://nextcloud.tld](https://nextcloud.tld) just fine. I have 2 problems which I believe are caused by incorrect configuration. First problem is that every client is identified as 127.0.0.1. Second problem is that Nextcloud mobile clients (both Android and iOS) are unable to open office files (ods and odt) in the app for editing. I’m running the built-in CODE-server. On the _Nextcloud Office_ tab in the administration settings is the following error: > Failed to connect to the remote server: cURL error 60: SSL certificate problem: self signed certificate in certificate chain (see [libcurl - Error Codes](https://curl.haxx.se/libcurl/c/libcurl-errors.html)) for [https://nextcloud.tld/extra-apps/richdocumentscode/proxy.php?req=/hosting/discovery](https://nextcloud.tld/extra-apps/richdocumentscode/proxy.php?req=/hosting/discovery) I’ve configured HAProxy exactly as described [here](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Putting-the-snap-behind-a-reverse-proxy) with only changing the names, IP-addresses and ports to my own. Here are some rows from the configuration file of the Nextcloud Snap that I believe are relevant to these problems. ```auto 'trusted_domains' => array ( 0 => 'nextcloud.tld', 1 => 'localhost', ), 'trusted_proxies' => array ( 0 => '127.0.0.1', 1 => '::1', ), 'forwarded_for_headers' => array ( 0 => 'HTTP_X_FORWARDED_FOR', 1 => 'HTTP_X_REAL_IP', ), 'overwrite.cli.url' => 'https://nextcloud.tld', ``` What am I doing wrong? ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 30, 2024, 9:22pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/2 "2024-12-30T21:22:19Z")
hi @temperator welcome to the community 🤝 > [@temperator](#): > > every client is identified as 127.0.0.1. please review [101: reverse proxy](https://help.nextcloud.com/t/101-reverse-proxy/194840) likely you didn’t configure the “trusted proxy” #trusted_proxies in a right way… maybe a restart is required… > [@temperator](#): > > Failed to connect to the remote server: cURL error 60: SSL certificate problem: self signed certificate in certificate chain my first guess would be you didn’t add your self-signed cert to a container Root CA store, which is required as both system must connect to each other using “public” https:// URL (see [Collabora integration guide](https://help.nextcloud.com/t/collabora-integration-guide/151879) for details) ---
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [December 30, 2024, 9:45pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/3 "2024-12-30T21:45:22Z")
What is the _container Root CA store_ in my case? I’m using the built-in CODE server. The host system of my instance is running on bare metal. I have added the _root certificate of my own certificate authority_ to the trust store of Ubuntu. This seems to have been successful as running `curl https://nextcloud.tld/index.php/dashboard` from a shell _on the host system_ returns a proper HTML-file. Is Snap-Nextcloud somehow unable to read the trusted root certificates of the host system? ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 30, 2024, 10:58pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/4 "2024-12-30T22:58:05Z")
> [@temperator](#): > > Is Snap-Nextcloud somehow unable to read the trusted root certificates of the host system? I’m not very familiar with Snap but suppose it is not expected to read the host CA store… in general containers are not “just another application” running on the host but more a slim VM isolated in many ways… this isolation is usually an advantage -container having access to a host file system would be huge security issue. > [@temperator](#): > > What is the _container Root CA store_ in my case? this is your job to find, I remember I saw the CA path shortly in the logs but I can say where/how. In general I would recommend you stop using self-signed certificates as it is really hard to make them work (every single client, mobiles, other users - friends, family, federated, shares) - IMO it is unmanageable to use self-signed certificates even for a small device fleet like a family without introducing an MDM solution… UPDATE: I came again across my logs again and add here for the reference: Nextcloud server is using “`/var/www/html/lib/private/Http/Client/Client.php`” when it connects to external systems and this one uses **/var/www/html/resources/config/ca-bundle.crt** in NC 30.0.4 Docker:Apache (but likely it’s generic). ---
**Author:** ![Michiel\_Breur](https://help.nextcloud.com/user_avatar/help.nextcloud.com/michiel_breur/32/67642_2.png) [@Michiel\_Breur](https://help.nextcloud.com/u/Michiel_Breur)\ **Post date:** [December 30, 2024, 11:13pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/5 "2024-12-30T23:13:59Z")
Don’t use the built-in code server, i found this out the hard way. It’s slow… buggy, just dies for no reason eventually wasting hours trying to figure out why, errors suddenly show up in nextcloud.log while it was working only minutes before. After a few days of fiddling around this solved it for me. Note~ i didn’t use the full guide mentioned, for some reason that was confusing. Use the docker image collabora/code. Add the new DNS to your hosting/dashboard . (f.e. [collabora.yoursite.com](http://collabora.yoursite.com)). ```auto docker run -t -d -p 127.0.0.1:9980:9980 -e 'domain=collabora\\.yoursite\\.com' --restart always --cap-add MKNOD collabora/code ``` Or this if you want to add dictionary (i didn’t) ```auto docker run -t -d -p 127.0.0.1:9980:9980 -e 'domain=collabora\\.yoursite\\.com' -e 'dictionaries=en nl ..' --restart always --cap-add MKNOD collabora/code ``` !!Note the **\\.** it’s needed!! Run the following: ```auto a2enmod proxy a2enmod proxy_wstunnel a2enmod proxy_http a2enmod ssl ``` ```auto Run : certbot -d collabora.yoursite.com (Pick 1) ``` Create a new site sites-available\yoursite.conf cp the example from the [guide](https://collabora-online-for-nextcloud.readthedocs.io/en/latest/install/) Edit/nano your collabora.conf and add the /path/to/your/cert.pem lines Change the line : `ServerName collabora.yoursite.com` (For me it puts the new ssl/cert files into /etc/letsencrypt/live/collabora.yoursite.com, i’ve read that sometimes it’ll add a `1` behind files if all are stored in same dir?) ```auto SSLCertificateFile /etc/letsencrypt/live/collabora.yoursite.com/cert.pem SSLCertificateChainFile /etc/letsencrypt/live/collabora.yoursite.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/collabora.yoursite.com/privkey.pem ``` Save and restart apache2 when asked. ```auto run : a2ensite collabora.conf ``` ```auto curl -v collabora.yoursite.com ``` And if all turns out fine add : `https://collabora.yoursite.com` to the nextcloud administration/office and select your own server. Incase i missed something please let me know. ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 31, 2024, 7:00am UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/6 "2024-12-31T07:00:34Z")
> [@Michiel\_Breur](#): > > `-e 'domain=collabora\\.yoursite\\.com' ` please be aware this is wrong/useless for newer versions > [@Important changes regarding COOL/CODE docker versions from v21.11.3.6 on (multiple domains setup)](https://help.nextcloud.com/t/important-changes-regarding-cool-code-docker-versions-from-v21-11-3-6-on-multiple-domains-setup/137867/1): > > `-e ERR: Use of domain variable is not supported.` use `aliasgroup` instead. if you only have one NC non need to bother at all, the 1st system connecting is always allowed. ---
**Author:** ![scubamuc](https://help.nextcloud.com/user_avatar/help.nextcloud.com/scubamuc/32/63165_2.png) [@scubamuc](https://help.nextcloud.com/u/scubamuc)\ **Post date:** [December 31, 2024, 9:13am UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/7 "2024-12-31T09:13:52Z")
> [@temperator](#): > > running Nextcloud as a Snap on Ubuntu 24.04 @temperator suggest you take a close look at our [Nextcloud snap wiki](https://github.com/nextcloud-snap/nextcloud-snap/wiki) expecially [CODE & Nextcloud Office configuration](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Configure-CODE-and-Nextcloud-office-for-Nextcloud-snap) and [Reverse proxy configuration](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Putting-the-snap-behind-a-reverse-proxy) once you’ve checked that out see [Hosts & FQDN configuration](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Hosts-and-FQDN-for-Nextcloud-snap) > [@Michiel\_Breur](#): > > Don’t use the built-in code server I personally agree with @Michiel_Breur and would suggest something like [How to install and configure Collabora CODE server for Nextcloud snap with docker](https://github.com/nextcloud-snap/nextcloud-snap/wiki/How-to-configure-collabora-CODE-with-docker) to save you time and hassle. ---
**Author:** ![Michiel\_Breur](https://help.nextcloud.com/user_avatar/help.nextcloud.com/michiel_breur/32/67642_2.png) [@Michiel\_Breur](https://help.nextcloud.com/u/Michiel_Breur)\ **Post date:** [December 31, 2024, 9:19am UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/8 "2024-12-31T09:19:38Z")
I didn’t know the \. Is needed anymore, since it worked using the \. Was needed, you can ignore that then. ---
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [December 31, 2024, 9:43am UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/9 "2024-12-31T09:43:40Z")
I circumvented the first problem (real IP addresses not being detected) by removing the reverse proxy alltogether and making the Snap listen the default ports 80 and 443. Apparently I would have had to terminate the TLS-connection with HAProxy to be able to set the `X-Forwarded-For`-header. I don’t have for that. The second problem still remains. My certificate isn’t self signed in the sense that I understand. It is signed by a certificate authority that just isn’t publicly know. I have installed the root certificate into multiple devices and signed multiple domain-specific certificates with it. Everything else works just fine, including the actual Snap-Nextcloud. The only problem I have is with the built-in CODE server. So no, I’m not going to stop using my own certificates. I could deploy a separate Collabora Online server but even in that case, would my Snap-Nextcloud be able to trust the certificate of the Collabora server if the root certificate isn’t known to Snap-Nextcloud? EDIT: I just checked `/snap/core20/current/etc/ssl/certs` and my root certificate is not there. I think I would somehow have to put it there. I’m trying to figure out how. ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 31, 2024, 1:44pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/10 "2024-12-31T13:44:31Z")
> [@temperator](#): > > I could deploy a separate Collabora Online server but even in that case, would my Snap-Nextcloud be able to trust the certificate of the Collabora server if the root certificate isn’t known to Snap-Nextcloud? both systems and users accessing the system must trust the whole certificate chain of both systems. This is the reason why running self-signed certificates is difficult as long you can not manage all involved clients and servers. ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 31, 2024, 1:47pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/11 "2024-12-31T13:47:04Z")
it’s not the `\.` 🤦‍♂️ it is the “`domain=`” which is replaced by “`aliasgroup1=`” ---
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [December 31, 2024, 2:26pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/12 "2024-12-31T14:26:11Z")
All my clients (Android, iOS, Linux laptops) trust the root certificate. All my servers, Ubuntu and Raspberry Pi, trust it. I haven’t had any real difficulties with this system before this one, so I wouldn’t blame this on privately signed certificates. It’s common practise for enterprises to have private networks with private certificates. Seems to me that this is purely a Snap problem. Everything else about Nextcloud works nicely, so I’m going to try to fix this before switching over to a separate Collabora Online. ---
**Author:** ![scubamuc](https://help.nextcloud.com/user_avatar/help.nextcloud.com/scubamuc/32/63165_2.png) [@scubamuc](https://help.nextcloud.com/u/scubamuc)\ **Post date:** [December 31, 2024, 3:33pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/13 "2024-12-31T15:33:30Z")
> [@temperator](#): > > Seems to me that this is purely a Snap problem. probably not… [Managing encryption](https://github.com/nextcloud-snap/nextcloud-snap/wiki/Managing-HTTP-encryption-(HTTPS)) ---
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [December 31, 2024, 10:24pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/14 "2024-12-31T22:24:26Z")
@scubamuc I installed my certificates following those instructions. - `cert.pem` contains the certificate of my Nextcloud instance - `chain.pem` contains aforementioned certificate **and** my root certificate - `privkey.pem` contains the private key I still get the following error on the settings page of Nextcloud Office. > Could not establish connection to the Collabora Online server. > Failed to connect to the remote server: cURL error 60: SSL certificate problem: self signed certificate in certificate chain (see [libcurl - Error Codes](https://curl.haxx.se/libcurl/c/libcurl-errors.html)) for [https://nextcloud.tld/extra-apps/richdocumentscode/proxy.php?req=/hosting/discovery](https://nextcloud.tld/extra-apps/richdocumentscode/proxy.php?req=/hosting/discovery) Am I still doing something wrong? What exactly should `chain.pem` contain in my case? ---
**Author:** ![Michiel\_Breur](https://help.nextcloud.com/user_avatar/help.nextcloud.com/michiel_breur/32/67642_2.png) [@Michiel\_Breur](https://help.nextcloud.com/u/Michiel_Breur)\ **Post date:** [January 1, 2025, 2:00am UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/15 "2025-01-01T02:00:30Z")
I’m not familiar with that term. keep in mind i started doing this maybe 2 weeks ago. It’s working for me and that’s the way i did it, i tried to put in as much as i could remember and even tried to find the exact command i used to start my docker colabora image. if i made mistakes there please correct them so we can learn from it. ---
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [January 1, 2025, 7:18pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/16 "2025-01-01T19:18:17Z")
> [@wwe](#): > > UPDATE: I came again across my logs again and add here for the reference: Nextcloud server is using “`/var/www/html/lib/private/Http/Client/Client.php`” when it connects to external systems and this one uses **/var/www/html/resources/config/ca-bundle.crt** in NC 30.0.4 Docker:Apache (but likely it’s generic). The Snap-equivalent file seems to be `/snap/nextcloud/45728/htdocs/resources/config/ca-bundle.crt` but it is not writable. ---
**Author:** ![szaimen](https://help.nextcloud.com/user_avatar/help.nextcloud.com/szaimen/32/63019_2.png) [@szaimen](https://help.nextcloud.com/u/szaimen)\ **Post date:** [January 1, 2025, 7:27pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/17 "2025-01-01T19:27:15Z")
Hi, [what about `security:certificates:import`](https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/occ_command.html#security)? ---
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [January 1, 2025, 8:09pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/18 "2025-01-01T20:09:39Z")
This nudged things forward a bit. Office settings now state that `Collabora Online server is reachable.` Hooray. Still can’t open Office files using either Android or iOS clients. Apparently a cURL error 28 now. ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [January 1, 2025, 8:34pm UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/19 "2025-01-01T20:34:32Z")
I have no proof but there seems self-signed certs are not supported bay iOS > [@iOS: CalDav/CardDAV: domain daaccountvalidationdomain / error 100](https://help.nextcloud.com/t/ios-caldav-carddav-domain-daaccountvalidationdomain-error-100/206241/10): > > iOS does not support self-signed certs anymore. So your issue is different. … and to be honest I would expect the same for Android. ---
**Author:** ![temperator](https://help.nextcloud.com/user_avatar/help.nextcloud.com/temperator/32/67774_2.png) [@temperator](https://help.nextcloud.com/u/temperator)\ **Post date:** [January 2, 2025, 8:37am UTC](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687/20 "2025-01-02T08:37:07Z")
One can install certificates in Android. `Settings / Network and Internet / Internet / Network preferences / Install certificates` [Next page](https://help.nextcloud.com/t/configuration-problems-reverse-proxy-and-office/213687.md?page=2)