Nextcloud Client does not find certifcate of the issuer

📱 Desktop & mobile clients
, , ,
1

The creation of my account on nextcloud desktop client (Nextcloud-3.10.2-x64) on my main Windows PC fails. I hope I can solve this because it is a massive problem in the core of Nextcloud benefit.
Message1b

Problem occurs on a single private Windows 10 PC only.
Two other windows 10 computer (Laptop and Company PC ) work fine. Their clients find the certificate, accept it and synchronize correctly.
I use DynDNS and letsencrypt certificate. My synology NAS with current DSM 7.2 runs a Nextcloud AIO v7.6.2 on docker. I use the Synology NAS as a reverse reverse proxy.

The letsencrypt certicate is for my 2 subdomains. (X509v3 Subject Alternative Name) Internal name (common name) is subdomain 1 and Nextcloud uses alternative name subdomain 2.

I tested a lot, including complete deinstallation of nextcloud client – because new clients on other computers worked. I could find that the problem exists for a second user on the same computer in the same way , while this user user also has a successful synchronization on the laptop. Hence the Windows 10 (22H2) on THIS PC has a problem.
Nextcloud log says: (removed real domain. It contains my personal name.)
2023-12-10 18:50:52:446 [ info nextcloud.sync.account C:\Users\User\AppData\Local\Temp\windows-19146\client-building\desktop\src\libsync\account.cpp:541 ]: ssl errors “SSL-Errors happened for url "https://sub2.mydomain.de/status.php\” \tError in QSslCertificate("", "", "1BAC58AsgTpgAmY7PhCfg==", "", "", QMap(), QDateTime(Invalid), QDateTime(Invalid)) : "Das Zertifikat des Ausstellers konnte nicht gefunden werden" ( "Das Zertifikat des Ausstellers konnte nicht gefunden werden" ) \n "
The next line mentions “ISRG Root X1”, “R3” from letsencrypt. The issuer is ISRG Root X1. Hence, my current guess is that the certifcate store (certlm) could have a problem with letsencrypt certificates. At least they are listed:

Certifictes
Certifictes826×77 4.55 KB

From SSL Server Test (Powered by Qualys SSL Labs) I got an overal A+ rating for the cerificate and the browsers and the Synology Drive client do not have a problem on the PC. They work fine.
My current workaround is of type ‚brute force‘: I mapped the nextcloud folder on my laptop in the living on the PC and open the files there. Then this laptop syncs to Nextcloud. Up and then when the laptop hibernates I’m screwed. This scenario is not reiliable.
Any ideas how I can get the nextcloud client running? It concerns my main PC. Therefore it is a main issue.

2

I don’t recall the specifics but it’s likely related to this and some weird bits about the certificate manager state on that device.

A couple things I recall about this:

2 Likes
3

Hello
Sorry for the late response. I was too busy due to the additional effort with the issue.
The hint concerning valid-isrgrootx1.letsencrypt.org was a huge step forward. However my experience was ambigous: When I had opened the URL I could create the account and the first synchonization started. However, after I had restarted the computer the ugly message popped up again and the connection was not possible again.
In MS edge I downloaded the certificate and got a file ‘valid-isrgrootx1.letsencrypt.org.crt’ I did the same with my domain and got the related crt file too.
Then I opened the certificate manager of Windows 10 ‘certmgr’ and imported the files into the folder for trusted root certificates. That solved the issue completely and the synchonization works fine now.
Of course I cannot say whether the crt file of isrgrootx1.letsencrypt.org was the solution or the file of my own domain - anyway it is solved!!
Thanks a lot for the hint.

1 Like