The issue is definitely the expiration of the old CA. However, the web browser seems to pull the correct certificate from the firewall (nextcloud is behind HAproxy). It is from ISRG Root X1 → R3 → my wildcard cert. However, the application seems to want to access some local copy of the certificate…

For others (like me) who take too late to actually read the bugreport, the solution is to simply browse to your Nextcloud URL in Edge Browser. After that I was able to login using the Nextcloud client successfully.

How did you delete the cert and where was it in your case? I have about a few dozen clients which have to be up an running again. I hope the NC devs will have a pretty quick look into this.

So far this is only happening for me with the Windows client and I don’t have anything special running in front of my Nextcloud server except a standard Untangle firewall. All my android devices are fine as well as the desktop app on Linux. So there’s no where I know of to delete/refresh any certifi…

SOLUTION (at least for me): Reboot the server I have Nextcloud running behind a Windows IIS reverse proxy. Windows IIS is the machine serving the certificates. Running an SSL test ( SSL Server Test (Powered by Qualys SSL Labs) ) showed that my server was returning the wrong (expired) intermediate c…

Yet another SOLUTION: I ran through and checked the SSL test site given by Mike3. I am using LetsEncrypt and I noticed that it showed two certificate paths. The #1 path was the one to the proper “ISRG Root X1” cert. There is another #2 path to the “DST Root CA X3” which shows invalid. So seems some…

Updating Server and reboot worked here :+1: However, i can’t tell if it was the the update or the reboot, that helped. :wink:

Solution of the problem [ca x3] EN: Try this to disable use of the expiring R3 in your chain [Windows OS]: Open certlm.msc from CMD (win+r), expand the tree for [1] Intermediate Certification Authorities > Certificates and for [2] Untrusted Certificates > Certificates. Drag R3 issued by DST Roo…

I split the topic since here it doesn’t seem to be related to the expired certificate rather the new one that is not included in the local varstore. Is that something that has to be done in Windows directly? Or is there something the desktop client can fix as well since the web browser doesn’t show …

For this issue, there is a bug report: ISRG Root X1 Certificate not trusted opened 10:26PM - 30 Sep 21 UTC (UTC) [chris246] chris246 bug …

Perhaps solution for linux clients and linux servers (similar problems): [image] Certificate has expired for apps.nextcloud and nextcloud.com ℹ️ Support No, the certificate for apps.nextcloud.com:443 doesn’t expire. Since 30.09.2021 the DST_Root_CA_X3 root expired apps…

Letsencrypt ISRG Root X1 local lookup not found

📱 Desktop & mobile clients 💻 Desktop

devnull October 1, 2021, 9:15am 10

Perhaps solution for linux clients and linux servers (similar problems):