Download failed in mobile browsers, it works in desktop. USE_UNAUTHORIZED doesn't work, only rejectUnauthorized.

[luisnabais]

Hello.

I'm using OnlyOffice in Docker and I'm getting the "Download failed" error, but only in mobile, in desktop browsers it works.
I'm using the image onlyoffice/documentserver:8.3.1.1.

I'm not using self-signed certificates, I'm using valid LE certificates (fullchain/key pair), which resolve successfully using curl in internal network and inside containers, without using -k flag.

Adding USE_UNAUTHORIZED_STORAGE as truedoesn't work, but changing rejectUnauthorized to false in defaults.json works, but as it's not a fixed solution (when I upgrade container it's lost), I believe the option USE_UNAUTHORIZED_STORAGE is somehow broken.

This is the docker compose yaml (cropped, just the essentials for this, but including all the variables):

services:
  onlyoffice:
    image: onlyoffice/documentserver:8.3.1.1
    environment:
      - DB_TYPE=${DB_TYPE}
      - DB_HOST=${DB_HOST}
      - DB_PORT=${DB_PORT}
      - DB_NAME=${DB_NAME}
      - DB_USER=${DB_USER}
      - JWT_SECRET=${JWT_SECRET}
      - USE_UNAUTHORIZED_STORAGE=true

Can you please check this?
Thank you.

[igwyd]

Hello @luisnabais, i don't think the issue is in the variable USE_UNAUTHORIZED_STORAGE. Show please the documentserver container log with error.

[luisnabais]

Hello @igwyd. Thanks for answering, but I get no errors in OnlyOffice documentserver container, when I open the file, regardless of opening successfully or not.
I've been searching about how to enable debug or something like that, but I cannot find it.
What can I do to help debug this?

[igwyd]

It looks like the issue is in specific mobile devices. As far as I know, mobile devices may have some issues with LE certificates https://stackoverflow.com/questions/78049111/android-devices-api-25-not-connecting-to-letsencrypt-ssl-servers-anymore

[luisnabais]

I tried multiple browsers in iOS, iPadOS and Android. The certificates are fully valid and tested. They work correctly in all my homelab apps. And I open the onlyoffice container website without issues, with valid certificate on the same browsers. It's the same URL, same certificate.
I really do not believe that is the issue here... And then, why would the option rejectUnauthorized set to false works?

[igwyd]

I checked USE_UNAUTHORIZED_STORAGE with my test self-signed certificates, it works, that's what it does - it sets rejectUnauthorized to false overrides this parameter in /etc/onlyoffice/documentserver/local.json.
Perhaps there is a typo in docker-compose.yml?

[luisnabais]

That's exactly what I'm saying from the beginning.

Why is rejectUnauthorized set to false working, but not USE_UNAUTHORIZED_STORAGE to true, when my certificates are letsencrypt (not self-signed), perfectly valid?
That's why I'm asking for help. Is it something not being contemplated in USE_UNAUTHORIZED_STORAGE, which rejectUnauthorized does?
What can we do to debug this?

Thanks a lot for your time and help.

[igwyd]

What can we do to debug this?

lets try. Do I understand correctly that if you set rejectUnauthorized: false in the /etc/onlyoffice/documentserver/default.json manually inside the container, the editors open without errors on mobile devices?
But if you set USE_UNAUTHORIZED_STORAGE=true in docker-compose.yml (without manually changing rejectUnauthorized to false in the default.json), the editors work in PC desktop browser but not on mobile devices?

[luisnabais]

What can we do to debug this?

lets try. Do I understand correctly that if you set rejectUnauthorized: false in the /etc/onlyoffice/documentserver/default.json manually inside the container, the editors open without errors on mobile devices? But if you set USE_UNAUTHORIZED_STORAGE=true in docker-compose.yml (without manually changing rejectUnauthorized to false in the default.json), the editors work in PC desktop browser but not on mobile devices?

Exactly.
USE_UNAUTHORIZED_STORAGE=true in docker-compose.yml doesn't work, only rejectUnauthorized set to false in /etc/onlyoffice/documentserver/default.json works.

Here is docker-compose.yml:

version: '3.2'

services:
  onlyoffice:
    image: onlyoffice/documentserver:8.3.1.1
    container_name: onlyoffice
    hostname: onlyoffice
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Lisbon
      - DB_TYPE=${DB_TYPE}
      - DB_HOST=${DB_HOST}
      - DB_PORT=${DB_PORT}
      - DB_NAME=${DB_NAME}
      - DB_USER=${DB_USER}
      - JWT_SECRET=${JWT_SECRET}
      - USE_UNAUTHORIZED_STORAGE=true
    volumes:
      - /data/docker_volumes/onlyoffice_data:/var/www/onlyoffice/Data
    networks:
      - traefik
    labels:
      - traefik.http.routers.onlyoffice.tls=true
      - traefik.http.services.onlyoffice.loadbalancer.server.port=80
    restart: unless-stopped
    healthcheck:
      test: curl -sSf http://127.0.0.1/healthcheck &>/dev/null || exit 1
      start_period: 60s
      interval: 5s
      timeout: 10s
      retries: 3

networks:
  traefik:
    external: true

[igwyd]

Unfortunately we still don't have an approved configuration for proxy traefik 2+ version (We have only for old version 1) ONLYOFFICE/DocumentServer#2162, issue may be here. Could you try with another proxy server? Nginx for example, here our configs https://helpcenter.onlyoffice.com/installation/docs-community-proxy.aspx