I just talked to IONOS support and I also got an email from them with some explanation, i do not understand in detail.
Maybe it also effects the central core, I decided to post this for your information. This is not a request for help! ;-)
--- translated from german to english ---
Hello Seb,
Thank you very much for the friendly phone call.
The IONOS servers were updated (from Debian 11 to Debian 13), which also updated the OpenSSL library. The OpenSSL library is responsible for encrypted communication.
It appears that the service at login.microsoftonline.com is having an issue with the updated OpenSSL library. Encryption cannot be set up properly. As a result, a 404 error is returned. This error has also been detected by other third-party providers. (1)
The obvious solution would be to patch the Microsoft server accordingly. However, this falls outside of IONOS’s scope of responsibility.
The “curl” command can be modified to prevent encryption failure.
This option uses only algorithms that were already available before the update:
“--curves “X25519:secp256r1:X448:secp384r1:secp521r1””
This option uses HTTP/1.1 instead of HTTP/2.0:
--no-alpn
Both options work.
In a PHP script that connects to login.microsoftonline.com using curl(), you can avoid the vulnerability by setting the curl option CURLOPT_SSL_ENABLE_ALPN to false.
curl_setopt($ch, CURLOPT_SSL_ENABLE_ALPN, false);
The options are therefore:
Contact your Microsoft representative to have the service patched.
Contact the provider of your website software to have the PHP code patched.
Currently, IONOS does not have any measures available to resolve the issue with login.microsoftonline.com.
(1) https://github.com/nextcloud/docker/issues/2560#issuecomment-4418929488
I very much regret that I cannot offer you any other solution.
Best regards
--- end ---
Greetings, Seb
