3

I'm trying to connect my NextCloud account to Ubuntu, so that I can take advantage of the calendar integration and other features. Right now I'm running my own NextCloud server with a self-signed certificate, as I'm trying to avoid relying on any outside authority.

I can access the server from my browser without issues, and I don't mind having to go through the 'untrusted' certificate exception dialog since I'm the one who signed it.

But when I try to connect my NextCloud account to Ubuntu using the "Online Accounts" feature in system Settings, the connection fails with an error message due to "Invalid Certificate."

Is there a way to force Ubuntu to accept my NextCloud server and credentials, even if the certificate is invalid? Is there a way to add the certificate so that Ubuntu will accept it and connect to my server?

Improve this question

2 Answers 2

Reset to default
3

Firefox uses its own certificate store, so it does not affect Online Accounts. But if you add your self-signed certificate to the root trust store of the system, then it should work. This Ask Ubuntu question deals exactly with this: How do I install a root certificate?

Improve this answer
1
  • Thank you for the link! From what I can gather, requesting NextCloud to enable SSL using a self-signed certificate doesn't actually produce a unique certificate, rather it uses a pre-installed "snake-oil" certificate that is designed to be rejected. I may have to figure out how to force NextCloud to use a unique certificate before I can install it on my client machine. It's such a hassle, though, so I'm going to go with Let's Encrypt for now. I'm going to mark your response as the answer though!
    – Sudo Sensei
    Jan 30, 2019 at 3:17
1

Right now I'm running my own NextCloud server with a self-signed certificate, as I'm trying to avoid relying on any outside authority.

Don't. Suddenly you want to share a file with someone else, who doesn't have your certificate.

The web is moving in the direction of TLS within the current PKI infrastructure. Set up Let's Encrypt, and optionally Public Key Pinning to ensure that no thirdparty can issue a new certificate with a new public key without your knowledge, to avoid a MiTM.

Improve this answer
2
  • I have to admit that I don't know enough about Let's Encrypt as a service. My understanding with regards to a certificate authority is that you have to 'trust' they are signing a valid certificate, and that a compromised CA can issue fraudulent certificates for MITM attacks (and there's historical precedent for this). What is to prevent Let's Encrypt from being able to covertly perform the same attack?
    – Sudo Sensei
    Jan 29, 2019 at 22:45
  • Transparency. Every certificate shall be published. Browsers should check against the public issuing protocol, and report any certificates not in the protocol. In addition a website can use public key pinning to pin a specific key.
    – vidarlo
    Jan 30, 2019 at 5:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.