RequestException: cURL error 60: SSL: no alternative certificate subject name matches target hostname 'github.com'

Hi Nextcloud-Community,

i’m facing a problem for few weeks, which i cant figure out what the problem is:

i cant update apps anymore because i receive the following error (excample):

RequestException
cURL error 60: SSL: no alternative certificate subject name matches target hostname ‘github.com’ (see libcurl - Error Codes) for https://github.com/nextcloud-releases/external/releases/download/v5.5.2/external-v5.5.2.tar.gz

i get this for every single app that has an update available, but it is so weird, because i can do anything else related to github.com without problems. i could only observe the problem with nextcloud and any help i could find in the internet that are similar to this problem couldnt solve it at all. Does anyone have a idea how the problem can be solved?

I’m running on nextcloud 30.0.1, php 8.2, debian bookworm, with nginx 1.26.0, lets encrpyt certificate.

Best Regards,
Blubbsy

If you download the file from that host with wget, do you receive the same error?

running curl -v https://github.com/.. from the server would likely provide more details and show the problem…

thats the problem, i dont receive this error:

same for curl -v, it works there. i just dont get what the problem is i cant reproduce the problem properly. I tried both commands already in the past and i’m using the same user as the one executing php-fpm.

since i couldnt find a solution i switched to Nextcloud AIO. Absolutely no idea why only nextcloud app update has this problem and nothing has it.

But well, via docker should work too for me…

currently I have the same problem.

Before this error I found the following problem in the log file:

OCA\Settings\Controller\AppSettingsController::getAppDiscoverMedia(): Argument #1 ($fileName) must be of type string, null given, called in /usr/local/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php on line 208 in file '/usr/local/www/nextcloud/apps/settings/lib/Controller/AppSettingsController.php' line 130

any idea where the problem is?

I had the same issue (could not update any app because of certificate issue, curl in the same environment as nextcloud working fine though). By running strace -ft php occ app:update polls, I figured that:

  • It tries to resolve an IPv6 for github.com
  • It fails, as GitHub does not support IPv6
  • It tries to resolve an IPv6 for github.com.<mydomain.tld>. I suppose it is because I have search <mydomain.tld> in my /etc/resolv.conf
  • It resolves to my own server, since I have configured *.<mydomain.tld> to resolve to one of my servers
  • My server answers on HTTPS, but obviously not with a github.com certificate, causing the error
  • It doesn’t try to resolve an IPv4 for github.com (which would work)

So I suppose this issues occurs when github.com.<mydomain.tld> resolves to a working server (but not GitHub’s), where mydomain.tld is in the search domain list of your DNS resolving configuration?

Maybe the root cause is that Nextcloud (or whatever it’s trying) tries: IPv6, IPv6 with search list, IPv4, IPv4 with search list, when probably it should be IPv6, IPv4, IPv6 with search list, IPv4 with search list.

I worked around this by setting allow_local_remote_servers to true in the Nextcloud config (found the option by exploring code around the stack trace). I have no idea why it works. Given that from the name (since there’s no documentation about it) I would expect it to work when it’s set to false.

Maybe another work around would be to changing the search list (if possible). Or disabling IPv6. Please don’t though, if GitHub supported IPv6 it wouldn’t be an issue. Maybe AOI doesn’t and that’s why it now works for @blubbsy ?

Let me know if that was it (or could have been) for you. If so we could make an issue.

1 Like

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.