SSL certificate problem when installing Nextcloud AIO behind Nginx Proxy Manager with 3rd party certificate

[JuSenshi]

Steps to reproduce

1. Create Ubuntu-VM with Nginx Proxy Manager as Docker Container
2. Create Ubuntu-VM with Nextcloud AIO via Docker
3. Follow the Reverse-Proxy documentation to setup everything but use own Lets Encrypt certificate for used domain

Expected behavior

When configuring Nextcloud in the AIO interface, it should accept the domain that got configured in NPM

Actual behavior

Generating an error message: "Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. ('sudo docker logs -f nextcloud-aio-mastercontainer')"
Said command output:

NOTICE: PHP message: The response of the connection attempt to "https://MYSUBDOMAIN.MYDOMAIN.de:443" was:
NOTICE: PHP message: Expected was: LONG_HEX_CODE
NOTICE: PHP message: The error message was: SSL certificate problem: unable to get local issuer certificate
NOTICE: PHP message: Please follow https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#6-how-to-debug-things in order to debug things!

Other information

Host OS

Ubuntu 24.04. LTS

Output of sudo docker info

Client: Docker Engine - Community
Version: 27.3.1
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.17.1
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.29.7
Path: /usr/libexec/docker/cli-plugins/docker-compose

Server:
Containers: 2
Running: 2
Paused: 0
Stopped: 0
Images: 2
Server Version: 27.3.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 7f7fdf5fed64eb6a7caf99b3e12efcf9d60e311c
runc version: v1.1.14-0-g2c9f560
init version: de40ad0
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.8.0-48-generic
Operating System: Ubuntu 24.04.1 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 7.755GiB
Name: REDACTED_HOSTNAME
ID: 2ab6e688-bec4-401b-b3a7-6888b6fe0ae7
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false

Docker run command or docker-compose file that you used

sudo docker run
--init
--sig-proxy=false
--name nextcloud-aio-mastercontainer
--restart always
--publish 8080:8080
--env APACHE_PORT=11000
--env NEXTCLOUD_DATADIR="/mnt/nfs/nextcloud"
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config
--volume /var/run/docker.sock:/var/run/docker.sock:ro
nextcloud/all-in-one:latest

Note: I also tried with parameter --env APACHE_IP_BINDING=0.0.0.0 but no success

Other valuable info about my setup

• Running multiple Ubuntu VMs on my Proxmox VE Server including one that hosts my Nginx proxy manager and a different one for Nextcloud
• Using a Netcup Webhosting package that includes the domain and handles Let's Encrypt certificates for said domain
• Exported the certificate for the domain into my nginx proxy manager, that i already use for other services, proving it works

More Info about the Nginx proxy manager config

Custom Locations: Nothing
SSL: My own certificate for my domain (hosted as a webserver on netcup with dns entry to my home network, working with other services)
Custom Nginx Configuration:

client_body_buffer_size 512k;
proxy_read_timeout 86400s;
client_max_body_size 0;

I followed the Reverse-Proxy setup docs exactly and sadly the Debugging sector did not help a single bit. I've seen other people ask about the error message i got but nothing worked or was not applicable to me.
BUT: When i open "mysubdomain.mydomain.de" in my browser, i get the exact hex string the system is expecting. So i guess the AIO interface/container can't access the domain properly?

Any help or ideas are much appreciated!

[szaimen]

Hi, can you follow https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#6-how-to-debug-things?

[JuSenshi]

and sadly the Debugging sector did not help a single bit
But i found out earlier today. Apparently contrary to other services, Nextcloud needs the whole certificate chain for the Domaincheck, otherwise it does not accept it. Other services aren't as picky, but i get it, it's a security feature. I would've appreciated if the error message was more obvious, but that might not even be a thing that is in your hands. Overall it's working now, just had to add the whole Chain to my Nginx Proxy Manager, so technically i configured it poorly.

[JuSenshi]

Thanks for all your work though, Simon. Keep it up, you're great!

[JuSenshi]

The error was a poor Nginx Proxy Configuration. It only contained the certificate for the domain itself and not the whole chain, missing the root and intermediate certs. I added the whole chain to the NPM-entry and it's working like a charm now. It was hard to debug this, as the error was kind of vague and other services did not have any problems with one cert only.