[Feature]: honor system user installed certificates

[audricd]

User problem

Hello,
(i am using this https://aur.archlinux.org/packages/nextcloud-native-bin)

on an environment i which i have my own CA (smallstepCA), i am not able to sign in to my nextcloud instance

my system does trust root ca

[audric@portatinux ~]$ curl -v cloud.lab
* Host cloud.lab:80 was resolved.
* IPv6: (none)
* IPv4: 10.10.10.21
*   Trying 10.10.10.21:80...
* Established connection to cloud.lab (10.10.10.21 port 80) from 100.121.230.56 port 57776 
* using HTTP/1.x
> GET / HTTP/1.1
> Host: cloud.lab
> User-Agent: curl/8.22.0
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 308 Permanent Redirect
< Connection: close
< Location: https://cloud.lab/
< Server: Caddy
< Date: Thu, 17 Sep 2026 06:46:06 GMT
< Content-Length: 0
< 
* shutting down connection #0
[audric@portatinux ~]$ curl -v https://cloud.lab
* Host cloud.lab:443 was resolved.
* IPv6: (none)
* IPv4: 10.10.10.21
*   Trying 10.10.10.21:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=cloud.lab
*   start date: Nov 27 17:28:32 2025 GMT
*   expire date: Nov 27 17:29:32 2026 GMT
*   issuer: O=labaudriCA; CN=labaudriCA Intermediate CA
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
*   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
*   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
*   subjectAltName: "cloud.lab" matches cert's "cloud.lab"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to cloud.lab (10.10.10.21 port 443) from 100.121.230.56 port 38322 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://cloud.lab/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: cloud.lab]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.22.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: cloud.lab
> User-Agent: curl/8.22.0
> Accept: */*
> 
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 302 
< alt-svc: h3=":443"; ma=2592000
< content-security-policy: default-src 'self'; script-src 'self' 'nonce-roA9Hsvv6QtXTSANhFciXmk+Q5OYjgzTXkl6SklHcPY='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
< content-type: text/html; charset=UTF-8
< date: Thu, 17 Sep 2026 06:46:24 GMT
< location: https://cloud.lab/login
< referrer-policy: no-referrer
< set-cookie: oc_sessionPassphrase=OU8emy5Vtx92OA97pPXxRUVEDCKHcUPLmvmlrrjMAAuBQY4m3lhhMeLCyQf8UT68tNZFPh55q%2BeFycvICnDOwP%2FNQkNCU5IBH5FquMk2ebgzi%2FELD3az0NMMLApHidYu; path=/; secure; HttpOnly; SameSite=Lax
< set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
< set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
< set-cookie: ocp9r96rt3iz=320727de0c6d68bf798db460e86da465; path=/; secure; HttpOnly; SameSite=Lax
< strict-transport-security: max-age=31536000;
< via: 1.1 Caddy
< via: 1.1 Caddy
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-permitted-cross-domain-policies: none
< x-robots-tag: noindex, nofollow
< content-length: 0
< 
* Connection #0 to host cloud.lab:443 left intact

Desired native experience

same experience as on android client, which honor the system trusted CAs

Relevant Nextcloud apps or data models

32.0.2

Reusable semantics

No response

Protocol or open-source references

No response