[GH-ISSUE #833] CERTIFICATE_VERIFY_FAILED #400

Closed
opened 2026-02-26 10:32:23 +03:00 by kerem · 9 comments
Owner

Originally created by @gejixiang0521-pixel on GitHub (Nov 6, 2025).
Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/833

This issue is unique.

  • I have used the search tool and did not find an issue describing my bug.

Operating System of DocumentServer

Docker

Version information

7.2.1

Expected Behavior

save success after edit

Actual Behavior

when I try to save it, I still get the following error:
[2025-11-06T12:43:04.309] [WARN] [localhost] [8f6af64bd7eb446ba976ad132ca0b367_1762432977063] [0011] nodeJS - sendServerRequest returned an error: data = {"status_code":500,"status_message":"HTTPSConnectionPool(host='172.16.20.112', port=30011): Max retries exceeded with url: /cache/files/data/8f6af64bd7eb446ba976ad132ca0b367_1762432977063_7541/output.docx/output.docx?md5=jgsql3FNLLwAgkULRnIaHQ&expires=1762433885&filename=output.docx (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1017)')))"}

Reproduction Steps

I configured OnlyOffice to use HTTPS. Below is my docker-compose configuration.
services:
office:
container_name: bisheng-office
image: onlyoffice/documentserver:7.2.1
ports:
- "30011:443"
environment:
TZ: Asia/Shanghai
JWT_ENABLED: "false"
NODE_TLS_REJECT_UNAUTHORIZED: "0"
SSL_ENABLED: "true"
SSL_CERTIFICATE_PATH: /etc/onlyoffice/documentserver/ssl/server.crt
SSL_KEY_PATH: /etc/onlyoffice/documentserver/ssl/server.key
SSL_CA_CERTIFICATES_PATH: /etc/onlyoffice/documentserver/ssl/acs-ca.crt
NODE_EXTRA_CA_CERTS: /etc/onlyoffice/documentserver/ssl/acs-ca.crt
REQUESTS_CA_BUNDLE: /etc/onlyoffice/documentserver/ssl/acs-ca.crt
SSL_CERT_FILE: /etc/onlyoffice/documentserver/ssl/acs-ca.crt

volumes:
  - ${DOCKER_VOLUME_DIRECTORY:-.}/office/bisheng:/var/www/onlyoffice/documentserver/sdkjs-plugins/bisheng
  - ${DOCKER_VOLUME_DIRECTORY:-.}/office/default.json:/etc/onlyoffice/documentserver/default.json
  - ${DOCKER_VOLUME_DIRECTORY:-.}/office/ssl:/etc/onlyoffice/documentserver/ssl
command: >  
    bash -c "cp /etc/onlyoffice/documentserver/ssl/acs-ca.crt /usr/local/share/ca-certificates/acs-ca.crt &&
           update-ca-certificates &&
           supervisorctl restart all"
restart: on-failure

Below is my /etc/onlyoffice/documentserver/default.json configuration.
"requestDefaults": {
"headers": {
"User-Agent": "Node.js/6.13",
"Connection": "Keep-Alive"
},
"gzip": true,
"rejectUnauthorized": false
},
However, when I try to save it, I still get the following error:
[2025-11-06T12:43:04.309] [WARN] [localhost] [8f6af64bd7eb446ba976ad132ca0b367_1762432977063] [0011] nodeJS - sendServerRequest returned an error: data = {"status_code":500,"status_message":"HTTPSConnectionPool(host='172.16.20.112', port=30011): Max retries exceeded with url: /cache/files/data/8f6af64bd7eb446ba976ad132ca0b367_1762432977063_7541/output.docx/output.docx?md5=jgsql3FNLLwAgkULRnIaHQ&expires=1762433885&filename=output.docx (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1017)')))"}
I’ve really tried many different methods but still couldn’t solve it. Could you please take a look for me? Thank you.

Additional information

No response

Originally created by @gejixiang0521-pixel on GitHub (Nov 6, 2025). Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/833 ### This issue is unique. - [x] I have used the [search tool](https://github.com/ONLYOFFICE/DocumentServer/issues?q=) and did not find an issue describing my bug. ### Operating System of DocumentServer Docker ### Version information 7.2.1 ### Expected Behavior save success after edit ### Actual Behavior when I try to save it, I still get the following error: [2025-11-06T12:43:04.309] [WARN] [localhost] [8f6af64bd7eb446ba976ad132ca0b367_1762432977063] [0011] nodeJS - sendServerRequest returned an error: data = {"status_code":500,"status_message":"HTTPSConnectionPool(host='172.16.20.112', port=30011): Max retries exceeded with url: /cache/files/data/8f6af64bd7eb446ba976ad132ca0b367_1762432977063_7541/output.docx/output.docx?md5=jgsql3FNLLwAgkULRnIaHQ&expires=1762433885&filename=output.docx (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1017)')))"} ### Reproduction Steps I configured OnlyOffice to use HTTPS. Below is my docker-compose configuration. services: office: container_name: bisheng-office image: onlyoffice/documentserver:7.2.1 ports: - "30011:443" environment: TZ: Asia/Shanghai JWT_ENABLED: "false" NODE_TLS_REJECT_UNAUTHORIZED: "0" SSL_ENABLED: "true" SSL_CERTIFICATE_PATH: /etc/onlyoffice/documentserver/ssl/server.crt SSL_KEY_PATH: /etc/onlyoffice/documentserver/ssl/server.key SSL_CA_CERTIFICATES_PATH: /etc/onlyoffice/documentserver/ssl/acs-ca.crt NODE_EXTRA_CA_CERTS: /etc/onlyoffice/documentserver/ssl/acs-ca.crt REQUESTS_CA_BUNDLE: /etc/onlyoffice/documentserver/ssl/acs-ca.crt SSL_CERT_FILE: /etc/onlyoffice/documentserver/ssl/acs-ca.crt volumes: - ${DOCKER_VOLUME_DIRECTORY:-.}/office/bisheng:/var/www/onlyoffice/documentserver/sdkjs-plugins/bisheng - ${DOCKER_VOLUME_DIRECTORY:-.}/office/default.json:/etc/onlyoffice/documentserver/default.json - ${DOCKER_VOLUME_DIRECTORY:-.}/office/ssl:/etc/onlyoffice/documentserver/ssl command: > bash -c "cp /etc/onlyoffice/documentserver/ssl/acs-ca.crt /usr/local/share/ca-certificates/acs-ca.crt && update-ca-certificates && supervisorctl restart all" restart: on-failure Below is my /etc/onlyoffice/documentserver/default.json configuration. "requestDefaults": { "headers": { "User-Agent": "Node.js/6.13", "Connection": "Keep-Alive" }, "gzip": true, "rejectUnauthorized": false }, However, when I try to save it, I still get the following error: [2025-11-06T12:43:04.309] [WARN] [localhost] [8f6af64bd7eb446ba976ad132ca0b367_1762432977063] [0011] nodeJS - sendServerRequest returned an error: data = {"status_code":500,"status_message":"HTTPSConnectionPool(host='172.16.20.112', port=30011): Max retries exceeded with url: /cache/files/data/8f6af64bd7eb446ba976ad132ca0b367_1762432977063_7541/output.docx/output.docx?md5=jgsql3FNLLwAgkULRnIaHQ&expires=1762433885&filename=output.docx (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1017)')))"} I’ve really tried many different methods but still couldn’t solve it. Could you please take a look for me? Thank you. ### Additional information _No response_
kerem 2026-02-26 10:32:23 +03:00
  • closed this issue
  • added the
    question
    label
Author
Owner

@igwyd commented on GitHub (Nov 7, 2025):

Hello @gejixiang0521-pixel. Your image version is too old; it doesn't support self-signed certificate with variables like NODE_EXTRA_CA_CERTS. Please use version 9.1.0 and use our supported Available Configuration Parameters.

<!-- gh-comment-id:3501771061 --> @igwyd commented on GitHub (Nov 7, 2025): Hello @gejixiang0521-pixel. Your image version is too old; it doesn't support self-signed certificate with variables like `NODE_EXTRA_CA_CERTS`. Please use version 9.1.0 and use our supported [Available Configuration Parameters](https://github.com/ONLYOFFICE/Docker-DocumentServer?tab=readme-ov-file#available-configuration-parameters).
Author
Owner

@gejixiang0521-pixel commented on GitHub (Nov 25, 2025):

Hello @gejixiang0521-pixel. Your image version is too old; it doesn't support self-signed certificate with variables like NODE_EXTRA_CA_CERTS. Please use version 9.1.0 and use our supported Available Configuration Parameters.

Thanks for your reply. I’d still like to stick with version 7.2.1 for now.

If we configure our own frontend and OnlyOffice with HTTPS on the default 443 port, document editing and saving work fine. However, port 443 is sensitive in our environment. Our frontend service is deployed on port 30008.

Is there a way to configure OnlyOffice so that it also serves HTTPS on port 30008 instead of 443?

<!-- gh-comment-id:3575199649 --> @gejixiang0521-pixel commented on GitHub (Nov 25, 2025): > Hello [@gejixiang0521-pixel](https://github.com/gejixiang0521-pixel). Your image version is too old; it doesn't support self-signed certificate with variables like `NODE_EXTRA_CA_CERTS`. Please use version 9.1.0 and use our supported [Available Configuration Parameters](https://github.com/ONLYOFFICE/Docker-DocumentServer?tab=readme-ov-file#available-configuration-parameters). Thanks for your reply. I’d still like to stick with version 7.2.1 for now. If we configure our own frontend and OnlyOffice with HTTPS on the default 443 port, document editing and saving work fine. However, port 443 is sensitive in our environment. Our frontend service is deployed on port 30008. Is there a way to configure OnlyOffice so that it also serves HTTPS on port 30008 instead of 443?
Author
Owner

@gejixiang0521-pixel commented on GitHub (Nov 25, 2025):

Hello @gejixiang0521-pixel. Your image version is too old; it doesn't support self-signed certificate with variables like NODE_EXTRA_CA_CERTS. Please use version 9.1.0 and use our supported Available Configuration Parameters.

If this limitation exists in 7.2.1, does a higher version of DocumentServer support changing the HTTPS service port?

Thanks again!

<!-- gh-comment-id:3575211923 --> @gejixiang0521-pixel commented on GitHub (Nov 25, 2025): > Hello [@gejixiang0521-pixel](https://github.com/gejixiang0521-pixel). Your image version is too old; it doesn't support self-signed certificate with variables like `NODE_EXTRA_CA_CERTS`. Please use version 9.1.0 and use our supported [Available Configuration Parameters](https://github.com/ONLYOFFICE/Docker-DocumentServer?tab=readme-ov-file#available-configuration-parameters). If this limitation exists in 7.2.1, does a higher version of DocumentServer support changing the HTTPS service port? Thanks again!
Author
Owner

@igwyd commented on GitHub (Nov 25, 2025):

Yes, this can be done using port mapping in Docker -p 30008:443. If you want to use self-signed certificates in the older version 7.2.1, then you need to disable server certificate verification -e USE_UNAUTHORIZED_STORAGE=true.

<!-- gh-comment-id:3575229152 --> @igwyd commented on GitHub (Nov 25, 2025): Yes, this can be done using port mapping in Docker `-p 30008:443`. If you want to use self-signed certificates in the older version 7.2.1, then you need to disable server certificate verification `-e USE_UNAUTHORIZED_STORAGE=true`.
Author
Owner

@igwyd commented on GitHub (Nov 25, 2025):

Changing the port is supported by any version, this is a Docker feature, not specific to our container.

<!-- gh-comment-id:3575254593 --> @igwyd commented on GitHub (Nov 25, 2025): Changing the port is supported by any version, this is a Docker feature, not specific to our container.
Author
Owner

@igwyd commented on GitHub (Nov 25, 2025):

But if you use your certificates, put them here https://github.com/ONLYOFFICE/Docker-DocumentServer?tab=readme-ov-file#running-onlyoffice-document-server-using-https

<!-- gh-comment-id:3575259599 --> @igwyd commented on GitHub (Nov 25, 2025): But if you use your certificates, put them here https://github.com/ONLYOFFICE/Docker-DocumentServer?tab=readme-ov-file#running-onlyoffice-document-server-using-https
Author
Owner

@bgox commented on GitHub (Nov 25, 2025):

But if you use your certificates, put them here https://github.com/ONLYOFFICE/Docker-DocumentServer?tab=readme-ov-file#running-onlyoffice-document-server-using-https

I observed that the content returned by the OnlyOffice API is shown in the image below.
Image
Image

Immediately afterward, when the frontend accesses the download link returned by the API, a cross-origin issue occurs, as shown in the image below.
Image

I have already added the parameter: -e USE_UNAUTHORIZED_STORAGE=true

How can I modify the port of the Editor.bin file download link returned by the OnlyOffice API?

<!-- gh-comment-id:3575389365 --> @bgox commented on GitHub (Nov 25, 2025): > But if you use your certificates, put them here https://github.com/ONLYOFFICE/Docker-DocumentServer?tab=readme-ov-file#running-onlyoffice-document-server-using-https I observed that the content returned by the OnlyOffice API is shown in the image below. <img width="1712" height="596" alt="Image" src="https://github.com/user-attachments/assets/433e2edc-4c16-475d-986a-94197581f5d8" /> <img width="1824" height="596" alt="Image" src="https://github.com/user-attachments/assets/fd6e2856-4020-4ef0-a579-8f4aa8e2278a" /> Immediately afterward, when the frontend accesses the download link returned by the API, a cross-origin issue occurs, as shown in the image below. <img width="1824" height="596" alt="Image" src="https://github.com/user-attachments/assets/65b5ca21-fe36-4887-96e1-5f6b2183d47e" /> I have already added the parameter: -e USE_UNAUTHORIZED_STORAGE=true How can I modify the port of the Editor.bin file download link returned by the OnlyOffice API?
Author
Owner

@igwyd commented on GitHub (Nov 25, 2025):

This is a different question, unrelated to certificate settings. To do this, you need to create a new issue.
If I understand correctly, you're writing your own integration, so you'll need to refer to our API documentation for that, framework examples https://api.onlyoffice.com/docs/docs-api/get-started/frontend-frameworks/ and language https://api.onlyoffice.com/docs/docs-api/samples/language-specific-examples/. But keep in mind that the documentation API have changed since 7.2.1, and you may not be able to made it for the older version. I recommend upgrading the documentserver to the last version.

<!-- gh-comment-id:3575452936 --> @igwyd commented on GitHub (Nov 25, 2025): This is a different question, unrelated to certificate settings. To do this, you need to create a new issue. If I understand correctly, you're writing your own integration, so you'll need to refer to our API documentation for that, framework examples https://api.onlyoffice.com/docs/docs-api/get-started/frontend-frameworks/ and language https://api.onlyoffice.com/docs/docs-api/samples/language-specific-examples/. But keep in mind that the documentation API have changed since 7.2.1, and you may not be able to made it for the older version. I recommend upgrading the documentserver to the last version.
Author
Owner

@gejixiang0521-pixel commented on GitHub (Nov 28, 2025):

This is a different question, unrelated to certificate settings. To do this, you need to create a new issue. If I understand correctly, you're writing your own integration, so you'll need to refer to our API documentation for that, framework examples https://api.onlyoffice.com/docs/docs-api/get-started/frontend-frameworks/ and language https://api.onlyoffice.com/docs/docs-api/samples/language-specific-examples/. But keep in mind that the documentation API have changed since 7.2.1, and you may not be able to made it for the older version. I recommend upgrading the documentserver to the last version.

We are a team, and we’ve already recompiled the image, which solved the issue.
Many thanks for your help!

<!-- gh-comment-id:3588417876 --> @gejixiang0521-pixel commented on GitHub (Nov 28, 2025): > This is a different question, unrelated to certificate settings. To do this, you need to create a new issue. If I understand correctly, you're writing your own integration, so you'll need to refer to our API documentation for that, framework examples https://api.onlyoffice.com/docs/docs-api/get-started/frontend-frameworks/ and language https://api.onlyoffice.com/docs/docs-api/samples/language-specific-examples/. But keep in mind that the documentation API have changed since 7.2.1, and you may not be able to made it for the older version. I recommend upgrading the documentserver to the last version. We are a team, and we’ve already recompiled the image, which solved the issue. Many thanks for your help!
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#400
No description provided.