Symptom

Users are unable to sign in to the mobile app against a self-hosted OpenProject instance. The app reports a TLS/certificate verification error or just an "Unable to sign" in error, even though the site opens normally in a web browser.

Possible cause

Your server is sending an incomplete certificate chain — only the server (leaf) certificate, without the intermediate CA certificate(s) that link it to a trusted root.

Web browsers often hide this problem: they can automatically download the missing intermediate certificate (via "AIA fetching") or reuse one they've cached from another site. Mobile app HTTP clients do not do this — they require the server to present the full chain during the TLS handshake. This is why the same server works in a browser but fails in the app.

This is a server configuration issue, not an app bug.

How to confirm

Test your server with one of the following:

• Online: Run SSL Labs Server Test (https://www.ssllabs.com/ssltest/analyze.html?d={YOUR_BASE_INSTANCE_URL_HERE}). If you see "Chain issues: Incomplete," this is your problem.

• Command line:
  openssl s_client -connect your-server.com:443 -servername your-server.com </dev/null
  Look at the Certificate chain section. If it lists only entry 0 (the leaf) with no intermediate entries (1, 2, …), or you see Verify return code: 21 (unable to verify the first certificate), the chain is incomplete.

How to fix

Reconfigure your web server to serve the full certificate chain (leaf certificate followed by the intermediate certificate(s)):

• nginx: Point ssl_certificate at a full-chain bundle, not the leaf-only file:
  cat your_domain.crt intermediate.crt > fullchain.crt
  (Order matters — leaf first, then intermediates.)

• Let's Encrypt / Certbot: Use fullchain.pem, not cert.pem.

• Apache: Provide the intermediate certificate(s) via SSLCertificateFile (bundle) or SSLCertificateChainFile on older versions.

• Load balancer / reverse proxy / CDN (AWS ALB, HAProxy, Cloudflare, IIS, etc.): Fill in the "intermediate certificate" field, which is often left empty.

After updating, re-run the SSL Labs test to confirm the chain issue is gone, then retry signing in from the app.