Update-Server for addons aren't reachable

[Siggi0904]

Hi,

my Nextcloud 21.0.4 say that since 3 days the update server for addons isn't reachable.

Log file documented the the ssl certificate for https://curl.haxx.se has expired.

Fully log:
Error | internet_connection_check | GuzzleHttp\Exception\RequestException: cURL error 60: SSL certificate problem: certificate has expired (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://www.nextcloud.com//var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php - line 158: GuzzleHttp\Handler\CurlFactory::createRejection()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php - line 110: GuzzleHttp\Handler\CurlFactory::finishError()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/Handler/CurlHandler.php - line 47: GuzzleHttp\Handler\CurlFactory::finish()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php - line 28: GuzzleHttp\Handler\CurlHandler->__invoke()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php - line 48: GuzzleHttp\Handler\Proxy::GuzzleHttp\Handler\{closure}("*** sensiti ... *")/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php - line 35: GuzzleHttp\Handler\Proxy::GuzzleHttp\Handler\{closure}("*** sensiti ... *")/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/Middleware.php - line 31: GuzzleHttp\PrepareBodyMiddleware->__invoke()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php - line 71: GuzzleHttp\Middleware::GuzzleHttp\{closure}("*** sensiti ... *")/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php - line 99: GuzzleHttp\RedirectMiddleware->__invoke()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php - line 73: GuzzleHttp\RedirectMiddleware->checkRedirect()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/promises/src/FulfilledPromise.php - line 41: GuzzleHttp\RedirectMiddleware->GuzzleHttp\{closure}("*** sensiti ... *")/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/promises/src/TaskQueue.php - line 48: GuzzleHttp\Promise\FulfilledPromise::GuzzleHttp\Promise\{closure}("*** sensiti ... *")/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/promises/src/Promise.php - line 248: GuzzleHttp\Promise\TaskQueue->run()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/promises/src/Promise.php - line 224: GuzzleHttp\Promise\Promise->invokeWaitFn()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/promises/src/Promise.php - line 269: GuzzleHttp\Promise\Promise->waitIfPending()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/promises/src/Promise.php - line 226: GuzzleHttp\Promise\Promise->invokeWaitList()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/promises/src/Promise.php - line 62: GuzzleHttp\Promise\Promise->waitIfPending()/var/www/clients/client39/web136/web/nc/3rdparty/guzzlehttp/guzzle/src/Client.php - line 187: GuzzleHttp\Promise\Promise->wait()/var/www/clients/client39/web136/web/nc/lib/private/Http/Client/Client.php - line 236: GuzzleHttp\Client->request()/var/www/clients/client39/web136/web/nc/apps/settings/lib/Controller/CheckSetupController.php - line 178: OC\Http\Client\Client->get()/var/www/clients/client39/web136/web/nc/apps/settings/lib/Controller/CheckSetupController.php - line 161: OCA\Settings\Controller\CheckSetupController->isSiteReachable()/var/www/clients/client39/web136/web/nc/apps/settings/lib/Controller/CheckSetupController.php - line 734: OCA\Settings\Controller\CheckSetupController->hasInternetConnectivityProblems()/var/www/clients/client39/web136/web/nc/lib/private/AppFramework/Http/Dispatcher.php - line 218: OCA\Settings\Controller\CheckSetupController->check()/var/www/clients/client39/web136/web/nc/lib/private/AppFramework/Http/Dispatcher.php - line 127: OC\AppFramework\Http\Dispatcher->executeController()/var/www/clients/client39/web136/web/nc/lib/private/AppFramework/App.php - line 157: OC\AppFramework\Http\Dispatcher->dispatch()/var/www/clients/client39/web136/web/nc/lib/private/Route/Router.php - line 302: OC\AppFramework\App::main()/var/www/clients/client39/web136/web/nc/lib/base.php - line 993: OC\Route\Router->match()/var/www/clients/client39/web136/web/nc/index.php - line 37: OC::handleRequest()

[kesselb]

Sounds like https://letsencrypt.org/2021/10/01/cert-chaining-help.html.

https://www.ssllabs.com/ssltest/analyze.html?d=www.nextcloud.com&latest does not show any errors related to our tls configuration.

[lookshe]

Small php test script to check wether server side fix is correct:

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://apps.nextcloud.com/api/v1/apps.json");
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYSTATUS, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
$output = curl_exec($ch);
curl_close($ch);

After removing "DST Root CA X3" certificate from server, the test script works fine.
But running "occ update:check" throws error as described from @Siggi0904.
After a few hours of testing and searching the bug, I was able to finally find the problem.
It is nextcloud itself: https://github.com/nextcloud/server/blob/master/resources/config/ca-bundle.crt#L436
The problematic certificate is bundled in nextcloud and used for every curl call.
After deleting "DST Root CA X3" certificate from ca-bundle.crt, "occ update:check" works fine.

[kesselb]

Thanks @lookshe for the hint. I've sent a pull request to update the certificate bundle. Yet the connection to our updater server works fine for me even with the expired certificate 🤷

[Siggi0904]

But that's looks like that it doesn't work in user space.
@lookshe fixed it here at my webspace but I get these error if I try to update at my website appstore.

[grosjo]

Issue still existing for NC24