Set up automatic redirection from HTTP to HTTPS, and HTTPS version doesn't work on the intranet

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 20.0.5): 20.0.7
Operating system and version (eg, Ubuntu 20.04): Debian 10
Apache or nginx version (eg, Apache 2.4.25): 2.4.38 (Debian)
PHP version (eg, 7.4): 7.3.19-1~deb10u1

The issue you are facing: Trying to set up redirection from HTTP to HTTPS but it’s not working. HTTPS also don’t work if I use a local computer.

Is this the first time you’ve seen this error? (Y/N): Y

Steps to replicate it:

  1. Go to ht-tp://192.168.0.17 using a computer on the same subnet
  2. It loads Nextcloud via HTTP
  3. Go to ht-tps://192.168.0.17
  4. It fails with the error:
    Secure Connection Failed

    An error occurred during a connection to 192.168.0.17. SSL received a record that exceeded the maximum permissible length.

    Error code: SSL_ERROR_RX_RECORD_TOO_LONG

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem. 

I have also opened up Nextcloud to the Internet using port 8888 on the domain nextcloud .domain.org.uk

  1. Go to ht-tp://nextcloud.domain.org.uk using my mobile phone via 4G
  2. It loads Nextcloud via HTTP
  3. Go to ht-tps://nextcloud.domain.org.uk
  4. I get an error about an untrusted certificate
  5. I click on “Accept risk and continue”
  6. I can get Nextcloud via HTTPS successfully.

I put Nextcloud on 8888 as we will need to use Apache2 for other websites on port 80 & 443. I’m sure I’m missing some obvious things! Note that I’ve put an “-” in the URLs as the forum is blocking me from making more than 4 links even though I didn’t want it to… I don’t know how to disable automatic hyperlinking.

Any help would be gratefully received.

The output of your Nextcloud log in Admin > Logging:

Nothing relevant

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php
$CONFIG = array (
  'instanceid' => 'secret',
  'passwordsalt' => 'secret',
  'secret' => 'secret',
  'trusted_domains' =>
  array (
    0 => 'nextcloud.domain.org.uk',
    1 => '192.168.0.17',
  ),
  0 =>
  array (
    0 => '192.168.0.17',
  ),
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'datadirectory' => '/var/www/html/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '20.0.7.1',
  'overwrite.cli.url' => 'http://192.168.0.17/nextcloud',
  'dbname' => 'nextcloud',
  'dbhost' => 'localhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'nextcloud',
  'dbpassword' => 'secret',
  'installed' => true,
  'mail_from_address' => 'secret',
  'mail_smtpmode' => 'smtp',
  'mail_sendmailmode' => 'smtp',
  'mail_domain' => 'domain.org.uk',
  'mail_smtpsecure' => 'tls',
  'mail_smtpauth' => 1,
  'mail_smtphost' => 'secret',
  'mail_smtpname' => 'secret',
  'mail_smtppassword' => 'secret',
  'mail_smtpport' => '587',
  'mail_smtpauthtype' => 'LOGIN',
  'twofactor_enforced' => 'true',
  'twofactor_enforced_groups' =>
  array (
  ),
  'twofactor_enforced_excluded_groups' =>
  array (
  ),
  'maintenance' => false,
  'updater.secret' => 'secret',
  'theme' => '',
  'loglevel' => 2,
);

The output of your Apache/nginx/system log in /var/log/____:
The only contents in apache2’s error.log - time is 13 hours in the past.

[Thu Feb 11 00:00:50.903084 2021] [ssl:warn] [pid 9628] AH01909: nextcloud.domain.org.uk:443:0 server certificate does NOT include an ID which matches the server name
[Thu Feb 11 00:00:50.903346 2021] [mpm_prefork:notice] [pid 9628] AH00163: Apache/2.4.38 (Debian) OpenSSL/1.1.1d configured -- resuming normal operations
[Thu Feb 11 00:00:50.903351 2021] [core:notice] [pid 9628] AH00094: Command line: '/usr/sbin/apache2'

Nothing relevant in apache2 access, daemon or system logs.

Here is apache’s configuration for Nextcloud in “nextcloud.conf” within “sites-available” folder - note, I took out the redirection as it didn’t work and caused an error:

Listen 8888
<VirtualHost *:8888>
        ServerName nextcloud.domain.org.uk

    <IfModule mod_headers.c>
      Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
    </IfModule>

        ServerAdmin secret
        DocumentRoot /var/www/html/nextcloud
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        SSLEngine on

        SSLCertificateFile      /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>

        Alias /nextcloud "/var/www/html/nextcloud/"

        <Directory /var/www/html/nextcloud/>
          Require all granted
          AllowOverride All
          Options FollowSymLinks MultiViews

        SSLOptions +StdEnvVars

          <IfModule mod_dav.c>
            Dav off
          </IfModule>

        </Directory>

</VirtualHost>

<VirtualHost 192.168.0.17>
        DocumentRoot "/var/www/html/nextcloud"
        ServerName nextcloud.domain.org.uk
        ServerAlias nextcloud
</VirtualHost>

Within ports.conf:

Listen 80

<IfModule ssl_module>
        Listen 443
</IfModule>

<IfModule mod_gnutls.c>
        Listen 443
</IfModule>

<IfModule mod_gnutls.c>
        Listen 8888
</IfModule>
```This text will be hidden

Hello,
first, in your apache config file, you doesn’t seems to have redirection configured thus, it won’t redirect http -> https
https://httpd.apache.org/docs/2.4/en/rewrite/remapping.html
second, some clues here: https://www.thesslstore.com/blog/ssl_error_rx_record_too_long/
You should disable TLS prior version: 1.2 and ssl3.0 and fix the cipher list.
Also you should use port 443 for https.

Edit: i changed the first link (initially for nginx instead of apache)

you know that you can run multiple virtual web server on the same ip adress all on the same port? just using different fqdns pointing to it. so there is no need to use different ports.