# Many \`could not check\` on Security and setup warnings

**URL:** <https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840>\
**Category:** ℹ️ Support\
**Tags:** update\_problems, nc29, webdav, dns, setup\_warning, security\_scanner\
**Created:** [August 26, 2024, 4:36pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840 "2024-08-26T16:36:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![John5](https://help.nextcloud.com/letter_avatar/john5/32/6_22734026db12803ebb3e059622ac3534.png) [@John5](https://help.nextcloud.com/u/John5)\
**Post date:** [August 26, 2024, 4:36pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/1 "2024-08-26T16:36:00Z")

</div>

Nextcloud version _(eg, 29.0.5)_: `29.0.5`  
Operating system and version _(eg, Ubuntu 24.04)_: `Debian 12 2024-06-01`  
Apache or nginx version _(eg, Apache 2.4.25)_: `2.4.61`  
PHP version _(eg, 8.3)_: `8.1.29`

The issue you are facing:

After upgrading to NC 29 I started having much more warnings on `Security & setup warnings`. The problem is that most of them are `Could not check something...`.

A full list:

```auto
* Could not check that the data directory is protected. Please check manually that your server does not allow access to the data directory. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its `trusted_domains` or the `overwrite.cli.url`.
* Your webserver is not set up to serve `.js.map` files. Without these files, JavaScript Source Maps won't function properly, making it more challenging to troubleshoot and debug any issues that may arise.
* Could not check for JavaScript support via any of your `trusted_domains` nor `overwrite.cli.url`. This may be the result of a server-side DNS mismatch or outbound firewall rule. Please check manually if your webserver serves `.mjs` files using the JavaScript MIME type. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its `trusted_domains` or the `overwrite.cli.url`.
* Could not check if your web server properly resolves the OCM and OCS provider URLs. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its `trusted_domains` or the `overwrite.cli.url`.
* 12 errors in the logs since August 19, 2024, 3:09:13 PM
* Could not check that your web server is properly set up to allow file synchronization over WebDAV. Please check manually. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its `trusted_domains` or the `overwrite.cli.url`. For more details see the [documentation ↗](https://docs.nextcloud.com/server/29/go.php?to=admin-setup-well-known-URL).
* Could not check that your web server serves `.well-known` correctly. Please check manually. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its `trusted_domains` or the `overwrite.cli.url`. For more details see the [documentation ↗](https://docs.nextcloud.com/server/29/go.php?to=admin-setup-well-known-URL).
* Could not check for WOFF2 loading support. Please check manually if your webserver serves `.woff2` files. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its `trusted_domains` or the `overwrite.cli.url`. For more details see the [documentation ↗](https://docs.nextcloud.com/server/29/go.php?to=admin-nginx).
* Could not check that your web server serves security headers correctly. Please check manually. For more details see the [documentation ↗](https://docs.nextcloud.com/server/29/go.php?to=admin-security).

```

Is this the first time you’ve seen this error? _(Y/N)_: N

Steps to replicate it:

1. Just open Administration → Overview → Wait a bit longer that usual.

The output of your Nextcloud log in **Admin \> Logging** :

```auto
Nothing relevant.

```

The output of your config.php file in `/path/to/nextcloud` (make sure you remove any identifiable information!):

```auto
<?php
$CONFIG = array (
  'passwordsalt' => 'some_salt',
  'secret' => 'some_secret',
  'trusted_domains' => 
  array (
    0 => 'my.domain',
  ),
  'datadirectory' => '/data',
  'dbtype' => 'mysql',
  'version' => '29.0.5.1',
  'overwrite.cli.url' => 'https://my.domain',
  'dbname' => 'nextcloud',
  'dbhost' => '127.0.0.1',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'my_admin',
  'dbpassword' => 'my_password',
  'installed' => true,
  'instanceid' => 'my_instance_id',
  'default_phone_region' => 'BE',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'redis' => 
  array (
    'host' => '/var/run/redis/redis.sock',
    'port' => '0',
  ),
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'maintenance' => false,
  'theme' => '',
  'loglevel' => 2,
  'maintenance_window_start' => 2,
  'updater.release.channel' => 'beta',
);

```

The output of your Apache/nginx/system log in `/var/log/ ____ `:

```auto
No relevant errors on error.log.

```

Output errors in nextcloud.log in /var/www/ or as admin user in top right menu, filtering for errors. Use a pastebin service if necessary.

```auto
Nothing relevant.

```

---

<div class="post-metadata">

**Author:** ![jtr](https://help.nextcloud.com/letter_avatar/jtr/32/6_22734026db12803ebb3e059622ac3534.png) [@jtr](https://help.nextcloud.com/u/jtr)\
**Post date:** [August 26, 2024, 5:02pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/2 "2024-08-26T17:02:58Z")

</div>

See the _Critical Changes_ section of the release notes for 28/29 for likely culprits and solutions related to setup checks: [Upgrade to Nextcloud 28 — Nextcloud latest Administration Manual latest documentation](https://docs.nextcloud.com/server/latest/admin_manual/release_notes/upgrade_to_28.html#setup-checks)

---

<div class="post-metadata">

**Author:** ![John5](https://help.nextcloud.com/letter_avatar/john5/32/6_22734026db12803ebb3e059622ac3534.png) [@John5](https://help.nextcloud.com/u/John5)\
**Post date:** [August 28, 2024, 7:21pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/3 "2024-08-28T19:21:54Z")

</div>

@jtr thanks for your reply. based on this notes I discovered that my nextcloud instance is not able to wget or curl its own domain. But it always worked without that, so now we need to loosen the security of our instance opening firewall rules to have security checks? It sounds a bit bad…

---

<div class="post-metadata">

**Author:** ![SQLSlacker](https://help.nextcloud.com/user_avatar/help.nextcloud.com/sqlslacker/32/55058_2.png) [@SQLSlacker](https://help.nextcloud.com/u/SQLSlacker)\
**Post date:** [September 13, 2024, 12:09am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/4 "2024-09-13T00:09:51Z")

</div>

Upgraded to 29.0.7 , my nextcloud is in a subdirectory, I’m getting some of the warnings above. This one in particular:  
Could not check that your web server serves security headers correctly, unable to query `/nextcloud/index.php/heartbeat`

Tried this on the server: `curl -I https://www.mynextcloudsite.com/nextcloud/index.php/heartbeat`  
And it returns: HTTP/2 200

So what’s going on here?

---

<div class="post-metadata">

**Author:** ![nrbell](https://help.nextcloud.com/letter_avatar/nrbell/32/6_22734026db12803ebb3e059622ac3534.png) [@nrbell](https://help.nextcloud.com/u/nrbell)\
**Post date:** [September 13, 2024, 1:55am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/5 "2024-09-13T01:55:45Z")

</div>

I’m having the same problem. It looks to me like the test code is somehow not taking the subdirectory installation into account. When requesting the heartbeat file, for instance, it is requesting /nextcloud/nextcloud/heartbeat instead of /nextcloud/heartbeat. When I use curl to request it, it works fine.

Here is an example from the logs of a request from the test system and a manual request:

```auto
access.log:xxx.xxx.xxx.xxx - - [12/Sep/2024:20:36:21 -0500] "GET /nextcloud/nextcloud/heartbeat HTTP/1.1" 404 10388 "-" "Nextcloud Server Crawler"

access.log:xxx.xxx.xxx.xxx - - [12/Sep/2024:20:53:51 -0500] "GET /nextcloud/heartbeat HTTP/1.1" 200 5101 "-" "curl/7.81.0"

```

---

<div class="post-metadata">

**Author:** ![MikeB](https://help.nextcloud.com/letter_avatar/mikeb/32/6_22734026db12803ebb3e059622ac3534.png) [@MikeB](https://help.nextcloud.com/u/MikeB)\
**Post date:** [September 13, 2024, 5:27am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/6 "2024-09-13T05:27:05Z")

</div>

I’m having the same issue. I also have NC configured as ‘my.domain/nextcloud’. I’m assuming there is a change in 29.0.7 (I either had 29.0.5 or .6 before updating with no issue) that fails to check on configurations with NC in a subdirectory of the domain. Although, I’d also think that this type of configuration would be checked before a release.

---

<div class="post-metadata">

**Author:** ![Shiva](https://help.nextcloud.com/letter_avatar/shiva/32/6_22734026db12803ebb3e059622ac3534.png) [@Shiva](https://help.nextcloud.com/u/Shiva)\
**Post date:** [September 13, 2024, 10:48am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/7 "2024-09-13T10:48:13Z")

</div>

Same issue here:  
nextcloud in subfolder on ubuntu-Apache, same list of warnings after update.  
Curling curl -I [https://www.domain.tld/subfolder/apps/settings/js/map-test.js.map](https://www.domain.tld/subfolder/apps/settings/js/map-test.js.map) returns 200

I also think this has to be related to the login-grant access webflow suddenly stopping to work: I can log and grant access to android nextcloud client app and any android app relying on it for access.  
For any other, the flow fails, whether I use App passwords or login form.  
[I have checked these settings](https://help.nextcloud.com/t/solved-client-wont-connect-to-server-usual-fix-didnt-work/110038)

---

<div class="post-metadata">

**Author:** ![marcoelgordo](https://help.nextcloud.com/user_avatar/help.nextcloud.com/marcoelgordo/32/64776_2.png) [@marcoelgordo](https://help.nextcloud.com/u/marcoelgordo)\
**Post date:** [September 13, 2024, 10:53am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/8 "2024-09-13T10:53:47Z")

</div>

My Server had no issues or error messages before the update this morning. Since 29.0.6 I have many errors. And not a clue as to how to resolve them

---

<div class="post-metadata">

**Author:** ![Shiva](https://help.nextcloud.com/letter_avatar/shiva/32/6_22734026db12803ebb3e059622ac3534.png) [@Shiva](https://help.nextcloud.com/u/Shiva)\
**Post date:** [September 13, 2024, 11:10am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/9 "2024-09-13T11:10:45Z")

</div>

Have to point out that it does indeed look like false positives.  
Before updating to 29.0.7 I had the false positive '.well-known’warning although config was checked and correct.  
Now this whole new bunch, when config is checked again, and curling myself succeeds …

I do think there’s something with having _nextcloud in a subfolder_, and am hoping the concomittent failure of access granting in webflows might point the way to what’s actually broken?

---

<div class="post-metadata">

**Author:** ![2600box](https://help.nextcloud.com/user_avatar/help.nextcloud.com/2600box/32/45999_2.png) [@2600box](https://help.nextcloud.com/u/2600box)\
**Post date:** [September 14, 2024, 8:41am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/10 "2024-09-14T08:41:27Z")

</div>

I spent a lot of time trying to resolve these before realising they are false positives and coming to this thread. Will be following closely for advice.

---

<div class="post-metadata">

**Author:** ![Baggypants](https://help.nextcloud.com/letter_avatar/baggypants/32/6_22734026db12803ebb3e059622ac3534.png) [@Baggypants](https://help.nextcloud.com/u/Baggypants)\
**Post date:** [September 17, 2024, 8:24am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/11 "2024-09-17T08:24:49Z")

</div>

Also seeing the same with things like:

```auto
179d095bf57a <proxy_ip> - - [17/Sep/2024:08:11:02 +0000] "HEAD /nextcloud/nextcloud/apps/settings/js/esm-test.mjs HTTP/1.1" 404 0 "-" "-" 119350
179d095bf57a <proxy_ip> - - [17/Sep/2024:08:11:03 +0000] "GET /nextcloud/nextcloud/index.php/heartbeat HTTP/1.1" 404 5115 "-" "-" 119357

```

---

<div class="post-metadata">

**Author:** ![Baggypants](https://help.nextcloud.com/letter_avatar/baggypants/32/6_22734026db12803ebb3e059622ac3534.png) [@Baggypants](https://help.nextcloud.com/u/Baggypants)\
**Post date:** [September 17, 2024, 11:41am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/12 "2024-09-17T11:41:15Z")

</div>

looks like the fix will come with 29.0.8 / 30.0.0.1

> <https://github.com/nextcloud/server/issues/47950>
>
> \### ⚠️ This issue respects the following points: ⚠️
> 
> \- \[X\] This is a \*\*bug\*\*, …not a question or a configuration/webserver/proxy issue.
> \- \[X\] This issue is \*\*not\*\* already reported on \[Github\](https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3Abug) OR \[Nextcloud Community Forum\](https://help.nextcloud.com/) \_(I've searched it)\_.
> \- \[X\] Nextcloud Server \*\*is\*\* up to date. See \[Maintenance and Release Schedule\](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions.
> \- \[X\] I agree to follow Nextcloud's \[Code of Conduct\](https://nextcloud.com/contribute/code-of-conduct/).
> 
> \### Bug description
> 
> Not withstanding https://docs.nextcloud.com/server/latest/admin\_manual/release\_notes/upgrade\_to\_28.html#setup-checks, Nextcloud Hub 8 (29.0.7) is ignoring \`overwrite.cli.url\` being defined as a subdirectory when doing system and security checks. I receive the following errors because my installation is in a subdirectory (e.g., nextcloud.mydomain.com/nextcloud\_dir):
> 
> \`\`\`
> There are some warnings regarding your setup.
> 
> Your webserver is not set up to serve \`.js.map\` files. Without these files, JavaScript Source Maps won't function properly, making it more challenging to troubleshoot and debug any issues that may arise.
> Could not check for JavaScript support via any of your \`trusted\_domains\` nor \`overwrite.cli.url\`. This may be the result of a server-side DNS mismatch or outbound firewall rule. Please check manually if your webserver serves \`.mjs\` files using the JavaScript MIME type. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its \`trusted\_domains\` or the \`overwrite.cli.url\`.
> 5 errors in the logs since September 6, 2024, 2:40:39 PM
> Could not check that your web server serves security headers correctly, unable to query \`/nextcloud\_dir/index.php/heartbeat\` For more details see the documentation ↗.
> 
> \`check\_for\_working\_wellknown\_setup\` is set to false in your configuration, so this check was skipped.
> Could not check for WOFF2 loading support. Please check manually if your webserver serves \`.woff2\` files. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its \`trusted\_domains\` or the \`overwrite.cli.url\`. For more details see the documentation.
> \`\`\`
> 
> See also many help requests at https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/6.
> 
> UPDATE: I should clarify the root directory properly returns a 403 as intended:
> 
> \`\`\`
> root@my\_ip ~ $ curl -H 'Cache-Control: no-cache, no-store' nextcloud.mydomain.com/      
> \<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"\>
> \<html\>\<head\>
> \<title\>403 Forbidden\</title\>
> \</head\>\<body\>
> \<h1\>Forbidden\</h1\>
> \<p\>You don't have permission to access this resource.\</p\>
> \</body\>\</html\>
> root@my\_ip ~ $ curl -H 'Cache-Control: no-cache, no-store' nextcloud.mydomain.com/nextcloud\_dir
> \<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"\>
> \<html\>\<head\>
> \<title\>301 Moved Permanently\</title\>
> \</head\>\<body\>
> \<h1\>Moved Permanently\</h1\>
> \<p\>The document has moved \<a href="http://nextcloud.mydomain.com/nextcloud\_dir/"\>here\</a\>.\</p\>
> \</body\>\</html\>
> root@my\_ip ~ $ curl -H 'Cache-Control: no-cache, no-store' nextcloud.mydomain.com/nextcloud\_dir/
> \`\`\`
> 
> UPDATE 2: I should also mention that updating /etc/hosts (per https://github.com/nextcloud/server/issues/44114#issuecomment-2110820538) to include:
> 
> \`127.0.0.1 nextcloud.mydomain.com\`
> 
> ...responds with "It works" content but does not resolve the Nextcloud errors.
> 
> \`\`\`
> curl -H 'Cache-Control: no-cache, no-store' nextcloud.mydomain.com
> 
> \<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"\>
> \<html xmlns="http://www.w3.org/1999/xhtml"\>
> \<head\>
> \<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /\>
> \<title\>Apache2 Debian Default Page: It works\</title\>
> \<style type="text/css" media="screen"\>
> \`\`\`
> 
> \### Steps to reproduce
> 
> 1. Setup Nextcloud within subdirectory
> 2. Upgrade to 29.0.7
> 3. Check for system and security issues (https://nextcloud.mydomain.com/nextcloud\_dir/index.php/settings/admin/overview)
> 
> \### Expected behavior
> 
> When checking for system and security issues (https://nextcloud.mydomain.com/nextcloud\_dir/index.php/settings/admin/overview), Nextcloud should use/take into account that \`overwrite.cli.url\` is defined as a subdirectory.
> 
> \### Nextcloud Server version
> 
> 29
> 
> \### Operating system
> 
> Debian/Ubuntu
> 
> \### PHP engine version
> 
> PHP 8.3
> 
> \### Web server
> 
> Apache (supported)
> 
> \### Database engine version
> 
> MySQL
> 
> \### Is this bug present after an update or on a fresh install?
> 
> Updated from a MINOR version (ex. 28.0.1 to 28.0.2)
> 
> \### Are you using the Nextcloud Server Encryption module?
> 
> None
> 
> \### What user-backends are you using?
> 
> \- \[\] Default user-backend \_(database)\_
> \- \[\] LDAP/ Active Directory
> \- \[\] SSO - SAML
> \- \[\] Other
> 
> \### Configuration report
> 
> \_No response\_
> 
> \### List of activated Apps
> 
> \_No response\_
> 
> \### Nextcloud Signing status
> 
> \_No response\_
> 
> \### Nextcloud Logs
> 
> \_No response\_
> 
> \### Additional info
> 
> \_No response\_

---

<div class="post-metadata">

**Author:** ![John5](https://help.nextcloud.com/letter_avatar/john5/32/6_22734026db12803ebb3e059622ac3534.png) [@John5](https://help.nextcloud.com/u/John5)\
**Post date:** [September 17, 2024, 6:51pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/13 "2024-09-17T18:51:54Z")

</div>

As a user, admin and developer I really value their effort but even with this fix the amount of warnings is not user friendly.

Actually there should be a pre-check if the domain is reachable instead of creating many `could not check` errors and make just one error to fix the connectivity first.

Also the documentation [Upgrade to Nextcloud 28 — Nextcloud latest Administration Manual latest documentation](https://docs.nextcloud.com/server/latest/admin_manual/release_notes/upgrade_to_28.html#setup-checks) could have more details on the point

- verifying that the Server can reach its own URL(s)

This can be an issue with the container/VM network or internal firewall or even some external firewall denying or dropping the request.

---

<div class="post-metadata">

**Author:** ![ant0n](https://help.nextcloud.com/letter_avatar/ant0n/32/6_22734026db12803ebb3e059622ac3534.png) [@ant0n](https://help.nextcloud.com/u/ant0n)\
**Post date:** [September 20, 2024, 3:05am UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/14 "2024-09-20T03:05:19Z")

</div>

I am looking forward to install 29.0.8 and as the overview check seems not to work at all at the moment.  
Nextcloud is up and running.  
Wish there would be an overview after testing with only 1 warning that says how many log errors there are since day month.

When this bug is fixed, could someone please post a working apache httpd.conf on nextcloud server and a working vhost.conf on reverse proxy and a working config.php on config directory? Would be awesome to see these three files of someone else who is running without nginx but only apache and is behind a reverse proxy.  
i do not run docker btw 🙂 maybe it is kind of outdated to run without docker? what would you say?

---

<div class="post-metadata">

**Author:** ![John5](https://help.nextcloud.com/letter_avatar/john5/32/6_22734026db12803ebb3e059622ac3534.png) [@John5](https://help.nextcloud.com/u/John5)\
**Post date:** [September 24, 2024, 5:21pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/15 "2024-09-24T17:21:05Z")

</div>

I saw there is an issue now [https://github.com/nextcloud/server/issues/48150](https://github.com/nextcloud/server/issues/48150) to even make it less polluted in case some configuration is wrong show just what is wrong instead of many warnings. If you have Github please thumbs up for it.

---

<div class="post-metadata">

**Author:** ![TwidgetITGuy](https://help.nextcloud.com/letter_avatar/twidgetitguy/32/6_22734026db12803ebb3e059622ac3534.png) [@TwidgetITGuy](https://help.nextcloud.com/u/TwidgetITGuy)\
**Post date:** [October 4, 2024, 2:09pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/16 "2024-10-04T14:09:25Z")

</div>

I’d been having the exact same issue for several months myself, it’s like the OP pulled his list from my installation! I never devoted much time to troubleshooting the issue, as everything appeared to work correctly, and the few times I did attempt, I was looking within my NC installation itself… until I saw this:

> [@John5](#):
>
> Also the documentation [Upgrade to Nextcloud 28 — Nextcloud latest Administration Manual latest documentation](https://docs.nextcloud.com/server/latest/admin_manual/release_notes/upgrade_to_28.html#setup-checks) could have more details on the point
> 
> - verifying that the Server can reach its own URL(s)
> 
> This can be an issue with the container/VM network or internal firewall or even some external firewall denying or dropping the request.

I am running NC on a Proxmox LXC, reversed proxied as [https://nextcloud.redacted.invalid](https://nextcloud.redacted.invalid), with an OPNSense firewall running Unbound DNS. When I pinged the URL, it came back to my _internal_ IP, not my _external_ IP. My Unbound DNS override was OK (using _nc_ for the hostname, not _nextcloud_), but my _/etc/hosts_, _/etc/hostname_, and _Proxmox LXC DNS_ was _not_ OK; it was set to _nextcloud_, causing it to resolve to the _internal IP_, and thus failing all those checks. Changing the hostname from _nextcloud_ to _nc_ fixed **ALL** those errors, and I got that beautiful green checkmark once more.

It’s always DNS! 🤣

---

<div class="post-metadata">

**Author:** ![JimmyKater](https://help.nextcloud.com/user_avatar/help.nextcloud.com/jimmykater/32/4850_2.png) [@JimmyKater](https://help.nextcloud.com/u/JimmyKater)\
**Post date:** [October 4, 2024, 2:12pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/17 "2024-10-04T14:12:49Z")

</div>

I’ve had to fight a similar problem those last days… my external requests to my server from my own network failed with reaching my routerlogin-page.

I needed to disenable the (un)bind-setting within my own router for my server-URL to get trough to my server. at the same time all errormessages of the server were gone as well.

So perhaps that might be a little hint and help for someone.

---

<div class="post-metadata">

**Author:** ![John5](https://help.nextcloud.com/letter_avatar/john5/32/6_22734026db12803ebb3e059622ac3534.png) [@John5](https://help.nextcloud.com/u/John5)\
**Post date:** [October 6, 2024, 12:53pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/18 "2024-10-06T12:53:04Z")

</div>

It got even worst for me… I updated to **29.0.7** and now a started having a red error:  
Your web server is not yet properly set up to allow file synchronization, because the WebDAV interface seems to be broken. To allow this check to run you have to make sure that your webserver can connect to itself. Therefor it must be able to resolve and connect to at least one its `trusted_domains` or the `overwrite.cli.url`.

I checked on config and my `trusted_domains` and `overwrite.cli.url` correctly have my domains, also my server can correctly resolve my domain name with the correct IP. Maybe someone from NC team could help us.

---

<div class="post-metadata">

**Author:** ![JimmyKater](https://help.nextcloud.com/user_avatar/help.nextcloud.com/jimmykater/32/4850_2.png) [@JimmyKater](https://help.nextcloud.com/u/JimmyKater)\
**Post date:** [October 8, 2024, 1:08pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/19 "2024-10-08T13:08:03Z")

</div>

try rebooting your machine… where is it hosted? at home?

---

<div class="post-metadata">

**Author:** ![John5](https://help.nextcloud.com/letter_avatar/john5/32/6_22734026db12803ebb3e059622ac3534.png) [@John5](https://help.nextcloud.com/u/John5)\
**Post date:** [October 8, 2024, 5:00pm UTC](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840/20 "2024-10-08T17:00:52Z")

</div>

Yes, it is hosted at home. I rebooted and tried configurations many times. DNS works perfect resolved to my external IP. I just discovered that somehow it complains about my SSL certificate being self-signed when I curl from my NC VM, but when I do it from the internet or even on the browser, it works perfect with a valid certificate. I have no idea how could that happen.

[Next page](https://help.nextcloud.com/t/many-could-not-check-on-security-and-setup-warnings/201840.md?page=2)