nginx reverse proxy not accepting letsencrypt certificate

[Razorblade]

Hi community

I have a new OPNsense up and running (3 months now, recently came from Sophos XG), with an nginx reverse proxy and three webservers running locally which can be accessed from public using https. Two servers are internally running http and one (nextcloud) is running internally with https.

Now I need to replace my wildcard certificate *.example.com with single domain certificates from let's encrypt. Wildcard letsencrypt doesn't work with my domain provider.
This works fine for both unencrypted servers, these can be reached externally using https with letsencrypt and http internally.

I have issues with my internal https connection between opnsense and nextcloud when using the newly created letsencrypt certificates.
When using the letsencryt certificates internally and externally then opnsense/nginx won't communicate with the internal nextcloud server telling me it can't verify the certificate chain.

*161 upstream SSL certificate verify error: (20:unable to get local issuer certificate) while SSL handshaking to upstream, client: xxx.xxx.xxx.xxx, server: nextcloud.example.com, request: "GET /index.php/204 HTTP/2.0", upstream: "https://172.16.10.10:443/index.php/204", host: "nextcloud.example.com"

But openssl directly from OPNsense shell works fine with status OK when verifying the connection.

Code Select Expand

openssl s_client -connect 172.16.10.10:443 -servername nextcloud.example.com -showcerts < /dev/nullShows

Code Select Expand

Verify return code: 0 (ok)

Internally the certificate is also working and I can connect to nextcloud internally using https using the new letsencrypt certificate.

What is working (but not a solution as the certificate will expire in two weeks):
internet --> opnsense/nginx/letsencrypt --> nextcloud/wildcard
But not:
internet --> opnsense/nginx/letsencrypt --> nextcloud/letsencrypt

Internally it doesn't matter whether letsencrypt ot wildcard, both are fine - it's the connection between opnsense/nginx and the internal web server
I checked all root certificates and they look fine and are installed on opnsense.

What could be the problem?

[Patrick M. Hausen]

Why don't you run the internal connection unencrypted?