nextcloud / nextcloud/desktop

[Bug]: nextcloudcmd complains about invalid SSL certificate (desktop client OK)

Closed
#9,125 1 comment 0 reactions 0 assignees View on GitHub
0. Needs triage bug
Dominant language
C++
Stars
3.9k
Forks
1k
Avg merge
1d 21h
Merged PRs (30d)
127

Description

### ⚠️ Before submitting, please verify the following: ⚠️

- [x] This is a **bug**, not a question or a configuration issue.
- [x] This issue is **not** already reported on Github (I've searched it).
- [x] Nextcloud Server and Desktop Client are **up to date**. See [Server Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) and [Desktop Releases](https://nextcloud.com/install/#install-clients) for supported versions.
- [x] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/)

### Bug description

Hello,

I am running NextCloud Server (through Docker) with an internal SSL certificate signed by an internal CA. It is trusted on all clients and everything is working well with the **Desktop** client (even on the Linux system where I encounter the issue). However, when trying to use the CLI client _nextcloudcmd_ , it complains about an untrusted SSL certificate:

`> ~
$ nextcloudcmd --trust -u MYUSER -p MYPASSWORD /local/path/ https://files.myserver.local
11-23 14:38:05:419 [ info nextcloud.sync.accessmanager ]: 2 "" "https://files.myserver.local/status.php" has X-Request-ID "e65da2c4-f9cc-49e7-a87a-4a0f6c5f0517"
11-23 14:38:05:423 [ info nextcloud.sync.networkjob ]: OCC::CheckServerJob created for "https://files.myserver.local" + "status.php" ""
11-23 14:38:05:432 [ info nextcloud.sync.account ]: ssl errors "SSL-Errors happened for url \"https://files.magvice.lan/status.php\" \tError in QSslCertificate(Version=\"3\", SerialNumber=\"47:d2:bb:ce:c8:cb:18:89\", Digest=\"D9O40qAmetFoLaTZ3vHhvA==\", Issuer=\"MGV-ROOT-CA\", Subject=\"MGV-ROOT-CA\", AlternativeSubjectNames=QMultiMap(), EffectiveDate=QDateTime(2025-07-10 12:23:00.000 UTC Qt::UTC), ExpiryDate=QDateTime(2075-07-10 12:23:00.000 UTC Qt::UTC)) : \"**The root certificate of the certificate chain is self-signed, and untrusted\" ( \"The root certificate of the certificate chain is self-signed, and untrusted\" ) \n "**
11-23 14:38:05:432 [ info nextcloud.sync.account ]: QList(QSslCertificate(Version="3", SerialNumber="46:8a:1a:e2:66:34:d4:dd", Digest="IB3IvABJFcMHO11lF6zCjQ==", Issuer="ORG-SUB-CA", Subject="*.myserver.local", AlternativeSubjectNames=QMultiMap((QSsl::DnsEntry, "*.myserver.local")), EffectiveDate=QDateTime(2025-07-10 12:51:00.000 UTC Qt::UTC), ExpiryDate=QDateTime(2026-07-10 12:51:00.000 UTC Qt::UTC)), QSslCertificate(Version="3", SerialNumber="13:d8:35:c1:65:ad:dc:c2", Digest="5L2/k2YJEPj9fZLbV1WGGg==", Issuer="ORG-ROOT-CA", Subject="ORG-SUB-CA", AlternativeSubjectNames=QMultiMap(), EffectiveDate=QDateTime(2025-07-10 12:23:00.000 UTC Qt::UTC), ExpiryDate=QDateTime(2035-07-10 12:23:00.000 UTC Qt::UTC)), QSslCertificate(Version="3", SerialNumber="47:d2:bb:ce:c8:cb:18:89", Digest="D9O40qAmetFoLaTZ3vHhvA==", Issuer="ORG-ROOT-CA", Subject="ORG-ROOT-CA", AlternativeSubjectNames=QMultiMap(), EffectiveDate=QDateTime(2025-07-10 12:23:00.000 UTC Qt::UTC), ExpiryDate=QDateTime(2075-07-10 12:23:00.000 UTC Qt::UTC)))
11-23 14:38:05:432 [ info nextcloud.sync.account ]: "SSL-Errors happened for url \"https://files.magvice.lan/status.php\" \tError in QSslCertificate(Version=\"3\", SerialNumber=\"47:d2:bb:ce:c8:cb:18:89\", Digest=\"D9O40qAmetFoLaTZ3vHhvA==\", Issuer=\"ORG-ROOT-CA\", Subject=\"ORG-ROOT-CA\", AlternativeSubjectNames=QMultiMap(), EffectiveDate=QDateTime(2025-07-10 12:23:00.000 UTC Qt::UTC), ExpiryDate=QDateTime(2075-07-10 12:23:00.000 UTC Qt::UTC)) : \"The root certificate of the certificate chain is self-signed, and untrusted\" ( \"The root certificate of the certificate chain is self-signed, and untrusted\" ) \n " Certs are known and trusted! This is not an actual error.
11-23 14:38:05:432 [ warning nextcloud.sync.networkjob ]: SslHandshakeFailedError: **"The server enforces strict transport security and does not accept untrusted certificates." : can be caused by a webserver wanting SSL client certificates**
11-23 14:38:05:432 [ warning nextcloud.sync.networkjob ]: QNetworkReply::SslHandshakeFailedError "The server enforces strict transport security and does not accept untrusted certificates." QVariant(Invalid)
11-23 14:38:05:432 [ warning nextcloud.sync.networkjob.checkserver ]: error: status.php replied 0 ""
Error connecting to server for status`

I can successfully confirm the system trusts the SSL certificate because I can query it with _curl_ without any issues. I can also confirm that no client certificates are required to access the system.

Passing the option '--trust' does not do anything at all. Also, no logs are registered on the server side (only the GUI clients appear in tthe logs. I attached them anyways). I also tried to disable HSTS but I have the same error from _nextcloudcmd_ .

### Steps to reproduce

1. Deploy the latest version of NextCloud server with Docker Compose
2. Install a SSL certificate (fullchain) recognized by the client
3. Install the CA certificates on the client system
4. Create a user on the NextCloud server
5. Create an app passworrd for authentication with the CLI client
6. Try to sync using _nextcloudcmd_

### Expected behavior

The CLI client _nextcloudcmd_ should connect and sync just like the GUI desktop client does.
In any case, the '--trust' option shoud work around the issue but it does not even work (I never had to use it in the past)

### Which files are affected by this bug

N/A

### Operating system

Linux

### Which version of the operating system you are running.

Arch Linux

### Package

Distro package manager

### Nextcloud Server version

Nextcloud Hub 25 Autumn (32.0.2)

### Nextcloud Desktop Client version

4.0.1daily, Git revision e81c242e131f207f0c18081004453a01af5bd51e

### Is this bug present after an update or on a fresh install?

Fresh desktop client install

### Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

### Are you using an external user-backend?

- [x] Default internal user-backend
- [ ] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Nextcloud Server logs

```shell
See attachment 'nextcloud.log' (too big to paste here). It only contains the Windows clients (and mobile) with the Desktop versions though (as mentioned, the CLI client error does not generate any log on the server).
```

### Additional info

[nextcloud.log](https://github.com/user-attachments/files/23696477/nextcloud.log)

Contributor guide

Open the contributing guide

Research direction

The issue names nextcloudcmd as the entry point but provides no affected files or tests. Reproduce the command with the internal CA and --trust option, then trace the SSL-error handling; done means the CLI connects and syncs with the trusted certificate, matching the desktop client.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli, desktop, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.