Since a few nextcloud releases I’m unable to update apps.
I’m always getting the following error:
{
"reqId": "TZdPKQlNbU6NiFG3XwEP",
"level": 3,
"time": "2025-07-25T08:00:19+00:00",
"remoteAddr": "2001:9e8:aaf8:f500:6257:18ff:fe8b:c491",
"user": "admin",
"app": "no app in context",
"method": "GET",
"url": "/settings/apps/update/bookmarks",
"message": "cURL error 60: SSL certificate problem: self-signed certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://github.com/nextcloud/bookmarks/releases/download/v15.1.2/bookmarks-15.1.2.tar.gz",
"userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0",
"version": "31.0.7.1",
"exception": {
"Exception": "GuzzleHttp\\Exception\\RequestException",
"Message": "cURL error 60: SSL certificate problem: self-signed certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://github.com/nextcloud/bookmarks/releases/download/v15.1.2/bookmarks-15.1.2.tar.gz",
"Code": 0,
"Trace": [
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php",
"line": 205,
"function": "createRejection",
"class": "GuzzleHttp\\Handler\\CurlFactory",
"type": "::",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php",
"line": 157,
"function": "finishError",
"class": "GuzzleHttp\\Handler\\CurlFactory",
"type": "::"
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlHandler.php",
"line": 47,
"function": "finish",
"class": "GuzzleHttp\\Handler\\CurlFactory",
"type": "::"
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php",
"line": 142,
"function": "__invoke",
"class": "GuzzleHttp\\Handler\\CurlHandler",
"type": "->"
},
{
"file": "/var/www/cloud/lib/private/Http/Client/DnsPinMiddleware.php",
"line": 149,
"function": "{closure:{closure:GuzzleHttp\\Middleware::tap():137}:138}",
"class": "GuzzleHttp\\Middleware",
"type": "::",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php",
"line": 35,
"function": "{closure:{closure:OC\\Http\\Client\\DnsPinMiddleware::addDnsPinning():103}:104}",
"class": "OC\\Http\\Client\\DnsPinMiddleware",
"type": "->",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php",
"line": 31,
"function": "__invoke",
"class": "GuzzleHttp\\PrepareBodyMiddleware",
"type": "->"
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php",
"line": 71,
"function": "{closure:{closure:GuzzleHttp\\Middleware::cookies():28}:29}",
"class": "GuzzleHttp\\Middleware",
"type": "::",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php",
"line": 66,
"function": "__invoke",
"class": "GuzzleHttp\\RedirectMiddleware",
"type": "->"
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/HandlerStack.php",
"line": 75,
"function": "{closure:{closure:GuzzleHttp\\Middleware::httpErrors():60}:61}",
"class": "GuzzleHttp\\Middleware",
"type": "::",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
"line": 333,
"function": "__invoke",
"class": "GuzzleHttp\\HandlerStack",
"type": "->"
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
"line": 169,
"function": "transfer",
"class": "GuzzleHttp\\Client",
"type": "->"
},
{
"file": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
"line": 189,
"function": "requestAsync",
"class": "GuzzleHttp\\Client",
"type": "->",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/lib/private/Http/Client/Client.php",
"line": 206,
"function": "request",
"class": "GuzzleHttp\\Client",
"type": "->"
},
{
"file": "/var/www/cloud/lib/private/Installer.php",
"line": 246,
"function": "get",
"class": "OC\\Http\\Client\\Client",
"type": "->",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/lib/private/Installer.php",
"line": 144,
"function": "downloadApp",
"class": "OC\\Installer",
"type": "->"
},
{
"file": "/var/www/cloud/apps/settings/lib/Controller/AppSettingsController.php",
"line": 614,
"function": "updateAppstoreApp",
"class": "OC\\Installer",
"type": "->",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/lib/private/AppFramework/Http/Dispatcher.php",
"line": 200,
"function": "updateApp",
"class": "OCA\\Settings\\Controller\\AppSettingsController",
"type": "->",
"args": [
"*** sensitive parameters replaced ***"
]
},
{
"file": "/var/www/cloud/lib/private/AppFramework/Http/Dispatcher.php",
"line": 114,
"function": "executeController",
"class": "OC\\AppFramework\\Http\\Dispatcher",
"type": "->"
},
{
"file": "/var/www/cloud/lib/private/AppFramework/App.php",
"line": 161,
"function": "dispatch",
"class": "OC\\AppFramework\\Http\\Dispatcher",
"type": "->"
},
{
"file": "/var/www/cloud/lib/private/Route/Router.php",
"line": 315,
"function": "main",
"class": "OC\\AppFramework\\App",
"type": "::"
},
{
"file": "/var/www/cloud/lib/base.php",
"line": 1040,
"function": "match",
"class": "OC\\Route\\Router",
"type": "->"
},
{
"file": "/var/www/cloud/index.php",
"line": 24,
"function": "handleRequest",
"class": "OC",
"type": "::"
}
],
"File": "/var/www/cloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php",
"Line": 276,
"message": "cURL error 60: SSL certificate problem: self-signed certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://github.com/nextcloud/bookmarks/releases/download/v15.1.2/bookmarks-15.1.2.tar.gz",
"exception": [],
"CustomMessage": "cURL error 60: SSL certificate problem: self-signed certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://github.com/nextcloud/bookmarks/releases/download/v15.1.2/bookmarks-15.1.2.tar.gz"
},
"id": "68833b7c17fcf"
}
cURL is working flawless everywhere else.
I can curl the apps manually from github and extract them in the apps folder. That’s what I’m
doing since the update function stopped working.
I wrote a small php script using php-curl which could fetch the apps from github without
problems.
It seems there is something wrong with the certificate store GuzzleHttp is using.
# occ security:certificates
+-----------+-------------+--------------+-------------+-----------+
| File Name | Common Name | Organization | Valid Until | Issued By |
+-----------+-------------+--------------+-------------+-----------+
I’m runnning debian unstable with nextcloud running under php-fpm and the following php-curl:
# apt-cache policy php-curl
php-curl:
Installed: 2:8.4+96
Candidate: 2:8.4+96
Version table:
*** 2:8.4+96 990
990 http://deb.debian.org/debian unstable/main amd64 Packages
100 /var/lib/dpkg/status
php-curl is linked to openssl
# apt-cache show libcurl4t64
Package: libcurl4t64
Source: curl
Version: 8.14.1-2
Installed-Size: 1012
Maintainer: Debian Curl Maintainers <team+curl@tracker.debian.org>
Architecture: amd64
Replaces: libcurl3, libcurl4
Provides: libcurl4 (= 8.14.1-2)
Depends: libbrotli1 (>= 0.6.0), libc6 (>= 2.38), libgssapi-krb5-2 (>= 1.17), libidn2-0 (>= 2.0.0), libldap2 (>= 2.6.2), libnghttp2-14 (>= 1.50.0), libnghttp3-9 (>= 0.15.0), libpsl5t64 (>= 0.16.0), librtmp1 (>= 2.3), libssh2-1t64 (>= 1.11.1), libssl3t64 (>= 3.3.0), libzstd1 (>= 1.5.5), zlib1g (>= 1:1.2.3.4)
There is no special cert configured in my php.ini.
It would be great if someone could point me where to look next. I’m not very fond of
going through the GuzzleHttp source code.