Windows client fails to detect certificate chain (requires intermediate CA as trusted root)

[CamZie]

Hello

We are recently having issues with the nextcloud desktop client in windows using a self-signed certificate.

In windows the certificate are correctly imported and on the browser everything works fine without any issues.

• Root CA is installed in Trusted Root Certification Authorities
• Intermediate CA is installed in Intermediate Certification Authorities

However, the windows desktop client does not allow connection with this setup:

It only works if our intermediate certificate is also added to Trusted Root, which is not best practice. Is this a limitation of the Nextcloud client SSL chain handling on Windows, or can this behavior be improved to properly use the windows certificate store?

Setup:

• Nextcloud server: 33.0.3
• Nextcloud client: 33.0.5 on Windows 11

[nilsding]

Does your web server respond with the full CA chain, or just the specific one created from your intermediate CA?