maindavfs2 - Support: sr #110735, davfs2 stopped trusting server...


sr #110735: davfs2 stopped trusting server letsencrypt certificate

Submitter:  Markus <markusng>
Submitted:  Mon 03 Oct 2022 09:32:15 AM UTC
Category:  None Priority:  5 - Normal
Severity:  2 - Minor Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment (Rich Markup)

Mon 03 Oct 2022 10:36:12 AM UTC, comment #1: 

I noted my raspberry pi client only had one CA-certificate (in /etc/ssl/certs/)

I added CA-certificates using the commands

sudo apt install ca-certificates
sudo dpkg-reconfigure ca-certificates

This resolved the issue.
Now mounting works again without a query

$ umount /mnt/dav
/sbin/umount.davfs: waiting for mount.davfs (pid 11034) to terminate gracefully .. OK
$ mount /mnt/dav

Markus <markusng>
Mon 03 Oct 2022 09:32:15 AM UTC, original submission:  

I use davfs2 to mount my NextCloud share, which is hosted by a commercial NextCloud provider.
Without a change I am aware of, davfs2 stopped trusting the letsencrypt server certificate and I have to confirm the fingerprint.

What can I do to let davfs2 trust the letsencrypt certificate again?

The rented domain with the certificate is:

As client I use a headless Raspberry Pi:

uname -a
Linux zeroW 5.15.61+ #1579 Fri Aug 26 11:08:59 BST 2022 armv6l GNU/Linux

My `/etc/fstab` file contains /mnt/dav davfs _netdev,noauto,user,uid=markus,gid=markus 0 0

I ran this command:

mount /mnt/dav

At first this mounted the share without a query, then it stopped trusting the certificate:

/sbin/mount.davfs: the server certificate is not trusted
  issuer:      Let's Encrypt, US
  fingerprint: (((snip)))  (((is it save to share a fingerprint?)))
You only should accept this certificate, if you can
verify the fingerprint! The server might be faked
or there might be a man-in-the-middle-attack.
Accept certificate for this session? [y,N]

For details of the certificate, I run this command:

curl -v

It produces this output :

*   Trying 2a00:17d8:200::2b1:443...
* Connected to (2a00:17d8:200::2b1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject:
*  start date: Aug 14 06:24:29 2022 GMT
*  expire date: Nov 12 06:24:28 2022 GMT
*  subjectAltName: host "" matched cert's ""
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x822b40)
> GET /remote.php/webdav/ HTTP/2
> Host:
> user-agent: curl/7.74.0
> accept: */*
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 401
< server: nginx
< date: Mon, 03 Oct 2022 09:06:20 GMT
< content-type: application/xml; charset=utf-8
< expires: Thu, 19 Nov 1981 08:52:00 GMT
< cache-control: no-store, no-cache, must-revalidate
< pragma: no-cache
< set-cookie: oc_sessionPassphrase=ird03TvfqjnZmARSowOdnuc%2BNa4gVOZ5sJMO8HNuf7WrOdxcDY4DHB%2BovKwr4pFk2O%2FXaenCKI0GjNk%2BQq4wyfrGZSIqJlzI%2BesyEvGDIkGkqJlEqDfZypyiolcT%2BUQC; path=/; secure; HttpOnly; SameSite=Lax
< set-cookie: ocslt7sf5faa=1804c8c755e5ee70fc3a2945fa58ea9c; path=/; secure; HttpOnly; SameSite=Lax
< set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
< set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
< content-security-policy: default-src 'none';
< www-authenticate: Basic realm="Managed Nextcloud", charset="UTF-8"
< strict-transport-security: max-age=15768000; includeSubDomains;
< referrer-policy: no-referrer
< x-content-type-options: nosniff
< x-download-options: noopen
< x-frame-options: SAMEORIGIN
< x-permitted-cross-domain-policies: none
< x-robots-tag: none
< x-xss-protection: 1; mode=block
<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="">
  <s:message>No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured</s:message>
* Connection #0 to host left intact

Markus <markusng>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by markusng (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    No changes have been made to this item

    Back to the top

    Powered by Savane 3.11