Nextcloud treats transport security as a measurable property of the deployment, not a one-time checkbox. The Administration overview page at /settings/admin/overview actively scans how your site answers over HTTPS and reports warnings when the HTTP Strict Transport Security header is missing, when the certificate chain is incomplete, or when the server advertises outdated TLS protocols. On a Managed Cloud shared plan running LiteSpeed on AlmaLinux and CloudLinux, you cannot touch the global TLS configuration, the OpenSSL library, or the virtual host template. What you can control is the certificate issued to your domain, the response headers emitted through .htaccess, and the way Nextcloud itself interprets the connection. This guide works entirely inside those boundaries and focuses on the security-hardening warnings that appear after basic HTTPS already works.

Certificate issuance, chain completeness, and renewal cadence

LiteSpeed serves whatever certificate the panel has installed for the domain, and on Hostiso that certificate is normally provisioned automatically. In cPanel Jupiter, open Security \u2192 SSL/TLS Status. Each domain and subdomain is listed with its coverage state, and the Run AutoSSL button forces an immediate check rather than waiting for the scheduled run. In DirectAdmin Evolution the equivalent lives under Account Manager \u2192 SSL Certificates, where selecting Free & automatic certificate from ACME provider and ticking every hostname you use for Nextcloud issues and installs the certificate in one action.

A frequent source of Nextcloud's \"certificate chain is incomplete\" warning is a missing intermediate. AutoSSL and the DirectAdmin ACME client install the full chain by default, but a certificate that was once pasted manually under SSL/TLS \u2192 Install and Manage SSL for your site (HTTPS) may contain only the leaf. If the overview page complains, delete the manual certificate for that host and re-run AutoSSL so the panel rebuilds the chain from the CA bundle it maintains. You can confirm the result from any external SSL checker, but the panel's own status column turning green is the authoritative signal on this stack.

Renewal is handled by the server, not by you, and there is no cron entry you need to create. AutoSSL re-checks roughly every day and renews certificates well before the Let's Encrypt ninety-day expiry, typically around the thirty-day mark. The one condition that breaks silent renewal is a domain validation failure: if a custom .htaccess rule blocks the /.well-known/acme-challenge/ path, the ACME HTTP-01 check cannot complete and the certificate quietly lapses. Keep any top-of-file redirects from interfering by excluding that path, which the ruleset in the next section handles explicitly.

Emitting HSTS and security headers through .htaccess

Nextcloud specifically wants the Strict-Transport-Security header with a long max-age so browsers refuse to downgrade to plain HTTP. Because you cannot edit the LiteSpeed virtual host, the correct place to add it is the .htaccess in your document root \u2014 typically /home/USERNAME/public_html/.htaccess or the subdomain's own root such as /home/USERNAME/cloud/.htaccess. Open Files \u2192 File Manager in cPanel (or System Info & Files \u2192 File Manager in DirectAdmin), enable Show Hidden Files (dotfiles) from the settings gear, and edit the file. Nextcloud writes its own managed block between # Nextcloud markers; place your header block above that block so your rules survive occ maintenance:repair rewrites.

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "no-referrer"
  Header always set X-Permitted-Cross-Domain-Policies "none"
  Header always set X-Robots-Tag "noindex, nofollow"
</IfModule>

A max-age of 15552000 seconds is 180 days, which matches Nextcloud's recommended minimum and clears the overview warning. Avoid adding the preload directive until you are certain every subdomain under the apex will serve HTTPS permanently, because preloading is difficult to reverse and is baked into browsers for long periods. If you also need to force HTTPS at the edge, pair the header with a canonical redirect that leaves the ACME path untouched:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

On LiteSpeed, mod_headers and mod_rewrite directives in .htaccess are honored through the server's Apache-compatibility layer, so no module loading is required on your part. After saving, hard-refresh the browser and reload /settings/admin/overview to confirm the HSTS warning disappears.

TLS protocol versions, overwriteprotocol, and PHP cURL trust

The overview scanner sometimes reports that outdated TLS versions such as 1.0 or 1.1 are still offered. The protocol list is a server-wide LiteSpeed setting you cannot change from a hosting account, so the practical path is a support request asking Hostiso to confirm the TLS floor is 1.2. Modern AlmaLinux images already negotiate TLS 1.2 and 1.3 and reject the deprecated versions, so in most cases this warning reflects a stale scan rather than a live weakness. Re-running the integrity check or clearing Nextcloud's cache often resolves a phantom report.

Nextcloud's own view of the connection matters as much as the wire protocol. If your plan places LiteSpeed behind an internal proxy or a CDN, PHP may see an http request internally even though the browser spoke HTTPS, which produces mixed-content asset URLs and login loops. The fix lives in File Manager at /home/USERNAME/nextcloud/config/config.php. Add the keys that tell Nextcloud to trust the forwarded protocol and the proxy that set it, using the private ranges your panel reports under the account's network details:

'overwriteprotocol' => 'https',
'overwrite.cli.url' => 'https://cloud.example.com',
'trusted_proxies' => array('10.0.0.0/8'),
'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),

Set trusted_proxies only to addresses you have confirmed, because trusting an overly broad range lets a client forge the forwarded header. Leave it absent if your plan terminates TLS directly on LiteSpeed with no intermediate hop.

Outbound TLS is a separate concern that surfaces when Nextcloud contacts update servers, app stores, or external storage. If background jobs log cURL error 60: SSL certificate problem in /home/USERNAME/nextcloud/data/nextcloud.log, the PHP build is missing an up-to-date CA bundle. Switch the active interpreter under cPanel's MultiPHP Manager or the CloudLinux Select PHP Version tool (DirectAdmin exposes the same selector) to a current release such as PHP 8.2 or 8.3, confirm the curl and openssl extensions are enabled, and set the CA path through a .user.ini in the document root:

openssl.cafile = /etc/ssl/certs/ca-bundle.crt
curl.cainfo = /etc/ssl/certs/ca-bundle.crt

The .user.ini is read per-directory by PHP, so it takes effect without any server-level change; allow a few minutes for the setting to propagate or touch the file again to reset the cache timer. This same TLS-trust pattern applies to any PHP application that makes outbound HTTPS calls, including the gateway callbacks described in our Moodle payments and cURL/TLS guide.

Once the certificate chain is complete, HSTS is advertised, the redirect spares the ACME path, and PHP trusts both the inbound proxy and the outbound CA bundle, the Nextcloud overview page should return a clean security report. Re-run the scan after each change so you can attribute any remaining warning to a single edit rather than guessing across several.