[Bug]: LDAP fails verification when using self-signed certs

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I'm running Nextcloud with Docker:
Nextcloud vs 24.0.5-apache
MariaDB 10.5.16

I have Nextcloud configured for LDAP authentication to OpenLDAP (LDAPS). The LDAP server certificate is signed by an internal/private CA. I have added the CA certificate to Nextcloud using the 'occ security:certificates:import' command and verified the CA certificate exists with 'occ security:certificates' command. However, Nextcloud still fails to connect to the LDAP server with a TLS verification failure.

The only work around I have found is to add the CA certificates to the running container's trusted certificates file '/etc/ssl/certs/ca-certificates.crt'. After the CA is added here, LDAPS succeeds.

This can be done by copying the CA cert to /usr/local/share/ca-certificates and running update-ca-certificates internally on container or by bind mounting the CA cert directly to /etc/ssl/certs/ca-certificates.crt with docker.

Steps to reproduce

Expected behavior

I would expect adding the CA Certificate via the occ:security:certificates interface would be sufficient for LDAPS.

Installation method

Community Docker image

Operating system

Debian/Ubuntu

PHP engine version

None

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

.

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

Start by reproducing LDAPS authentication in the Community Docker image after importing a private CA with occ security:certificates:import. Compare that behavior with the system CA bundle at /etc/ssl/certs/ca-certificates.crt; done means the imported CA is sufficient for LDAP TLS verification without modifying the container's system certificate bundle.