"Download failed" after upgrade to onlyoffice - unable to verify the first certificate #96

thomass4t · 2018-04-10T15:22:12Z

I upgraded to the current community- and document-server 9.6.1.627
Community-Server runs with self-signed SSL certificate
Document-Server runs with plain http

After restart of the two docker containers, I get an error message when opening any kind of document. The error message merely shows "Download failed".

I discovered the underlying error within the logfile
/app/onlyoffice/DocumentServer/logs/documentserver/converter/out.log

Whenever I open a document, an error shows up in this logfile:

[2018-04-10 14:17:05.216] [ERROR] nodeJS - error downloadFile:url=https://onlyoffice/products/files/httphandlers/filehandler.ashx?action=stream&fileid=4&version=6&stream_auth=xxx;attempt=3;code:UNABLE_TO_VERIFY_LEAF_SIGNATURE;connect:undefined;(id=PryKqIixHZSmYe_LEsQ_)
Error: unable to verify the first certificate
at Error (native)
at TLSSocket. (_tls_wrap.js:1092:38)
at emitNone (events.js:86:13)
at TLSSocket.emit (events.js:185:7)
at TLSSocket._finishInit (_tls_wrap.js:609:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:439:38)

The document-Server seems to download something from the community-server and fails because it doesn't know the CA of the self-signed certificate.

How can I add my self-signed certificate or my CA to the document-server?
My CA must be injected to Node-JS service.
(Adding it to /etc/ssl/certs didn't work and also setting the docker-env NODE_TLS_REJECT_UNAUTHORIZED=0 didn't help either)

Thanks for any suggestions,
Thomas

dmkash · 2018-07-13T20:21:38Z

I am running into the same problem while setting up local virtual machines in our development environment. For our development virtual machines we use the .test TLD, so need to use self-signed certificates.

The ONLYOFFICE Document Server has been installed on a CentOS 7 virtual machine following the directions here: https://helpcenter.onlyoffice.com/server/linux/document/linux-installation-centos.aspx

I tried adding NODE_TLS_REJECT_UNAUTHORIZED=0 to the /etc/onlyoffice/documentserver/supervisor/onlyoffice-documentserver-docservice.ini but this didn't work, either. I'm seeing the exact same error in /var/log/onlyoffice/documentserver/docservice/out.log as the OP:

[2018-07-13 14:50:22.799] [ERROR] nodeJS - postData error: docId = 2_2_;url = https://testserver.ourdomain.test/path/to/document;data = {"key":"2_2_","status":1,"users":["1"],"actions":[{"type":1,"userid":1}]}
Error: self signed certificate
    at TLSSocket.<anonymous> (_tls_wrap.js:1105:38)
    at emitNone (events.js:106:13)
    at TLSSocket.emit (events.js:208:7)
    at TLSSocket._finishInit (_tls_wrap.js:639:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:469:38)

agolybev · 2018-07-16T08:39:14Z

Hi Dana, try turning off validating certificate by Document Server. Set services.CoAuthoring.requestDefaults.rejectUnauthorized=false in /etc/onlyoffice/documentserver/defaults.json file and restart documentserver serviceis with supervisorctl restart all.

inpos · 2018-08-24T18:42:07Z

Unfortunately, node.js don't use system ca-certs and this issue can't be fixed by adding local CA cert to system bundle. Workaround by @agolybev work, but breaks SSL security due to allow connections to unauthorized ssl servers.

thomaswollburg · 2018-09-26T09:41:14Z

The workaround does work, but pretty pretty please update your documentation as I have tried all -e SSL_VERIFY_CLIENT="off" -e NODE_TLS_REJECT_UNAUTHORIZED=0 and what not to make this work. Can I invoice these useless hours of frustration somewhere? Even set up chain file and gave it the recommend name and everything. Nothing helped here.

ibnpetr · 2018-09-26T16:41:46Z

@thomaswollburg
Next version of the DocumentServer container will include node.js v8, it does use system CA bundle, you will be able to import your certificates without having to disable verification.

changchichung · 2018-10-30T01:45:05Z

@ibnpetr is there any schedule for next release ?

skuep · 2019-01-15T11:59:33Z

@ibnpetr
I am curious, are you already using node v8? When I execute the following in the onlyoffice docker container, I get:

docker exec <id> node -v
v8.14.0

However I am having the exact same issues as above. Also tried every workaround given above.

mrwormo · 2019-06-26T09:29:29Z

Hi,
I'm using the latest docker image with Traefik as reverse proxy, and i have the same problem.

The trick to turning off validating certificate by Document Server works great :

Set services.CoAuthoring.requestDefaults.rejectUnauthorized=false in /etc/onlyoffice/documentserver/defaults.json file and restart documentserver serviceis with supervisorctl restart all.

But how can i modify the default.json when the container starts ? services.CoAuthoring.requestDefaults.rejectUnauthorized seems to not be modified by an environment variable (https://github.com/ONLYOFFICE/Docker-DocumentServer#available-configuration-parameters).

ShockwaveNN · 2019-06-26T14:29:54Z

@mrwormo Hi, you're are right, not all options from default.json can be configured by params.
But you can use something like this after starting container

docker exec -it containerID /var/www/onlyoffice/documentserver/npm/node_modules/.bin/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false'

(I didn't check this exact command, but you should get an idea

mrwormo · 2019-06-27T08:51:55Z

Hi @ShockwaveNN,
This command works just fine. Many thx !
Now i need to run the command when the container starts. I tried to put this line at the end of the Docker-compose.yml, but it doesn't work.
I continue to search a solution to automate this...

ShockwaveNN · 2019-06-27T08:58:42Z

@mrwormo I think there is no elegant way to use this command witho Docker Compose, you can modify https://github.com/ONLYOFFICE/Docker-DocumentServer/blob/master/run-document-server.sh to add this command and rebuild image locally

mrwormo · 2019-06-27T10:26:19Z

@ShockwaveNN I actually thought about modifying https://github.com/ONLYOFFICE/Docker-DocumentServer/blob/master/run-document-server.sh, and build my own image, but that means that we would have to rebuild the image each time we update.

ShockwaveNN · 2019-06-27T10:47:34Z

@mrwormo I think you can try to move running run-document-server.sh command to docker-compose.yml file and add something like

command: >
    bash -c "/var/www/onlyoffice/documentserver/npm/node_modules/.bin/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false'
    && bash /app/onlyoffice/run-document-server.sh"

I didn't test it through

mrwormo · 2019-07-01T09:46:13Z

@ShockwaveNN Thx for the time spent, but it doesn't work. Dont't bother, i will continue to edit the file after the container has started...

ShockwaveNN · 2019-07-10T12:48:19Z

This issue is closed, seems original problem was resolved via update of nodejs to version 8
If not - I think it's better to create new issue

ReinerNippes · 2019-11-11T21:35:21Z

@ShockwaveNN

This issue is closed, seems original problem was resolved via update of nodejs to version 8
If not - I think it's better to create new issue

no. it's still not possible to use selfsigned certifcates.
and the workaround to change the file /etc/onlyoffice/documentserver/default.json inside the container would not survive an update. or?

…ce - unable to verify the first certificate

* fix issue #96 ; 'Download failed' after upgrade to onlyoffice - unable to verify the first certificate * New variable name REJECT_UNAUTHORIZED_STORAGE Shell variable rnamed to REJECT_UNAUTHORIZED_STORAGE.

jcklpe · 2019-12-13T02:06:29Z

Can confirm that Reiner is correct. This issue wasn't fixed until I used the temporary fix.

fixes the issue reported here ONLYOFFICE/Docker-DocumentServer#96 with self-signed certificates

zner0L · 2021-01-31T08:12:15Z

There actually is a way to do this properly and without disabling certificate verification. You can add your own CAs (or rather, replace nodejs' CA store) by adding them in the agentOptions of request, which takes in the options you can define in the TLS Secure Context:

"services.CoAuthoring.requestDefaults" {
    "agentOptions": {
        "ca": "<your pem style CA cert>"
    }
}

nmaludy · 2021-02-05T20:12:02Z

@mrwormo I think you can try to move running run-document-server.sh command to docker-compose.yml file and add something like
command: >
    bash -c "/var/www/onlyoffice/documentserver/npm/node_modules/.bin/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false'
    && bash /app/onlyoffice/run-document-server.sh"
I didn't test it through

I got this working using a modified version of this suggestion, basically inserting the edit in the docker run command. Problem in the example above is trying to use /var/www/onlyoffice/documentserver/npm/node_modules/.bin/json that doesn't exist. Instead need to use /var/www/onlyoffice/documentserver/npm/bin/json:

docker run -i -t -d -p 8443:443  -v /var/www/onlyoffice/Data:/var/www/onlyoffice/Data \
  --entrypoint "/bin/bash" \
  onlyoffice/documentserver \
  -c "/var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false' && /app/ds/run-document-server.sh"

lgzcoollg · 2022-01-09T15:01:40Z

@mrwormo I think you can try to move running run-document-server.sh command to docker-compose.yml file and add something like
command: >
    bash -c "/var/www/onlyoffice/documentserver/npm/node_modules/.bin/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false'
    && bash /app/onlyoffice/run-document-server.sh"
I didn't test it through
I got this working using a modified version of this suggestion, basically inserting the edit in the docker run command. Problem in the example above is trying to use /var/www/onlyoffice/documentserver/npm/node_modules/.bin/json that doesn't exist. Instead need to use /var/www/onlyoffice/documentserver/npm/bin/json:
docker run -i -t -d -p 8443:443  -v /var/www/onlyoffice/Data:/var/www/onlyoffice/Data \
  --entrypoint "/bin/bash" \
  onlyoffice/documentserver \
  -c "/var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false' && /app/ds/run-document-server.sh"

Docker tag:6.4, input command after docker run.and it work

lgzcoollg · 2022-01-25T08:19:31Z

@mrwormo I think you can try to move running run-document-server.sh command to docker-compose.yml file and add something like
command: >
    bash -c "/var/www/onlyoffice/documentserver/npm/node_modules/.bin/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false'
    && bash /app/onlyoffice/run-document-server.sh"
I didn't test it through
I got this working using a modified version of this suggestion, basically inserting the edit in the docker run command. Problem in the example above is trying to use /var/www/onlyoffice/documentserver/npm/node_modules/.bin/json that doesn't exist. Instead need to use /var/www/onlyoffice/documentserver/npm/bin/json:
docker run -i -t -d -p 8443:443  -v /var/www/onlyoffice/Data:/var/www/onlyoffice/Data \
  --entrypoint "/bin/bash" \
  onlyoffice/documentserver \
  -c "/var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false' && /app/ds/run-document-server.sh"

not work in docker image tags 7.0.0

ShockwaveNN · 2022-01-25T08:21:32Z

You can now use docker env key USE_UNAUTHORIZED_STORAGE

lgzcoollg · 2022-01-25T09:05:36Z

You can now use docker env key USE_UNAUTHORIZED_STORAGE

Seccused!
-e USE_UNAUTHORIZED_STORAGE=true

mrwormo · 2022-02-28T14:36:12Z

You can now use docker env key USE_UNAUTHORIZED_STORAGE

Yeah ! It's working with tag:6.4.2.
Not tested with tag:7

webagroprom · 2022-05-25T19:43:07Z

 #- LARGER_FILE_LIMITS=true
    ports:
      - '9050:80'
      - '9000:443'
    stdin_open: true
    restart: always
    stop_grace_period: 120s
    command: bash -c "/var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false' && bash /app/onlyoffice/run-document-server.sh"
    volumes:

Added to configuration docker-compose.yml launched container docker-compose up -d

nextcloud: Error while downloading the document file to be converted.) (версия 7.1.0.215)

What am I doing wrong ? How to solve this error?

webagroprom · 2022-05-26T07:24:40Z

@mrwormo I think you can try to move running run-document-server.sh command to docker-compose.yml file and add something like
command: >
    bash -c "/var/www/onlyoffice/documentserver/npm/node_modules/.bin/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false'
    && bash /app/onlyoffice/run-document-server.sh"
I didn't test it through
I got this working using a modified version of this suggestion, basically inserting the edit in the docker run command. Problem in the example above is trying to use /var/www/onlyoffice/documentserver/npm/node_modules/.bin/json that doesn't exist. Instead need to use /var/www/onlyoffice/documentserver/npm/bin/json:
docker run -i -t -d -p 8443:443  -v /var/www/onlyoffice/Data:/var/www/onlyoffice/Data \
  --entrypoint "/bin/bash" \
  onlyoffice/documentserver \
  -c "/var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/default.json -I -e 'this.services.CoAuthoring.requestDefaults.rejectUnauthorized=false' && /app/ds/run-document-server.sh"
Docker tag:6.4, input command after docker run.and it work

Can you show an example of how to correctly add (as you added) data to the docker-compose.yml configuration file ?

ShockwaveNN · 2022-05-26T07:31:38Z

@webagroprom I think for you it's better to create new discusttion\new issue since your problem doesn't seem any relation to original issue with certificate verification

rasmu31 · 2022-06-07T11:56:28Z

Hello,

To resolve the same problem with Let's encrypt cert, I didn't modify onlyoffice configuration file default.json.
I only change ssl_certificate in nginx configuration file /etc/nginx/conf.d/ds.conf (onlyoffice general server block) :
ssl_certificate /etc/ssl/certs/fullchain.pem;
ssl_certificate_key /etc/ssl/private/privkey.pem;

pem files are from let's encrypt folder, I just copied them in /etc/ssl/certs/ and /etc/private/
When having the problem, I used cert.pem, now I use fullchain.pem and problem is gone.

See attachment : ds.conf.txt

douglascrp · 2022-06-14T13:34:05Z

You can now use docker env key USE_UNAUTHORIZED_STORAGE

Seccused! -e USE_UNAUTHORIZED_STORAGE=true

Yes, it works

mirrornight · 2024-09-03T06:04:57Z

You can now use docker env key USE_UNAUTHORIZED_STORAGE

not work in docker image tags onlyoffice/documentserver-de:7.3.3.50.

This was referenced Aug 31, 2018

Doesn't work, but why? ONLYOFFICE/onlyoffice-nextcloud#3

Closed

Error occurred in the document service: Error while downloading the document file to be converted #101

Closed

changchichung mentioned this issue Oct 30, 2018

onlyoffice not working ReinerNippes/nextcloud#15

Closed

faxenmaxen mentioned this issue Dec 6, 2018

Nextcloud app - HTTP 403 Forbidden - Error while downloading the document file to be converted. ONLYOFFICE/onlyoffice-nextcloud#36

Closed

ShockwaveNN closed this as completed Jul 10, 2019

ReinerNippes added a commit to ReinerNippes/Docker-DocumentServer that referenced this issue Nov 12, 2019

fix issue ONLYOFFICE#96 ; 'Download failed' after upgrade to onlyoffi…

d067050

…ce - unable to verify the first certificate

ReinerNippes mentioned this issue Dec 10, 2019

Running this ansible script causes Hyper terminal emulator to break ReinerNippes/nextcloud#61

Closed

agolybev added a commit that referenced this issue Dec 26, 2019

Remake fix #96

9eff99f

SleepingShell mentioned this issue Sep 15, 2020

Allow turning off TLS verification from env variable #290

Open

armagankaratosun added a commit to armagankaratosun/nextcloud that referenced this issue Nov 30, 2020

fixes "nodeJS - error downloadFile"

b63f920

fixes the issue reported here ONLYOFFICE/Docker-DocumentServer#96 with self-signed certificates

armagankaratosun mentioned this issue Nov 30, 2020

fixes "nodeJS - error downloadFile" ReinerNippes/nextcloud#101

Open

ShockwaveNN mentioned this issue Aug 4, 2021

Download file failed. ONLYOFFICE/Docker-CommunityServer#126

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

"Download failed" after upgrade to onlyoffice - unable to verify the first certificate #96

"Download failed" after upgrade to onlyoffice - unable to verify the first certificate #96

thomass4t commented Apr 10, 2018

dmkash commented Jul 13, 2018

agolybev commented Jul 16, 2018

inpos commented Aug 24, 2018 •

edited

Loading

thomaswollburg commented Sep 26, 2018

ibnpetr commented Sep 26, 2018

changchichung commented Oct 30, 2018

skuep commented Jan 15, 2019

mrwormo commented Jun 26, 2019 •

edited

Loading

ShockwaveNN commented Jun 26, 2019

mrwormo commented Jun 27, 2019

ShockwaveNN commented Jun 27, 2019

mrwormo commented Jun 27, 2019

ShockwaveNN commented Jun 27, 2019

mrwormo commented Jul 1, 2019

ShockwaveNN commented Jul 10, 2019

ReinerNippes commented Nov 11, 2019 •

edited

Loading

jcklpe commented Dec 13, 2019

zner0L commented Jan 31, 2021

nmaludy commented Feb 5, 2021 •

edited

Loading

lgzcoollg commented Jan 9, 2022 •

edited

Loading

lgzcoollg commented Jan 25, 2022

ShockwaveNN commented Jan 25, 2022

lgzcoollg commented Jan 25, 2022

mrwormo commented Feb 28, 2022

webagroprom commented May 25, 2022

webagroprom commented May 26, 2022

ShockwaveNN commented May 26, 2022

rasmu31 commented Jun 7, 2022 •

edited

Loading

douglascrp commented Jun 14, 2022

mirrornight commented Sep 3, 2024

"Download failed" after upgrade to onlyoffice - unable to verify the first certificate #96

"Download failed" after upgrade to onlyoffice - unable to verify the first certificate #96

Comments

thomass4t commented Apr 10, 2018

dmkash commented Jul 13, 2018

agolybev commented Jul 16, 2018

inpos commented Aug 24, 2018 • edited Loading

thomaswollburg commented Sep 26, 2018

ibnpetr commented Sep 26, 2018

changchichung commented Oct 30, 2018

skuep commented Jan 15, 2019

mrwormo commented Jun 26, 2019 • edited Loading

ShockwaveNN commented Jun 26, 2019

mrwormo commented Jun 27, 2019

ShockwaveNN commented Jun 27, 2019

mrwormo commented Jun 27, 2019

ShockwaveNN commented Jun 27, 2019

mrwormo commented Jul 1, 2019

ShockwaveNN commented Jul 10, 2019

ReinerNippes commented Nov 11, 2019 • edited Loading

jcklpe commented Dec 13, 2019

zner0L commented Jan 31, 2021

nmaludy commented Feb 5, 2021 • edited Loading

lgzcoollg commented Jan 9, 2022 • edited Loading

lgzcoollg commented Jan 25, 2022

ShockwaveNN commented Jan 25, 2022

lgzcoollg commented Jan 25, 2022

mrwormo commented Feb 28, 2022

webagroprom commented May 25, 2022

webagroprom commented May 26, 2022

ShockwaveNN commented May 26, 2022

rasmu31 commented Jun 7, 2022 • edited Loading

douglascrp commented Jun 14, 2022

mirrornight commented Sep 3, 2024

inpos commented Aug 24, 2018 •

edited

Loading

mrwormo commented Jun 26, 2019 •

edited

Loading

ReinerNippes commented Nov 11, 2019 •

edited

Loading

nmaludy commented Feb 5, 2021 •

edited

Loading

lgzcoollg commented Jan 9, 2022 •

edited

Loading

rasmu31 commented Jun 7, 2022 •

edited

Loading