[Solved] Nextcloud 21.0.3 internet check not using resources/config/ca-bundle.crt

Support intro

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 20.0.5): 21.0.3
Operating system and version (eg, Ubuntu 20.04): CentOS 8.4.2105
Apache or nginx version (eg, Apache 2.4.25): httpd-2.4.37-39.module_el8.4.0+778+c970deab.x86_64
PHP version (eg, 7.4): 7.4.21

The issue you are facing:
After upgrading from 20.0.11 to 21.0.3, nextcloud internet check is no longer able to reach internet. My Nextcloud is behind a transparent Proxy (OpnSense + Squid) and the CA file of the proxy is appended to resources/config/ca-bundle.crt as in previous versions.

Yet , now I receive the following error and the Settings → Overview → Security & Setup Warnings fails with " * Error occurred while checking server setup"

nextcloud log shows:

{"reqId":"YQWUIkQMwgVxHz62WFNOHQAAAAY","level":3,"time":"2021-07-31T18:19:45+00:00","remoteAddr":"192.168.1.98","user":"snikolov","app":"internet_connection_check","method":"GET","url":"/index.php/settings/ajax/checksetup","message":{"Exception":"GuzzleHttp\\Exception\\ConnectException","Message":"cURL error 28: Connection timed out after 30000 milliseconds (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for http://www.nextcloud.com/","Code":0,"Trace":[{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php","line":158,"function":"createRejection","class":"GuzzleHttp\\Handler\\CurlFactory","type":"::"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php","line":110,"function":"finishError","class":"GuzzleHttp\\Handler\\CurlFactory","type":"::"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlHandler.php","line":47,"function":"finish","class":"GuzzleHttp\\Handler\\CurlFactory","type":"::"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php","line":28,"function":"__invoke","class":"GuzzleHttp\\Handler\\CurlHandler","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php","line":48,"function":"GuzzleHttp\\Handler\\{closure}","class":"GuzzleHttp\\Handler\\Proxy","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php","line":35,"function":"GuzzleHttp\\Handler\\{closure}","class":"GuzzleHttp\\Handler\\Proxy","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":31,"function":"__invoke","class":"GuzzleHttp\\PrepareBodyMiddleware","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php","line":71,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":63,"function":"__invoke","class":"GuzzleHttp\\RedirectMiddleware","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/HandlerStack.php","line":75,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php","line":331,"function":"__invoke","class":"GuzzleHttp\\HandlerStack","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php","line":168,"function":"transfer","class":"GuzzleHttp\\Client","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php","line":187,"function":"requestAsync","class":"GuzzleHttp\\Client","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Http/Client/Client.php","line":236,"function":"request","class":"GuzzleHttp\\Client","type":"->"},{"file":"/var/www/html/nextcloud/apps/settings/lib/Controller/CheckSetupController.php","line":178,"function":"get","class":"OC\\Http\\Client\\Client","type":"->"},{"file":"/var/www/html/nextcloud/apps/settings/lib/Controller/CheckSetupController.php","line":161,"function":"isSiteReachable","class":"OCA\\Settings\\Controller\\CheckSetupController","type":"->"},{"file":"/var/www/html/nextcloud/apps/settings/lib/Controller/CheckSetupController.php","line":734,"function":"hasInternetConnectivityProblems","class":"OCA\\Settings\\Controller\\CheckSetupController","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":218,"function":"check","class":"OCA\\Settings\\Controller\\CheckSetupController","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":127,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/AppFramework/App.php","line":157,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/html/nextcloud/lib/private/Route/Router.php","line":302,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/html/nextcloud/lib/base.php","line":993,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/html/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/html/nextcloud/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php","Line":210,"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36","version":"21.0.3.1"}

Is this the first time you’ve seen this error? (Y/N): Y

Steps to replicate it:

  1. Put the nextcloud behind transparent (http + https ) proxy
  2. Add the Proxy CA file to resources/config/ca-bundle.crt
  3. Generate a symlink that points to the CA file in the OS similar to this one:
[root@nextcloud nextcloud]# ls -l /var/www/html/865038e4.0 
lrwxrwxrwx. 1 root root 49 27 окт  2020 /var/www/html/865038e4.0 -> /etc/pki/ca-trust/source/anchors/OPNsense-SSL.crt
  1. Add the following in the php.ini
[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
curl.cainfo=/var/www/html/865038e4.0
  1. systemctl restart httpd php-fpm

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

[root@nextcloud config]# cat config.php 
<?php
$CONFIG = array (
  'instanceid' => 'ocq5fxs7yuzz',
  'passwordsalt' => 'REDACTED',
  'secret' => 'REDACTED',
  'trusted_domains' => 
  array (
    0 => 'nextcloud.localdomain',
    1 => 'REDACTED',
  ),
  'datadirectory' => '/var/www/html/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '21.0.3.1',
  'overwrite.cli.url' => 'http://nextcloud.localdomain',
  'dbname' => 'nextcloud',
  'dbhost' => 'localhost:/var/lib/mysql/mysql.sock',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'REDACTED',
  'dbpassword' => 'REDACTED',
  'installed' => true,
  'filelocking.enabled' => true,
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'memcache.local' => '\\OC\\Memcache\\Redis',
  'redis' => 
  array (
    'host' => 'localhost',
    'port' => 6379,
    'timeout' => 1.5,
  ),
  'mail_smtpmode' => 'smtp',
  'mail_smtpsecure' => 'tls',
  'mail_sendmailmode' => 'smtp',
  'mail_from_address' => 'REDACTED',
  'mail_domain' => 'gmail.com',
  'mail_smtpauthtype' => 'LOGIN',
  'mail_smtpauth' => 1,
  'mail_smtphost' => 'smtp.gmail.com',
  'mail_smtpport' => '587',
  'mail_smtpname' => 'REDACTED',
  'mail_smtppassword' => 'REDACTED',
  'maintenance' => false,
  'theme' => '',
  'loglevel' => 1,
  'default_phone_region' => 'BG',
);

What is the difference between v20 and v21 ?

I remmber that after the update I had to replace

memcache.local' => '\\OC\\Memcache\\APCu',

with

'memcache.local' => '\\OC\\Memcache\\Redis',

Yet, I didn’t detect any issues at that time.

Modifying the firewall to bypass the proxy for the nextcloud gives the green checkmark,so the memcache.local is not the problem.

OK, I found the root cause and it was not in the Nextcloud.

Steps I did to debug:

  1. Enable debug logs for nextcloud (config.php)
  2. Identify that curl was returning error 28
"Message":"cURL error 28: Connection timed out after 30000 milliseconds (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for http://www.edri.org/"
  1. Check the proxy logs and fix the issue there