How to export private certificates

ℹ️ Support
,
1

Since the SSL certs are auto-updated every 90 days, how do I export the certs so that our firewall can do content inspection?

2

Hi @dmay.cuny

Aside from the fact that this topic is not really Nextcloud specific, one would need a lot more information about your network and server infrastructure before they could even begin to think about giving you any kind of educated advice.

Just this much: transparent traffic inspection on edge firewalls is a dying breed, precisely because today everything runs over HTTPS and therefore IPS/IDS is shifting more and more to the endpoints. You could use a web proxy, but that comes with it’s own challenges, especially as Encrypted SNI, Encrypted Client Hello, and HTTP3/QUIC gain more traction…

Inspect traffic from client devices:

  • Client devices → web proxy → Internet. This requires the web proxy certificate to be installed on the client devices.

Inspect traffic to a web applictaion server:

  • Client devices → reverse (web) proxy → web application server. In this case you would inspect the traffic on the reverse proxy, and there would be no need to copy certificates back and forth because the reverse proxy is also the HTTPS endpoint.
1 Like
3

No. That want my question. At all.

My firewall does the traffic inspection for me. All I need is the SSL certs from Nextcloud to then import into my firewall to do the inspection.

How do I export the private key and cert chain from Nextcloud so that I can import them into my firewall?

4

Nextcloud has no ssl certs and keys.
You need to check config of your Webserver

1 Like
5

Where the actual certificate files are stored depends on the operating system, the installation type, and how exactly you obtained the certificates. For example, if you are using Certbot on a Debian or Ubuntu system, they are stored in /etc/letsencrypt/live/cloud.yourdomain.tld/.

Also, since the web server handles https, as @rakekniven already said, you should be able to find the path to the certificate files in your web server’s ssl configuration:

Example in Apache:

SSLCertificateFile /etc/letsencrypt/live/cloud.yourdomain.tld/fullchain.pem
SSLCACertificateFile /etc/letsencrypt/live/cloud.yourdomain.tld/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cloud.yourdomain.tld/privkey.pem
1 Like
6

Well, Nextcloud does maintain the Nextcloud SNAP package on github, and that DOES include an automated, trusted cert renewal.

So I realize I probably need to extract them via an openssl CLI command but didn’t know how the SNAP package was architected if it would allow for this or was its cert config non-standard.

7

I don’t use snap myself, but according to their documentation it looks like the keys and certificates are stored in: /var/snap/nextcloud/current/

https://github.com/nextcloud-snap/nextcloud-snap#where-is-my-stuff

8

@bb77 is right, /var/snap/nextcloud/current/certs is the correct location.
see also managing enctryption

9

Since the cert renewals are automated in the SNAP package there must be a password required to access and export the private cert and chain files, or is root access enough?

10

yes sudo will suffice.