Again: Successfull Installation but not possible to Login

[wbockhh]

Hello,
a got a problem similar to the Q&A item "Succefull Installation but not possible to Log-In #432" with the error-window as already quoted there.
I tried to solve my problem according to the recommodations there, but failed so far.
I am running opencloud on a local machine (linux - debian - trixie - nginx as proxy for opencloud - self-signed certificate with openssl) in my local network, maybe that is the reason for my problem.

In a log (see below) I read "certificate relies on legacy Common Name field, use SANS". Does that mean, I have to create a self-signed certificate including an additional domain other than my "local-server.local-domain.lan"? Which SAN must be used: localhost or what?

Thanks for your assistance in advance.
Regards Wolfgang

Here are my configuration files (partly similar to a running ocis server running on a dedicated server on cloud.mydomain.de).

1. nginx sites-available

server {
        listen 80 ;
        listen [::]:80 ;
        server_name local-server.local-domain.lan;
# location to redirect to https
        location / {
            # add port if deviates via OCIS_URL
            return 301 https://$server_name$request_uri;
            # return 301 https://$server_name:9200$request_uri;
        }
}
server {
        # default 443 but can deviate if set in OCIS_URL
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;
        server_name local-server.local-domain.lan;
        ssl_certificate /etc/ssl/private/local-server.local-domain.lan.crt;
        ssl_certificate_key /etc/ssl/private/local-server.local-domain.lan.key;
        include /etc/ssl/options-ssl-nginx.conf;
        ssl_dhparam /etc/ssl/ssl-dhparams.pem;
        http2_max_concurrent_streams 512;

    location / {
       # OIDC Tokens in headers are quite large and can exceed default limits of reverse proxies
       proxy_buffers 4 256k;
       proxy_buffer_size 128k;
       proxy_busy_buffers_size 256k;

       # Disable checking of client request body size
       client_max_body_size 0;
   #    proxy_pass https://local-server.local-domain.lan:9200; # nginx-t: -> bad gateway
       proxy_pass http://localhost:9200;
   #    proxy_pass https://127.0.0.1:9200;
       proxy_set_header Host $host;

        # use multiple curves  (only if dhparams file is used)
        # ssl_ecdh_curve secp521r1:secp384r1; # nginx-t: -> not allowed here

        # reduce time to first byte
        # ssl_buffer_size 4k; # -> nginx-t: -> not allowed here

        # add strict transport security
        add_header Strict-Transport-Security "max-age=15768000; must-revalidate; includeSubDomains; preload;" always;

2. opencloud.env
/etc/opencloud/opencloud.env
OC_URL=https://local-server.local-domain.lan
PROXY_HTTP_ADDR=0.0.0.0:9200
PROXY_TLS=false
OC_INSECURE=false
OC_LOG_LEVEL=warn
OC_CONFIG_DIR=/etc/opencloud
OC_BASE_DATA_PATH=/60-opencloud-daten
OC_LOG_FILE=/var/log/opencloud/opencloud-server.log

# aus opencloud.yaml
OC_SERVICE_ACCOUNT_ID=(secret)
OC_SERVICE_ACCOUNT_SECRET=(secret)

3. /etc/systemd/system/opencloud.service

[Unit]
Description=OpenCloud Service
# After=network.target

[Service]
Type=simple
User=opencloud
Group=opencloud
EnvironmentFile=/etc/opencloud/opencloud.env
ExecStart=/opt/opencloud/opencloud server
Restart=always
RestartSec=5
WorkingDirectory=/opt/opencloud
# Restart=on-failure
# RestartSec=5
# Environment=PATH=/usr/bin:/usr/local/bin
# StandardOutput=journal
# StandardError=journal

[Install]
WantedBy=multi-user.target

And here are the logs

/var/log/nginx/xxxx/xxxx.opencloud.proxy.ssl.error.log

2026/03/01 13:32:24 [crit] 4014#4014: *1 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking to upstream, client: 192.168.x.yyy, server: local-server.local-domain.lan, request: "GET / HTTP/2.0", upstream: "https://192.168.x.xxx:9200/", host: "local-server.local-domain.lan"
2026/03/01 13:32:24 [crit] 4014#4014: *1 SSL_do_handshake() failed (SSL: error:0A0000C6:SSL routines::packet length too long error:0A000139:SSL routines::record layer failure) while SSL handshaking to upstream, client: 192.168.x.yyy, server: local-server.local-domain.lan, request: "GET / HTTP/2.0", upstream: "https://[fd00::xxxx:xxxx:xxxx:xxxx:77]:9200/", host: "local-server.local-domain.lan"
2026/03/01 13:32:26 [error] 4014#4014: *1 no live upstreams while connecting to upstream, client: 192.168.x.yyy, server: local-server.local-domain.lan, request: "GET / HTTP/2.0", upstream: "https://local-server.local-domain.lan/", host: "local-server.local-domain.lan"
....

root@localserver:/# systemctl status opencloud.service
? opencloud.service - OpenCloud Service
Loaded: loaded (/etc/systemd/system/opencloud.service; enabled; preset: enabled)
Active: active (running) since Sun 2026-03-01 13:06:39 CET; 3s ago
Invocation: 69b1b1aac94f4c59a39220e298b68aa3
Main PID: 3645 (opencloud)
Tasks: 8 (limit: 18777)
Memory: 43.7M (peak: 44.2M)
CPU: 1.407s
CGroup: /system.slice/opencloud.service
+-3645 /opt/opencloud/opencloud server
Mär 01 13:06:39 local-server systemd[1]: Started opencloud.service - OpenCloud Service.
....
/var/log/opencloud/opencloud-server.log

{"level":"warn","service":"idp","kid":"private-key","path":"/60-opencloud-daten/idp/private-key.pem","time":"2026-03-01T13:06:41+01:00","message":"skipped as signer with same kid already loaded"}
{"level":"warn","service":"storage-system","host.name":"local-server","pkg":"rhttp","time":"2026-03-01T13:06:41+01:00","message":"missing or incomplete nats configuration. Events will not be published."}
...
{"level":"warn","service":"ocm","host.name":"local-server","pkg":"rhttp","time":"2026-03-01T13:06:41+01:00","message":"missing or incomplete nats configuration. Events will not be published."}
{"level":"warn","service":"frontend","host.name":"local-server","pkg":"rhttp","traceid":"67e5d5d4c104b7fd7b663cb276afd0eb","time":"2026-03-01T13:06:42+01:00","message":"core access token not set"}
{"level":"warn","service":"frontend","host.name":"local-server","pkg":"rhttp","traceid":"67e5d5d4c104b7fd7b663cb276afd0eb","host":"127.0.0.1","method":"GET","uri":"/","url":"/","proto":"HTTP/1.1","status":401,"size":0,"start":"01/Mar/2026:13:
06:42 +0100","end":"01/Mar/2026:13:06:42 +0100","time_ns":192560,"time":"2026-03-01T13:06:42+01:00","message":"http"}
###
After firefox: https://local-server.local-domain.lan/access-denied
######
{"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://local-server.local-domain.lan/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANS instead","authenticator":"oidc","path":"/api/v0/settings/roles-list","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0","client.address":"","network.peer.address":"127.0.0.1","network.peer.
port":"51120","time":"2026-03-01T13:09:55+01:00","message":"failed to authenticate the request"}
(multiple times same error messages)

[micbar]

The error message indicates that the certificate uses the wrong field for the domain name.