Repository: owncloud/ocis
Pull request #4781 (2022-10-11 10:17:03)

Nats tls
<!--
Thanks for submitting a change to ownCloud!

This is the bug tracker for the oCIS component. Find other components at https://github.com/owncloud/core/blob/master/.github/CONTRIBUTING.md#guidelines

For fixing potential security issues please see https://owncloud.org/security/

To make it possible for us to get your change reviewed and merged please carefully fill out the requested information below.

Please note that any kind of change needs first be submitted to the master branch which holds the next version of oCIS.

Please set the following labels:

- Set label "Status:Needs-Review" for review or "Status:In-Progress" if the PR still has open tasks.
- Assignment: assign to self
- Reviewers: pick at least one
-->

## Description
<!--- Describe your changes in detail -->
Enable TLS encryption for the connection between the nats server and clients.
The server can either use provided certificates, or if the certificate file doesn't exist, a self-signed certificate will be generated.


## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
In a production deployment no connection between servers should be unencrypted.

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] New feature (non-breaking change which adds functionality)

## Checklist:
<!-- Tick the checkboxes when done. -->
<!-- Raise documentation ticket in owncloud.github.io/ -->
- [x] Code changes

## Todo before ready:
- [x] remove reva replace (requires this https://github.com/cs3org/reva/pull/3334)
- [x] add changelog 


update-docs[bot]: Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a [changelog](https://github.com/owncloud/ocis/blob/master/changelog/README.md) item based on your changes.

sonarcloud[bot]: SonarCloud Quality Gate failed.&nbsp; &nbsp; [![Quality Gate failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/failed-16px.png 'Quality Gate failed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=4781)

[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=BUG) [![C](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/C-16px.png 'C')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=BUG) [1 Bug](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=BUG)  
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4781&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4781&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=4781&resolved=false&types=SECURITY_HOTSPOT)  
[![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=4781&resolved=false&types=CODE_SMELL)

[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/0-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4781&metric=new_coverage&view=list) [0.0% Coverage](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4781&metric=new_coverage&view=list)  
[![1.6%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '1.6%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4781&metric=new_duplicated_lines_density&view=list) [1.6% Duplication](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=4781&metric=new_duplicated_lines_density&view=list)


ownclouders: :boom: Acceptance test [<strong>Core-API-Tests-ocis-storage-6</strong>](https://drone.owncloud.com/owncloud/ocis/16015/52/1) failed. Further test are cancelled...
<!-- id: pr-4781 -->

ownclouders: :boom: Acceptance test [<strong>localApiTests-apiAccountsHashDifficulty-ocis</strong>](https://drone.owncloud.com/owncloud/ocis/16015/42/1) failed. Further test are cancelled...
<!-- id: pr-4781 -->

ownclouders: :boom: Acceptance test [<strong>cs3ApiTests-ocis</strong>](https://drone.owncloud.com/owncloud/ocis/16015/41/1) failed. Further test are cancelled...
<!-- id: pr-4781 -->

ownclouders: :boom: Acceptance test [<strong>localApiTests-apiGraph-ocis</strong>](https://drone.owncloud.com/owncloud/ocis/16015/46/1) failed. Further test are cancelled...
<!-- id: pr-4781 -->

ownclouders: :boom: Acceptance test [<strong>Core-API-Tests-ocis-storage-4</strong>](https://drone.owncloud.com/owncloud/ocis/16015/50/1) failed. Further test are cancelled...
<!-- id: pr-4781 -->


Patch:
diff --git a/.drone.env b/.drone.env
index dcc45022977..3971384b8fd 100644
--- a/.drone.env
+++ b/.drone.env
@@ -3,5 +3,5 @@ CORE_COMMITID=ddd3b90f4aea35a459a6fedf78a9bcf110dc3303
 CORE_BRANCH=master
 
 # The test runner source for UI tests
-WEB_COMMITID=283eb8eebcfbcdce76198f76d465c73e3094ba8b
+WEB_COMMITID=c8c69113bc7987d6f14e32e5f1e7bd1b5491b1d9
 WEB_BRANCH=master
diff --git a/.drone.star b/.drone.star
index 8efd2e8fdde..4e184314649 100644
--- a/.drone.star
+++ b/.drone.star
@@ -1889,6 +1889,11 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes = [], depends_on =
             "IDM_CREATE_DEMO_USERS": True,
             "IDM_ADMIN_PASSWORD": "admin",  # override the random admin password from `ocis init`
             "FRONTEND_SEARCH_MIN_LENGTH": "2",
+            "AUDIT_EVENTS_TLS_INSECURE": True,
+            "GRAPH_EVENTS_TLS_INSECURE": True,
+            "NOTIFICATIONS_EVENTS_TLS_INSECURE": True,
+            "SEARCH_EVENTS_TLS_INSECURE": True,
+            "NATS_TLS_SKIP_VERIFY_CLIENT_CERT": True,
         }
         wait_for_ocis = {
             "name": "wait-for-ocis-server",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d85d609fb32..bbde24fd304 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@ The following sections list the changes for unreleased.
 * Enhancement - Report parent id: [#4757](https://github.com/owncloud/ocis/pull/4757)
 * Enhancement - Add thumbnails support for tiff and bmp files: [#4634](https://github.com/owncloud/ocis/pull/4634)
 * Enhancement - Update reva: [#4588](https://github.com/owncloud/ocis/pull/4588)
+* Enhancement - Update ownCloud Web to v6.0.0-rc.2: [#4786](https://github.com/owncloud/ocis/pull/4786)
 * Enhancement - Make it possible to configure a WOPI folderurl: [#4716](https://github.com/owncloud/ocis/pull/4716)
 
 ## Details
@@ -215,6 +216,82 @@ The following sections list the changes for unreleased.
    https://github.com/owncloud/ocis/pull/4719
    https://github.com/owncloud/ocis/pull/4750
 
+* Enhancement - Update ownCloud Web to v6.0.0-rc.2: [#4786](https://github.com/owncloud/ocis/pull/4786)
+
+   Tags: web
+
+   We updated ownCloud Web to v6.0.0-rc.2. Please refer to the changelog (linked) for details on
+   the web release.
+
+   ### Breaking changes * BREAKING CHANGE for users in
+   [owncloud/web#6648](https://github.com/owncloud/web/issues/6648): breaks existing
+   bookmarks - they won't resolve anymore. * BREAKING CHANGE for developers in
+   [owncloud/web#6648](https://github.com/owncloud/web/issues/6648): the appDefaults
+   composables from web-pkg now work with drive aliases, concatenated with relative item paths,
+   instead of webdav paths. If you use the appDefaults composables in your application it's
+   likely that your code needs to be adapted.
+
+   ### Changes * Bugfix
+   [owncloud/web#7419](https://github.com/owncloud/web/issues/7419): Add language
+   param opening external app * Bugfix
+   [owncloud/web#7731](https://github.com/owncloud/web/pull/7731): "Copy
+   Quicklink"-translations * Bugfix
+   [owncloud/web#7652](https://github.com/owncloud/web/pull/7652): Disable copy/move
+   overwrite on self * Bugfix
+   [owncloud/web#7739](https://github.com/owncloud/web/pull/7739): Disable shares
+   loading on public and trash locations * Bugfix
+   [owncloud/web#7740](https://github.com/owncloud/web/pull/7740): Disappearing
+   quicklink in sidebar * Bugfix
+   [owncloud/web#7734](https://github.com/owncloud/web/pull/7734): File name
+   reactivity * Bugfix [owncloud/web#7724](https://github.com/owncloud/web/pull/7724):
+   Folder conflict dialog * Bugfix
+   [owncloud/web#7652](https://github.com/owncloud/web/pull/7652): Inhibit move files
+   between spaces * Bugfix
+   [owncloud/web#7640](https://github.com/owncloud/web/pull/7640): "Private
+   link"-button alignment * Bugfix
+   [owncloud/web#7748](https://github.com/owncloud/web/pull/7748): Reload file list
+   after last share removal * Bugfix
+   [owncloud/web#7699](https://github.com/owncloud/web/issues/7699): Remove the "close
+   sidebar"-calls on delete * Bugfix
+   [owncloud/web#7504](https://github.com/owncloud/web/pull/7504): Resolve upload
+   existing folder * Bugfix
+   [owncloud/web#7675](https://github.com/owncloud/web/pull/7675): Search bar on small
+   screens * Bugfix [owncloud/web#7662](https://github.com/owncloud/web/pull/7662):
+   Sidebar for received shares in search file list * Bugfix
+   [owncloud/web#7506](https://github.com/owncloud/web/issues/7506): Shares loading *
+   Bugfix [owncloud/web#7632](https://github.com/owncloud/web/pull/7632): Sidebar
+   toggle icon * Bugfix [owncloud/web#7756](https://github.com/owncloud/web/pull/7756):
+   Try to obtain refresh token before the error case * Bugfix
+   [owncloud/web#7651](https://github.com/owncloud/web/pull/7651): Spaces on "Shared
+   via link"-page * Bugfix
+   [owncloud/web#7521](https://github.com/owncloud/web/issues/7521): Spaces
+   reactivity on update * Bugfix
+   [owncloud/web#7630](https://github.com/owncloud/web/pull/7630): Upload modify time *
+   Change [owncloud/web#6648](https://github.com/owncloud/web/issues/6648): Drive
+   aliases in URLs * Enhancement
+   [owncloud/web#7709](https://github.com/owncloud/web/pull/7709): Edit custom
+   permissions wording * Enhancement
+   [owncloud/web#7190](https://github.com/owncloud/web/pull/7190): Deny subfolders
+   inside share * Enhancement
+   [owncloud/web#7684](https://github.com/owncloud/web/pull/7684): Design polishing *
+   Enhancement [owncloud/web#7725](https://github.com/owncloud/web/pull/7725): Enable
+   renaming on received shares * Enhancement
+   [owncloud/web#7747](https://github.com/owncloud/web/pull/7747): Friendlier logout
+   screen * Enhancement
+   [owncloud/web#6247](https://github.com/owncloud/web/issues/6247): Id based routing *
+   Enhancement [owncloud/web#7405](https://github.com/owncloud/web/pull/7405):
+   Resolve internal links * Enhancement
+   [owncloud/web#7569](https://github.com/owncloud/web/pull/7569): Make keybindings
+   global * Enhancement
+   [owncloud/web#7405](https://github.com/owncloud/web/pull/7405): Resolve private
+   links * Enhancement [owncloud/web#7684](https://github.com/owncloud/web/pull/7684):
+   Update ODS to v14.0.0-alpha.20 * Enhancement
+   [owncloud/web#7430](https://github.com/owncloud/web/pull/7430): Webdav support in
+   web-client package
+
+   https://github.com/owncloud/ocis/pull/4786
+   https://github.com/owncloud/web/releases/tag/v6.0.0-rc.2
+
 * Enhancement - Make it possible to configure a WOPI folderurl: [#4716](https://github.com/owncloud/ocis/pull/4716)
 
    The wopi folder URL is used to jump back from an application to the containing folder in the files
diff --git a/changelog/unreleased/nats-tls.md b/changelog/unreleased/nats-tls.md
new file mode 100644
index 00000000000..f392f6778d8
--- /dev/null
+++ b/changelog/unreleased/nats-tls.md
@@ -0,0 +1,5 @@
+Enhancement: Secure the nats connectin with TLS
+
+Encyrpted the connection to the event broker using TLS.
+
+https://github.com/owncloud/ocis/pull/4781
diff --git a/changelog/unreleased/update-web-6.0.0-rc.2.md b/changelog/unreleased/update-web-6.0.0-rc.2.md
new file mode 100644
index 00000000000..53513430d8d
--- /dev/null
+++ b/changelog/unreleased/update-web-6.0.0-rc.2.md
@@ -0,0 +1,46 @@
+Enhancement: Update ownCloud Web to v6.0.0-rc.2
+
+Tags: web
+
+We updated ownCloud Web to v6.0.0-rc.2. Please refer to the changelog (linked) for details on the web release.
+
+### Breaking changes
+* BREAKING CHANGE for users in [owncloud/web#6648](https://github.com/owncloud/web/issues/6648): breaks existing bookmarks - they won't resolve anymore.
+* BREAKING CHANGE for developers in [owncloud/web#6648](https://github.com/owncloud/web/issues/6648): the appDefaults composables from web-pkg now work with drive aliases, concatenated with relative item paths, instead of webdav paths. If you use the appDefaults composables in your application it's likely that your code needs to be adapted.
+
+### Changes
+* Bugfix [owncloud/web#7419](https://github.com/owncloud/web/issues/7419): Add language param opening external app
+* Bugfix [owncloud/web#7731](https://github.com/owncloud/web/pull/7731): "Copy Quicklink"-translations
+* Bugfix [owncloud/web#7652](https://github.com/owncloud/web/pull/7652): Disable copy/move overwrite on self
+* Bugfix [owncloud/web#7739](https://github.com/owncloud/web/pull/7739): Disable shares loading on public and trash locations
+* Bugfix [owncloud/web#7740](https://github.com/owncloud/web/pull/7740): Disappearing quicklink in sidebar
+* Bugfix [owncloud/web#7734](https://github.com/owncloud/web/pull/7734): File name reactivity
+* Bugfix [owncloud/web#7724](https://github.com/owncloud/web/pull/7724): Folder conflict dialog
+* Bugfix [owncloud/web#7652](https://github.com/owncloud/web/pull/7652): Inhibit move files between spaces
+* Bugfix [owncloud/web#7640](https://github.com/owncloud/web/pull/7640): "Private link"-button alignment
+* Bugfix [owncloud/web#7748](https://github.com/owncloud/web/pull/7748): Reload file list after last share removal
+* Bugfix [owncloud/web#7699](https://github.com/owncloud/web/issues/7699): Remove the "close sidebar"-calls on delete
+* Bugfix [owncloud/web#7504](https://github.com/owncloud/web/pull/7504): Resolve upload existing folder
+* Bugfix [owncloud/web#7675](https://github.com/owncloud/web/pull/7675): Search bar on small screens
+* Bugfix [owncloud/web#7662](https://github.com/owncloud/web/pull/7662): Sidebar for received shares in search file list
+* Bugfix [owncloud/web#7506](https://github.com/owncloud/web/issues/7506): Shares loading
+* Bugfix [owncloud/web#7632](https://github.com/owncloud/web/pull/7632): Sidebar toggle icon
+* Bugfix [owncloud/web#7756](https://github.com/owncloud/web/pull/7756): Try to obtain refresh token before the error case
+* Bugfix [owncloud/web#7651](https://github.com/owncloud/web/pull/7651): Spaces on "Shared via link"-page
+* Bugfix [owncloud/web#7521](https://github.com/owncloud/web/issues/7521): Spaces reactivity on update
+* Bugfix [owncloud/web#7630](https://github.com/owncloud/web/pull/7630): Upload modify time
+* Change [owncloud/web#6648](https://github.com/owncloud/web/issues/6648): Drive aliases in URLs
+* Enhancement [owncloud/web#7709](https://github.com/owncloud/web/pull/7709): Edit custom permissions wording
+* Enhancement [owncloud/web#7190](https://github.com/owncloud/web/pull/7190): Deny subfolders inside share
+* Enhancement [owncloud/web#7684](https://github.com/owncloud/web/pull/7684): Design polishing
+* Enhancement [owncloud/web#7725](https://github.com/owncloud/web/pull/7725): Enable renaming on received shares
+* Enhancement [owncloud/web#7747](https://github.com/owncloud/web/pull/7747): Friendlier logout screen
+* Enhancement [owncloud/web#6247](https://github.com/owncloud/web/issues/6247): Id based routing
+* Enhancement [owncloud/web#7405](https://github.com/owncloud/web/pull/7405): Resolve internal links
+* Enhancement [owncloud/web#7569](https://github.com/owncloud/web/pull/7569): Make keybindings global
+* Enhancement [owncloud/web#7405](https://github.com/owncloud/web/pull/7405): Resolve private links
+* Enhancement [owncloud/web#7684](https://github.com/owncloud/web/pull/7684): Update ODS to v14.0.0-alpha.20
+* Enhancement [owncloud/web#7430](https://github.com/owncloud/web/pull/7430): Webdav support in web-client package
+
+https://github.com/owncloud/ocis/pull/4786
+https://github.com/owncloud/web/releases/tag/v6.0.0-rc.2
diff --git a/go.mod b/go.mod
index af56462a54d..641ecbf28e7 100644
--- a/go.mod
+++ b/go.mod
@@ -9,8 +9,8 @@ require (
 	github.com/armon/go-radix v1.0.0
 	github.com/blevesearch/bleve/v2 v2.3.4
 	github.com/coreos/go-oidc/v3 v3.4.0
-	github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c
-	github.com/cs3org/reva/v2 v2.10.1-0.20221006145249-70bf0e95ec00
+	github.com/cs3org/go-cs3apis v0.0.0-20221005085457-19ea8088a512
+	github.com/cs3org/reva/v2 v2.10.1-0.20221012104058-ae7c58b9bffa
 	github.com/disintegration/imaging v1.6.2
 	github.com/ggwhite/go-masker v1.0.9
 	github.com/go-chi/chi/v5 v5.0.7
diff --git a/go.sum b/go.sum
index 4263fdcde2a..07c599ba8c5 100644
--- a/go.sum
+++ b/go.sum
@@ -293,10 +293,10 @@ github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo
 github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
 github.com/crewjam/saml v0.4.6 h1:XCUFPkQSJLvzyl4cW9OvpWUbRf0gE7VUpU8ZnilbeM4=
 github.com/crewjam/saml v0.4.6/go.mod h1:ZBOXnNPFzB3CgOkRm7Nd6IVdkG+l/wF+0ZXLqD96t1A=
-github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c h1:b+YTmOGlf43mnF8MzO0fsy8/Ho8JLu44Iq5Y0fKLJMM=
-github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
-github.com/cs3org/reva/v2 v2.10.1-0.20221006145249-70bf0e95ec00 h1:cmXDi1Uv/96k8lv7/mWShKIMd4cvOqmhtbrXtVxz+uM=
-github.com/cs3org/reva/v2 v2.10.1-0.20221006145249-70bf0e95ec00/go.mod h1:UQVMlPZtcoPXLZSJ4ZRTruzn6PlRVmpEantwf1wGknU=
+github.com/cs3org/go-cs3apis v0.0.0-20221005085457-19ea8088a512 h1:xTvaIsLu1ezoWOJKnV0ehgiowkOiEhMaylaI1lD/Axw=
+github.com/cs3org/go-cs3apis v0.0.0-20221005085457-19ea8088a512/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
+github.com/cs3org/reva/v2 v2.10.1-0.20221012104058-ae7c58b9bffa h1:DSeaakiPW5zYrGGEDO0BkSZWhqq6LS+rd1DQ1DPztJo=
+github.com/cs3org/reva/v2 v2.10.1-0.20221012104058-ae7c58b9bffa/go.mod h1:QUHLTf/ACFG2ueNP3u1dslv1bIWTTQAqvWFCorVke6o=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
diff --git a/ocis-pkg/crypto/crypto.go b/ocis-pkg/crypto/crypto.go
new file mode 100644
index 00000000000..170d76182db
--- /dev/null
+++ b/ocis-pkg/crypto/crypto.go
@@ -0,0 +1,28 @@
+// Package crypto implements utility functions for handling crypto related files.
+package crypto
+
+import (
+	"bytes"
+	"crypto/x509"
+	"errors"
+	"io"
+)
+
+// NewCertPoolFromPEM reads certificates from io.Reader and returns a x509.CertPool
+// containing those certificates.
+func NewCertPoolFromPEM(crts ...io.Reader) (*x509.CertPool, error) {
+	certPool := x509.NewCertPool()
+
+	var buf bytes.Buffer
+	for _, c := range crts {
+		if _, err := io.Copy(&buf, c); err != nil {
+			return nil, err
+		}
+		if !certPool.AppendCertsFromPEM(buf.Bytes()) {
+			return nil, errors.New("failed to append cert from PEM")
+		}
+		buf.Reset()
+	}
+
+	return certPool, nil
+}
diff --git a/ocis-pkg/log/log.go b/ocis-pkg/log/log.go
index 14a89d5ea85..0c3ea4632e9 100644
--- a/ocis-pkg/log/log.go
+++ b/ocis-pkg/log/log.go
@@ -53,6 +53,11 @@ func LoggerFromConfig(name string, cfg *shared.Log) Logger {
 	)
 }
 
+// NopLogger initializes a no-operation logger.
+func NopLogger() Logger {
+	return Logger{zerolog.Nop()}
+}
+
 // NewLogger initializes a new logger instance.
 func NewLogger(opts ...Option) Logger {
 	options := newOptions(opts...)
diff --git a/ocis-pkg/registry/registry.go b/ocis-pkg/registry/registry.go
index 8cbe6b38922..6f048e44889 100644
--- a/ocis-pkg/registry/registry.go
+++ b/ocis-pkg/registry/registry.go
@@ -69,7 +69,7 @@ func GetRegistry() registry.Registry {
 			reg = mdnsr.NewRegistry()
 		}
 		// No cache needed for in-memory registry
-		if plugin == "memory" {
+		if plugin != "memory" {
 			reg = cache.New(reg, cache.WithTTL(20*time.Second))
 		}
 	})
diff --git a/services/audit/pkg/command/server.go b/services/audit/pkg/command/server.go
index 2537adfdd57..11c312dc06c 100644
--- a/services/audit/pkg/command/server.go
+++ b/services/audit/pkg/command/server.go
@@ -2,12 +2,16 @@ package command
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
+	"os"
 
 	"github.com/cs3org/reva/v2/pkg/events"
 	"github.com/cs3org/reva/v2/pkg/events/server"
 	"github.com/go-micro/plugins/v4/events/natsjs"
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
+	ociscrypto "github.com/owncloud/ocis/v2/ocis-pkg/crypto"
 	"github.com/owncloud/ocis/v2/services/audit/pkg/config"
 	"github.com/owncloud/ocis/v2/services/audit/pkg/config/parser"
 	"github.com/owncloud/ocis/v2/services/audit/pkg/logging"
@@ -36,7 +40,27 @@ func Server(cfg *config.Config) *cli.Command {
 			defer cancel()
 
 			evtsCfg := cfg.Events
+
+			var rootCAPool *x509.CertPool
+			if evtsCfg.TLSRootCACertificate != "" {
+				rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate)
+				if err != nil {
+					return err
+				}
+
+				rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile)
+				if err != nil {
+					return err
+				}
+				evtsCfg.TLSInsecure = false
+			}
+
+			tlsConf := &tls.Config{
+				InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec
+				RootCAs:            rootCAPool,
+			}
 			client, err := server.NewNatsStream(
+				natsjs.TLSConfig(tlsConf),
 				natsjs.Address(evtsCfg.Endpoint),
 				natsjs.ClusterID(evtsCfg.Cluster),
 			)
diff --git a/services/audit/pkg/config/config.go b/services/audit/pkg/config/config.go
index 48cadb0db68..ef6ba9f4926 100644
--- a/services/audit/pkg/config/config.go
+++ b/services/audit/pkg/config/config.go
@@ -23,9 +23,11 @@ type Config struct {
 
 // Events combines the configuration options for the event bus.
 type Events struct {
-	Endpoint      string `yaml:"endpoint" env:"AUDIT_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
-	Cluster       string `yaml:"cluster" env:"AUDIT_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
-	ConsumerGroup string `yaml:"group" env:"AUDIT_EVENTS_GROUP" desc:"The consumergroup of the service. One group will only get one copy of an event."`
+	Endpoint             string `yaml:"endpoint" env:"AUDIT_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	Cluster              string `yaml:"cluster" env:"AUDIT_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	ConsumerGroup        string `yaml:"group" env:"AUDIT_EVENTS_GROUP" desc:"The consumergroup of the service. One group will only get one copy of an event."`
+	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;AUDIT_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
+	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"AUDIT_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided AUDIT_EVENTS_TLS_INSECURE will be seen as false."`
 }
 
 // Auditlog holds audit log information
diff --git a/services/frontend/pkg/revaconfig/config.go b/services/frontend/pkg/revaconfig/config.go
index 1439d32029e..9d4a1f87f45 100644
--- a/services/frontend/pkg/revaconfig/config.go
+++ b/services/frontend/pkg/revaconfig/config.go
@@ -198,7 +198,7 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error
 								"default_permissions":               22,
 								"search_min_length":                 cfg.SearchMinLength,
 								"public": map[string]interface{}{
-									"alias":                      false,
+									"alias":                      true,
 									"enabled":                    true,
 									"send_mail":                  true,
 									"defaultPublicLinkShareName": "Public link",
diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go
index 8e42344e9fd..6d6e565810c 100644
--- a/services/graph/pkg/config/config.go
+++ b/services/graph/pkg/config/config.go
@@ -70,6 +70,8 @@ type Identity struct {
 
 // Events combines the configuration options for the event bus.
 type Events struct {
-	Endpoint string `yaml:"endpoint" env:"GRAPH_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Set to a empty string to disable emitting events."`
-	Cluster  string `yaml:"cluster" env:"GRAPH_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	Endpoint             string `yaml:"endpoint" env:"GRAPH_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Set to a empty string to disable emitting events."`
+	Cluster              string `yaml:"cluster" env:"GRAPH_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;GRAPH_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
+	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"GRAPH_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_EVENTS_TLS_INSECURE will be seen as false."`
 }
diff --git a/services/graph/pkg/server/http/server.go b/services/graph/pkg/server/http/server.go
index 5fe70a4bedc..d7ba70be8a2 100644
--- a/services/graph/pkg/server/http/server.go
+++ b/services/graph/pkg/server/http/server.go
@@ -1,10 +1,15 @@
 package http
 
 import (
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+
 	"github.com/cs3org/reva/v2/pkg/events/server"
 	chimiddleware "github.com/go-chi/chi/v5/middleware"
 	"github.com/go-micro/plugins/v4/events/natsjs"
 	"github.com/owncloud/ocis/v2/ocis-pkg/account"
+	ociscrypto "github.com/owncloud/ocis/v2/ocis-pkg/crypto"
 	"github.com/owncloud/ocis/v2/ocis-pkg/middleware"
 	"github.com/owncloud/ocis/v2/ocis-pkg/service/http"
 	"github.com/owncloud/ocis/v2/ocis-pkg/version"
@@ -33,7 +38,26 @@ func Server(opts ...Option) (http.Service, error) {
 
 	if options.Config.Events.Endpoint != "" {
 		var err error
+		var rootCAPool *x509.CertPool
+		if options.Config.Events.TLSRootCACertificate != "" {
+			rootCrtFile, err := os.Open(options.Config.Events.TLSRootCACertificate)
+			if err != nil {
+				return http.Service{}, err
+			}
+
+			rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile)
+			if err != nil {
+				return http.Service{}, err
+			}
+			options.Config.Events.TLSInsecure = false
+		}
+
+		tlsConf := &tls.Config{
+			InsecureSkipVerify: options.Config.Events.TLSInsecure, //nolint:gosec
+			RootCAs:            rootCAPool,
+		}
 		publisher, err = server.NewNatsStream(
+			natsjs.TLSConfig(tlsConf),
 			natsjs.Address(options.Config.Events.Endpoint),
 			natsjs.ClusterID(options.Config.Events.Cluster),
 		)
diff --git a/services/nats/pkg/command/server.go b/services/nats/pkg/command/server.go
index d2817590790..fae3e0cd6fe 100644
--- a/services/nats/pkg/command/server.go
+++ b/services/nats/pkg/command/server.go
@@ -2,11 +2,13 @@ package command
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 
 	"github.com/oklog/run"
 
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
+	pkgcrypto "github.com/owncloud/ocis/v2/ocis-pkg/crypto"
 	"github.com/owncloud/ocis/v2/services/nats/pkg/config"
 	"github.com/owncloud/ocis/v2/services/nats/pkg/config/parser"
 	"github.com/owncloud/ocis/v2/services/nats/pkg/logging"
@@ -36,6 +38,26 @@ func Server(cfg *config.Config) *cli.Command {
 
 			defer cancel()
 
+			// Generate a self-signing cert if no certificate is present
+			if err := pkgcrypto.GenCert(cfg.Nats.TLSCert, cfg.Nats.TLSKey, logger); err != nil {
+				logger.Fatal().Err(err).Msgf("Could not generate test-certificate")
+			}
+
+			crt, err := tls.LoadX509KeyPair(cfg.Nats.TLSCert, cfg.Nats.TLSKey)
+			if err != nil {
+				return err
+			}
+
+			clientAuth := tls.RequireAndVerifyClientCert
+			if cfg.Nats.TLSSkipVerifyClientCert {
+				clientAuth = tls.NoClientCert
+			}
+
+			tlsConf := &tls.Config{
+				MinVersion:   tls.VersionTLS12,
+				ClientAuth:   clientAuth,
+				Certificates: []tls.Certificate{crt},
+			}
 			natsServer, err := nats.NewNATSServer(
 				ctx,
 				logging.NewLogWrapper(logger),
@@ -43,6 +65,7 @@ func Server(cfg *config.Config) *cli.Command {
 				nats.Port(cfg.Nats.Port),
 				nats.ClusterID(cfg.Nats.ClusterID),
 				nats.StoreDir(cfg.Nats.StoreDir),
+				nats.TLSConfig(tlsConf),
 			)
 			if err != nil {
 				return err
diff --git a/services/nats/pkg/config/config.go b/services/nats/pkg/config/config.go
index 9e969cc9968..eaec9f483d8 100644
--- a/services/nats/pkg/config/config.go
+++ b/services/nats/pkg/config/config.go
@@ -22,8 +22,11 @@ type Config struct {
 
 // Nats is the nats config
 type Nats struct {
-	Host      string `yaml:"host" env:"NATS_NATS_HOST" desc:"Bind address."`
-	Port      int    `yaml:"port" env:"NATS_NATS_PORT" desc:"Bind port."`
-	ClusterID string `yaml:"clusterid" env:"NATS_NATS_CLUSTER_ID" desc:"ID of the NATS cluster."`
-	StoreDir  string `yaml:"store_dir" env:"NATS_NATS_STORE_DIR" desc:"Path for the NATS JetStream persistence directory."`
+	Host                    string `yaml:"host" env:"NATS_NATS_HOST" desc:"Bind address."`
+	Port                    int    `yaml:"port" env:"NATS_NATS_PORT" desc:"Bind port."`
+	ClusterID               string `yaml:"clusterid" env:"NATS_NATS_CLUSTER_ID" desc:"ID of the NATS cluster."`
+	StoreDir                string `yaml:"store_dir" env:"NATS_NATS_STORE_DIR" desc:"Path for the NATS JetStream persistence directory."`
+	TLSCert                 string `yaml:"tls_cert" env:"NATS_TLS_CERT" desc:"File name of the TLS server certificate for the nats listener."`
+	TLSKey                  string `yaml:"tls_key" env:"NATS_TLS_KEY" desc:"File name for the TLS certificate key for the server certificate."`
+	TLSSkipVerifyClientCert bool   `yaml:"tls_skip_verify_client_cert" env:"OCIS_INSECURE;NATS_TLS_SKIP_VERIFY_CLIENT_CERT" desc:"Whether the nats server should skip the client certificate verification during the TLS handshake."`
 }
diff --git a/services/nats/pkg/config/defaults/defaultconfig.go b/services/nats/pkg/config/defaults/defaultconfig.go
index 7c359ea7fa8..fb5f91a8ee3 100644
--- a/services/nats/pkg/config/defaults/defaultconfig.go
+++ b/services/nats/pkg/config/defaults/defaultconfig.go
@@ -1,7 +1,7 @@
 package defaults
 
 import (
-	"path"
+	"path/filepath"
 
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/v2/services/nats/pkg/config"
@@ -29,7 +29,9 @@ func DefaultConfig() *config.Config {
 			Host:      "127.0.0.1",
 			Port:      9233,
 			ClusterID: "ocis-cluster",
-			StoreDir:  path.Join(defaults.BaseDataPath(), "nats"),
+			StoreDir:  filepath.Join(defaults.BaseDataPath(), "nats"),
+			TLSCert:   filepath.Join(defaults.BaseDataPath(), "nats/tls.crt"),
+			TLSKey:    filepath.Join(defaults.BaseDataPath(), "nats/tls.key"),
 		},
 	}
 }
diff --git a/services/nats/pkg/server/nats/nats.go b/services/nats/pkg/server/nats/nats.go
index e346596fd7e..8536804cc7b 100644
--- a/services/nats/pkg/server/nats/nats.go
+++ b/services/nats/pkg/server/nats/nats.go
@@ -23,6 +23,7 @@ func NewNATSServer(ctx context.Context, logger nserver.Logger, opts ...NatsOptio
 
 	// enable JetStream
 	natsOpts.JetStream = true
+	natsOpts.AllowNonTLS = false
 
 	server, err := nserver.NewServer(natsOpts)
 	if err != nil {
diff --git a/services/nats/pkg/server/nats/options.go b/services/nats/pkg/server/nats/options.go
index 43816dd4ffe..d2c66869e70 100644
--- a/services/nats/pkg/server/nats/options.go
+++ b/services/nats/pkg/server/nats/options.go
@@ -1,6 +1,8 @@
 package nats
 
 import (
+	"crypto/tls"
+
 	nserver "github.com/nats-io/nats-server/v2/server"
 )
 
@@ -34,3 +36,10 @@ func StoreDir(StoreDir string) NatsOption {
 		o.StoreDir = StoreDir
 	}
 }
+
+// TLSConfig sets the tls config for the nats server
+func TLSConfig(c *tls.Config) NatsOption {
+	return func(o *nserver.Options) {
+		o.TLSConfig = c
+	}
+}
diff --git a/services/notifications/pkg/command/server.go b/services/notifications/pkg/command/server.go
index 6fcdb31e7ac..6bc5034db8b 100644
--- a/services/notifications/pkg/command/server.go
+++ b/services/notifications/pkg/command/server.go
@@ -1,13 +1,17 @@
 package command
 
 import (
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
+	"os"
 
 	"github.com/cs3org/reva/v2/pkg/events"
 	"github.com/cs3org/reva/v2/pkg/events/server"
 	"github.com/cs3org/reva/v2/pkg/rgrpc/todo/pool"
 	"github.com/go-micro/plugins/v4/events/natsjs"
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
+	"github.com/owncloud/ocis/v2/ocis-pkg/crypto"
 	"github.com/owncloud/ocis/v2/services/notifications/pkg/channels"
 	"github.com/owncloud/ocis/v2/services/notifications/pkg/config"
 	"github.com/owncloud/ocis/v2/services/notifications/pkg/config/parser"
@@ -35,7 +39,26 @@ func Server(cfg *config.Config) *cli.Command {
 			}
 
 			evtsCfg := cfg.Notifications.Events
+			var rootCAPool *x509.CertPool
+			if evtsCfg.TLSRootCACertificate != "" {
+				rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate)
+				if err != nil {
+					return err
+				}
+
+				rootCAPool, err = crypto.NewCertPoolFromPEM(rootCrtFile)
+				if err != nil {
+					return err
+				}
+				evtsCfg.TLSInsecure = false
+			}
+
+			tlsConf := &tls.Config{
+				InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec
+				RootCAs:            rootCAPool,
+			}
 			client, err := server.NewNatsStream(
+				natsjs.TLSConfig(tlsConf),
 				natsjs.Address(evtsCfg.Endpoint),
 				natsjs.ClusterID(evtsCfg.Cluster),
 			)
diff --git a/services/notifications/pkg/config/config.go b/services/notifications/pkg/config/config.go
index c0bd81678e2..c2c20f025d4 100644
--- a/services/notifications/pkg/config/config.go
+++ b/services/notifications/pkg/config/config.go
@@ -43,7 +43,9 @@ type SMTP struct {
 
 // Events combines the configuration options for the event bus.
 type Events struct {
-	Endpoint      string `yaml:"endpoint" env:"NOTIFICATIONS_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
-	Cluster       string `yaml:"cluster" env:"NOTIFICATIONS_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
-	ConsumerGroup string `yaml:"group" env:"NOTIFICATIONS_EVENTS_GROUP" desc:"Name of the event group / queue on the event system."`
+	Endpoint             string `yaml:"endpoint" env:"NOTIFICATIONS_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	Cluster              string `yaml:"cluster" env:"NOTIFICATIONS_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	ConsumerGroup        string `yaml:"group" env:"NOTIFICATIONS_EVENTS_GROUP" desc:"Name of the event group / queue on the event system."`
+	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;NOTIFICATIONS_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
+	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"NOTIFICATIONS_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided NOTIFICATIONS_EVENTS_TLS_INSECURE will be seen as false."`
 }
diff --git a/services/search/pkg/config/config.go b/services/search/pkg/config/config.go
index 9cf092caf3d..e47ced27756 100644
--- a/services/search/pkg/config/config.go
+++ b/services/search/pkg/config/config.go
@@ -29,7 +29,9 @@ type Config struct {
 
 // Events combines the configuration options for the event bus.
 type Events struct {
-	Endpoint      string `yaml:"endpoint" env:"SEARCH_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
-	Cluster       string `yaml:"cluster" env:"SEARCH_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
-	ConsumerGroup string `yaml:"group" env:"SEARCH_EVENTS_GROUP" desc:"The customer group of the service. One group will only get one copy of an event"`
+	Endpoint             string `yaml:"endpoint" env:"SEARCH_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	Cluster              string `yaml:"cluster" env:"SEARCH_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	ConsumerGroup        string `yaml:"group" env:"SEARCH_EVENTS_GROUP" desc:"The customer group of the service. One group will only get one copy of an event"`
+	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;SEARCH_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
+	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"SEARCH_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SEARCH_EVENTS_TLS_INSECURE will be seen as false."`
 }
diff --git a/services/search/pkg/service/v0/service.go b/services/search/pkg/service/v0/service.go
index 99912b01877..ec7ef06c260 100644
--- a/services/search/pkg/service/v0/service.go
+++ b/services/search/pkg/service/v0/service.go
@@ -2,7 +2,10 @@ package service
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"errors"
+	"os"
 	"path/filepath"
 
 	"github.com/blevesearch/bleve/v2"
@@ -16,6 +19,7 @@ import (
 	"go-micro.dev/v4/metadata"
 	grpcmetadata "google.golang.org/grpc/metadata"
 
+	ociscrypto "github.com/owncloud/ocis/v2/ocis-pkg/crypto"
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
 	searchsvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/search/v0"
 	"github.com/owncloud/ocis/v2/services/search/pkg/config"
@@ -32,7 +36,27 @@ func NewHandler(opts ...Option) (searchsvc.SearchProviderHandler, error) {
 
 	// Connect to nats to listen for changes that need to trigger an index update
 	evtsCfg := cfg.Events
+
+	var rootCAPool *x509.CertPool
+	if evtsCfg.TLSRootCACertificate != "" {
+		rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate)
+		if err != nil {
+			return nil, err
+		}
+
+		rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile)
+		if err != nil {
+			return nil, err
+		}
+		evtsCfg.TLSInsecure = false
+	}
+
+	tlsConf := &tls.Config{
+		InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec
+		RootCAs:            rootCAPool,
+	}
 	client, err := server.NewNatsStream(
+		natsjs.TLSConfig(tlsConf),
 		natsjs.Address(evtsCfg.Endpoint),
 		natsjs.ClusterID(evtsCfg.Cluster),
 	)
diff --git a/services/sharing/pkg/config/config.go b/services/sharing/pkg/config/config.go
index a68167e5a28..74a98043167 100644
--- a/services/sharing/pkg/config/config.go
+++ b/services/sharing/pkg/config/config.go
@@ -150,6 +150,8 @@ type PublicSharingJSONCS3Driver struct {
 }
 
 type Events struct {
-	Addr      string `yaml:"endpoint" env:"SHARING_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
-	ClusterID string `yaml:"cluster" env:"SHARING_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	Addr              string `yaml:"endpoint" env:"SHARING_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	ClusterID         string `yaml:"cluster" env:"SHARING_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	TLSInsecure       bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;SHARING_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
+	TLSRootCaCertPath string `yaml:"tls_root_ca_cert_path" env:"SHARING_EVENTS_TLS_ROOT_CA_CERT" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SHARING_EVENTS_TLS_INSECURE will be seen as false."`
 }
diff --git a/services/sharing/pkg/config/defaults/defaultconfig.go b/services/sharing/pkg/config/defaults/defaultconfig.go
index 8e502114a94..0b136a97a71 100644
--- a/services/sharing/pkg/config/defaults/defaultconfig.go
+++ b/services/sharing/pkg/config/defaults/defaultconfig.go
@@ -69,8 +69,9 @@ func DefaultConfig() *config.Config {
 			// TODO implement and add owncloudsql publicshare driver
 		},
 		Events: config.Events{
-			Addr:      "127.0.0.1:9233",
-			ClusterID: "ocis-cluster",
+			Addr:        "127.0.0.1:9233",
+			ClusterID:   "ocis-cluster",
+			TLSInsecure: true,
 		},
 	}
 }
diff --git a/services/sharing/pkg/revaconfig/config.go b/services/sharing/pkg/revaconfig/config.go
index e66cf07f259..fc4f675b8ff 100644
--- a/services/sharing/pkg/revaconfig/config.go
+++ b/services/sharing/pkg/revaconfig/config.go
@@ -102,10 +102,12 @@ func SharingConfigFromStruct(cfg *config.Config) map[string]interface{} {
 			},
 			"interceptors": map[string]interface{}{
 				"eventsmiddleware": map[string]interface{}{
-					"group":     "sharing",
-					"type":      "nats",
-					"address":   cfg.Events.Addr,
-					"clusterID": cfg.Events.ClusterID,
+					"group":            "sharing",
+					"type":             "nats",
+					"address":          cfg.Events.Addr,
+					"clusterID":        cfg.Events.ClusterID,
+					"tls-insecure":     cfg.Events.TLSInsecure,
+					"tls-root-ca-cert": cfg.Events.TLSRootCaCertPath,
 				},
 			},
 		},
diff --git a/services/storage-users/pkg/config/config.go b/services/storage-users/pkg/config/config.go
index 6f5d0cf3757..c6ade71a0bd 100644
--- a/services/storage-users/pkg/config/config.go
+++ b/services/storage-users/pkg/config/config.go
@@ -133,8 +133,10 @@ type OwnCloudSQLDriver struct {
 }
 
 type Events struct {
-	Addr      string `yaml:"endpoint" env:"STORAGE_USERS_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
-	ClusterID string `yaml:"cluster" env:"STORAGE_USERS_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	Addr              string `yaml:"endpoint" env:"STORAGE_USERS_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	ClusterID         string `yaml:"cluster" env:"STORAGE_USERS_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	TLSInsecure       bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;STORAGE_USERS_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
+	TLSRootCaCertPath string `yaml:"tls_root_ca_cert_path" env:"STORAGE_USERS_EVENTS_TLS_ROOT_CA_CERT" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_EVENTS_TLS_INSECURE will be seen as false."`
 }
 
 // Cache holds cache config
diff --git a/services/storage-users/pkg/config/defaults/defaultconfig.go b/services/storage-users/pkg/config/defaults/defaultconfig.go
index 3d2f66514b4..0fdad518c1a 100644
--- a/services/storage-users/pkg/config/defaults/defaultconfig.go
+++ b/services/storage-users/pkg/config/defaults/defaultconfig.go
@@ -75,8 +75,9 @@ func DefaultConfig() *config.Config {
 			},
 		},
 		Events: config.Events{
-			Addr:      "127.0.0.1:9233",
-			ClusterID: "ocis-cluster",
+			Addr:        "127.0.0.1:9233",
+			ClusterID:   "ocis-cluster",
+			TLSInsecure: true,
 		},
 		Cache: config.Cache{
 			Store:    "memory",
diff --git a/services/storage-users/pkg/revaconfig/config.go b/services/storage-users/pkg/revaconfig/config.go
index 873b84984c4..e6642cac98f 100644
--- a/services/storage-users/pkg/revaconfig/config.go
+++ b/services/storage-users/pkg/revaconfig/config.go
@@ -34,10 +34,12 @@ func StorageUsersConfigFromStruct(cfg *config.Config) map[string]interface{} {
 			},
 			"interceptors": map[string]interface{}{
 				"eventsmiddleware": map[string]interface{}{
-					"group":     "sharing",
-					"type":      "nats",
-					"address":   cfg.Events.Addr,
-					"clusterID": cfg.Events.ClusterID,
+					"group":            "sharing",
+					"type":             "nats",
+					"address":          cfg.Events.Addr,
+					"clusterID":        cfg.Events.ClusterID,
+					"tls-insecure":     cfg.Events.TLSInsecure,
+					"tls-root-ca-cert": cfg.Events.TLSRootCaCertPath,
 				},
 			},
 		},
@@ -47,11 +49,13 @@ func StorageUsersConfigFromStruct(cfg *config.Config) map[string]interface{} {
 			// TODO build services dynamically
 			"services": map[string]interface{}{
 				"dataprovider": map[string]interface{}{
-					"prefix":         cfg.HTTP.Prefix,
-					"driver":         cfg.Driver,
-					"drivers":        UserDrivers(cfg),
-					"nats_address":   cfg.Events.Addr,
-					"nats_clusterID": cfg.Events.ClusterID,
+					"prefix":                 cfg.HTTP.Prefix,
+					"driver":                 cfg.Driver,
+					"drivers":                UserDrivers(cfg),
+					"nats_address":           cfg.Events.Addr,
+					"nats_clusterID":         cfg.Events.ClusterID,
+					"nats_tls_insecure":      cfg.Events.TLSInsecure,
+					"nats_root_ca_cert_path": cfg.Events.TLSRootCaCertPath,
 					"data_txs": map[string]interface{}{
 						"simple": map[string]interface{}{
 							"cache_store":    cfg.Cache.Store,
diff --git a/services/web/Makefile b/services/web/Makefile
index fa880e686cd..df2a41bffe8 100644
--- a/services/web/Makefile
+++ b/services/web/Makefile
@@ -1,6 +1,6 @@
 SHELL := bash
 NAME := web
-WEB_ASSETS_VERSION = v5.7.0
+WEB_ASSETS_VERSION = v6.0.0-rc.2
 
 include ../../.make/recursion.mk
 


Test patch:
diff --git a/ocis-pkg/crypto/crypto_test.go b/ocis-pkg/crypto/crypto_test.go
index e61c0a82a61..6147edc4447 100644
--- a/ocis-pkg/crypto/crypto_test.go
+++ b/ocis-pkg/crypto/crypto_test.go
@@ -40,7 +40,7 @@ var _ = Describe("Crypto", func() {
 	Describe("Creating key / certificate pair", func() {
 		Context("For ocis-proxy in the location of the user config directory", func() {
 			It(fmt.Sprintf("Creates the cert / key tuple in: %s", filepath.Join(userConfigDir, "ocis")), func() {
-				if err := crypto.GenCert(config.Proxy.HTTP.TLSCert, config.Proxy.HTTP.TLSKey, log.NewLogger()); err != nil {
+				if err := crypto.GenCert(config.Proxy.HTTP.TLSCert, config.Proxy.HTTP.TLSKey, log.NopLogger()); err != nil {
 					Fail(err.Error())
 				}
 
@@ -54,4 +54,50 @@ var _ = Describe("Crypto", func() {
 			})
 		})
 	})
+	Describe("Creating a new cert pool", func() {
+		var (
+			crtOne string
+			keyOne string
+			crtTwo string
+			keyTwo string
+		)
+		BeforeEach(func() {
+			crtOne = filepath.Join(userConfigDir, "ocis/one.cert")
+			keyOne = filepath.Join(userConfigDir, "ocis/one.key")
+			crtTwo = filepath.Join(userConfigDir, "ocis/two.cert")
+			keyTwo = filepath.Join(userConfigDir, "ocis/two.key")
+			if err := crypto.GenCert(crtOne, keyOne, log.NopLogger()); err != nil {
+				Fail(err.Error())
+			}
+			if err := crypto.GenCert(crtTwo, keyTwo, log.NopLogger()); err != nil {
+				Fail(err.Error())
+			}
+		})
+		It("handles one certificate", func() {
+			f1, _ := os.Open(crtOne)
+			defer f1.Close()
+
+			c, err := crypto.NewCertPoolFromPEM(f1)
+			if err != nil {
+				Fail(err.Error())
+			}
+			if len(c.Subjects()) != 1 {
+				Fail("expected 1 certificate in the cert pool")
+			}
+		})
+		It("handles multiple certificates", func() {
+			f1, _ := os.Open(crtOne)
+			f2, _ := os.Open(crtTwo)
+			defer f1.Close()
+			defer f2.Close()
+
+			c, err := crypto.NewCertPoolFromPEM(f1, f2)
+			if err != nil {
+				Fail(err.Error())
+			}
+			if len(c.Subjects()) != 2 {
+				Fail("expected 2 certificates in the cert pool")
+			}
+		})
+	})
 })
diff --git a/ocis-pkg/crypto/gencert_test.go b/ocis-pkg/crypto/gencert_test.go
index 9a57630df5f..32f0bbc6957 100644
--- a/ocis-pkg/crypto/gencert_test.go
+++ b/ocis-pkg/crypto/gencert_test.go
@@ -58,7 +58,6 @@ func TestPersistKey(t *testing.T) {
 
 	type args struct {
 		keyName string
-		l       log.Logger
 		pk      interface{}
 	}
 	tests := []struct {
@@ -69,7 +68,6 @@ func TestPersistKey(t *testing.T) {
 			name: "writes a private key (rsa) to the specified location",
 			args: args{
 				keyName: keyPath,
-				l:       log.NewLogger(),
 				pk:      rsaPk,
 			},
 		},
@@ -77,14 +75,13 @@ func TestPersistKey(t *testing.T) {
 			name: "writes a private key (ecdsa) to the specified location",
 			args: args{
 				keyName: keyPath,
-				l:       log.NewLogger(),
 				pk:      ecdsaPk,
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := persistKey(tt.args.keyName, tt.args.l, tt.args.pk); err != nil {
+			if err := persistKey(tt.args.keyName, log.NopLogger(), tt.args.pk); err != nil {
 				t.Error(err)
 			}
 		})
@@ -107,7 +104,6 @@ func TestPersistCertificate(t *testing.T) {
 
 	type args struct {
 		certName string
-		l        log.Logger
 		pk       interface{}
 	}
 	tests := []struct {
@@ -119,7 +115,6 @@ func TestPersistCertificate(t *testing.T) {
 			name: "store a certificate with an rsa private key",
 			args: args{
 				certName: certPath,
-				l:        log.NewLogger(),
 				pk:       rsaPk,
 			},
 			wantErr: false,
@@ -128,7 +123,6 @@ func TestPersistCertificate(t *testing.T) {
 			name: "store a certificate with an ecdsa private key",
 			args: args{
 				certName: certPath,
-				l:        log.NewLogger(),
 				pk:       ecdsaPk,
 			},
 			wantErr: false,
@@ -137,7 +131,6 @@ func TestPersistCertificate(t *testing.T) {
 			name: "should fail",
 			args: args{
 				certName: certPath,
-				l:        log.NewLogger(),
 				pk:       42,
 			},
 			wantErr: true,
@@ -146,7 +139,7 @@ func TestPersistCertificate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Run(tt.name, func(t *testing.T) {
-				if err := persistCertificate(tt.args.certName, tt.args.l, tt.args.pk); err != nil {
+				if err := persistCertificate(tt.args.certName, log.NopLogger(), tt.args.pk); err != nil {
 					if !tt.wantErr {
 						t.Error(err)
 					}
diff --git a/services/settings/ui/tests/acceptance/pageobjects/filesPageSettingsContext.js b/services/settings/ui/tests/acceptance/pageobjects/filesPageSettingsContext.js
index a2e8beb8bc7..b2ca955c398 100644
--- a/services/settings/ui/tests/acceptance/pageobjects/filesPageSettingsContext.js
+++ b/services/settings/ui/tests/acceptance/pageobjects/filesPageSettingsContext.js
@@ -75,7 +75,7 @@ module.exports = {
       selector: '#account-info-container'
     },
     fileTableHeaderItems: {
-      selector: '//*[@id="files-personal-table"]//th[not(.//div)]',
+      selector: '//*[@id="files-space-table"]//th[not(.//div)]',
       locateStrategy: 'xpath'
     }
   }
diff --git a/tests/acceptance/expected-failures-webUI-on-OCIS-storage-ocisSmokeTest.md b/tests/acceptance/expected-failures-webUI-on-OCIS-storage-ocisSmokeTest.md
index 932d2626149..8c8f7c3be99 100644
--- a/tests/acceptance/expected-failures-webUI-on-OCIS-storage-ocisSmokeTest.md
+++ b/tests/acceptance/expected-failures-webUI-on-OCIS-storage-ocisSmokeTest.md
@@ -13,7 +13,3 @@ Only the web scenarios tagged ocisSmokeTest are run by default in OCIS CI. This
 
 ### [Copy private link option not available](https://github.com/owncloud/ocis/issues/1409)
 - [webUIPrivateLinks/accessingPrivateLinks.feature:9](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIPrivateLinks/accessingPrivateLinks.feature#L9)
-- [webUIPrivateLinks/accessingPrivateLinks.feature:17](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIPrivateLinks/accessingPrivateLinks.feature#L17)
-
-### [impossible to navigate into a folder in the trashbin](https://github.com/owncloud/web/issues/1725)
-- [webUITrashbinDelete/trashbinDelete.feature:29](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinDelete/trashbinDelete.feature#L29)
diff --git a/tests/acceptance/expected-failures-webUI-on-OCIS-storage.md b/tests/acceptance/expected-failures-webUI-on-OCIS-storage.md
index dd154bcb8de..a85398e67b6 100644
--- a/tests/acceptance/expected-failures-webUI-on-OCIS-storage.md
+++ b/tests/acceptance/expected-failures-webUI-on-OCIS-storage.md
@@ -70,11 +70,10 @@ Other free text and Markdown formatting can be used elsewhere in the document if
 
 ### [webUI-Private-Links](https://github.com/owncloud/web/issues/6844)
 - [webUIPrivateLinks/accessingPrivateLinks.feature:9](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIPrivateLinks/accessingPrivateLinks.feature#L9)
-- [webUIPrivateLinks/accessingPrivateLinks.feature:17](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIPrivateLinks/accessingPrivateLinks.feature#L17)
 - [webUIPrivateLinks/accessingPrivateLinks.feature:25](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIPrivateLinks/accessingPrivateLinks.feature#L25)
 
 ### [Share additional info](https://github.com/owncloud/ocis/issues/1253)
-- [webUISharingInternalUsersShareWithPage/shareWithUsers.feature:140](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingInternalUsersShareWithPage/shareWithUsers.feature#L140)
+- [webUISharingInternalUsersShareWithPage/shareWithUsers.feature:138](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingInternalUsersShareWithPage/shareWithUsers.feature#L138)
 
 ### [Expiration date set is not implemented in user share](https://github.com/owncloud/ocis/issues/1250)
 - [webUISharingInternalGroups/shareWithGroups.feature:279](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingInternalGroups/shareWithGroups.feature#L279)
@@ -98,7 +97,7 @@ Other free text and Markdown formatting can be used elsewhere in the document if
 - [webUISharingPublicManagement/shareByPublicLink.feature:133](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/shareByPublicLink.feature#L133)
 
 ### [Propfind response to trashbin endpoint is different in ocis](https://github.com/owncloud/product/issues/186)
-- [webUIFilesSearch/search.feature:178](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesSearch/search.feature#L178)
+- [webUIFilesSearch/search.feature:131](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesSearch/search.feature#L131)
 
 ### [restoring a file from "Deleted files" (trashbin) is not possible if the original folder does not exist any-more](https://github.com/owncloud/web/issues/1753)
 - [webUITrashbinRestore/trashbinRestore.feature:138](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinRestore/trashbinRestore.feature#L138)
@@ -107,7 +106,7 @@ Other free text and Markdown formatting can be used elsewhere in the document if
 - [webUIUpload/uploadFileGreaterThanQuotaSize.feature:12](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIUpload/uploadFileGreaterThanQuotaSize.feature#L12)
 
 ### [restoring a file deleted from a received shared folder is not possible](https://github.com/owncloud/ocis/issues/1124)
-- [webUITrashbinRestore/trashbinRestore.feature:260](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinRestore/trashbinRestore.feature#L260)
+- [webUITrashbinRestore/trashbinRestore.feature:244](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinRestore/trashbinRestore.feature#L244)
 
 ### [Blocked user is not logged out](https://github.com/owncloud/ocis/issues/902)
 - [webUILogin/adminBlocksUser.feature:13](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUILogin/adminBlocksUser.feature#L13)
@@ -129,18 +128,12 @@ Other free text and Markdown formatting can be used elsewhere in the document if
 - [webUIFilesDetails/fileDetails.feature:106](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesDetails/fileDetails.feature#L106)
 - [webUIFilesDetails/fileDetails.feature:123](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesDetails/fileDetails.feature#L123)
 - [webUIFilesDetails/fileDetails.feature:140](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesDetails/fileDetails.feature#L140)
-- [webUIFilesDetails/fileDetails.feature:169](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesDetails/fileDetails.feature#L169)
 
 ### [Deletion of a recursive folder from trashbin is not possible](https://github.com/owncloud/product/issues/188)
-- [webUITrashbinDelete/trashbinDelete.feature:85](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinDelete/trashbinDelete.feature#L85)
-- [webUITrashbinDelete/trashbinDelete.feature:71](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinDelete/trashbinDelete.feature#L71)
-- [webUITrashbinDelete/trashbinDelete.feature:48](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinDelete/trashbinDelete.feature#L48)
+- [webUITrashbinDelete/trashbinDelete.feature:51](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinDelete/trashbinDelete.feature#L51)
+- [webUITrashbinDelete/trashbinDelete.feature:65](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinDelete/trashbinDelete.feature#L65)
 
 ### [Tags page not implemented yet](https://github.com/owncloud/web/issues/5017)
-- [webUIDeleteFilesFolders/deleteFilesFolders.feature:135](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIDeleteFilesFolders/deleteFilesFolders.feature#L135)
-- [webUIFilesSearch/search.feature:63](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesSearch/search.feature#L63)
-- [webUIFilesSearch/search.feature:71](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesSearch/search.feature#L71)
-- [webUIFilesSearch/search.feature:84](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesSearch/search.feature#L84)
 - [webUITags/tagsSuggestion.feature:25](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITags/tagsSuggestion.feature#L25)
 - [webUITags/tagsSuggestion.feature:35](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITags/tagsSuggestion.feature#L35)
 - [webUITags/createTags.feature:16](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITags/createTags.feature#L16)
@@ -150,20 +143,9 @@ Other free text and Markdown formatting can be used elsewhere in the document if
 - [webUITags/createTags.feature:61](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITags/createTags.feature#L61)
 - [webUITags/createTags.feature:79](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITags/createTags.feature#L79)
 
-### [impossible to navigate into a folder in the trashbin](https://github.com/owncloud/web/issues/1725)
-- [webUITrashbinDelete/trashbinDelete.feature:29](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUITrashbinDelete/trashbinDelete.feature#L29)
-
 ### [Saving public share is not possible](https://github.com/owncloud/web/issues/5321)
 - [webUISharingPublicManagement/shareByPublicLink.feature:31](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/shareByPublicLink.feature#L31)
 
-### [Public link send by email field](https://github.com/owncloud/web/issues/2422)
-- [webUISharingPublicManagement/publicLinkShareByEmail.feature:15](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/publicLinkShareByEmail.feature#L15)
-- [webUISharingPublicManagement/publicLinkShareByEmail.feature:25](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/publicLinkShareByEmail.feature#L25)
-- [webUISharingPublicManagement/publicLinkShareByEmail.feature:41](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/publicLinkShareByEmail.feature#L41)
-- [webUISharingPublicManagement/publicLinkShareByEmail.feature:56](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/publicLinkShareByEmail.feature#L56)
-- [webUISharingPublicManagement/publicLinkShareByEmail.feature:71](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/publicLinkShareByEmail.feature#L71)
-- [webUISharingPublicManagement/publicLinkShareByEmail.feature:99](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicManagement/publicLinkShareByEmail.feature#L99)
-
 ### [Uploading folders does not work in files-drop](https://github.com/owncloud/web/issues/2443)
 - [webUISharingPublicDifferentRoles/shareByPublicLinkDifferentRoles.feature:247](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingPublicDifferentRoles/shareByPublicLinkDifferentRoles.feature#L247)
 
@@ -202,64 +184,28 @@ Other free text and Markdown formatting can be used elsewhere in the document if
 - [webUIWebdavLocks/unlock.feature:148](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLocks/unlock.feature#L148)
 - [webUIWebdavLocks/unlock.feature:198](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLocks/unlock.feature#L198)
 - [webUIWebdavLocks/unlock.feature:199](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLocks/unlock.feature#L199)
-- [webUIWebdavLockProtection/delete.feature:32](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/delete.feature#L32)
 - [webUIWebdavLockProtection/delete.feature:33](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/delete.feature#L33)
-- [webUIWebdavLockProtection/delete.feature:53](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/delete.feature#L53)
-- [webUIWebdavLockProtection/delete.feature:54](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/delete.feature#L54)
-- [webUIWebdavLockProtection/move.feature:35](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L35)
+- [webUIWebdavLockProtection/delete.feature:34](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/delete.feature#L34)
 - [webUIWebdavLockProtection/move.feature:36](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L36)
-- [webUIWebdavLockProtection/move.feature:56](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L56)
-- [webUIWebdavLockProtection/move.feature:57](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L57)
-- [webUIWebdavLockProtection/move.feature:79](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L79)
-- [webUIWebdavLockProtection/move.feature:80](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L80)
-- [webUIWebdavLockProtection/move.feature:100](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L100)
-- [webUIWebdavLockProtection/move.feature:101](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L101)
-- [webUIWebdavLockProtection/upload.feature:31](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L31)
+- [webUIWebdavLockProtection/move.feature:37](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L37)
 - [webUIWebdavLockProtection/upload.feature:32](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L32)
-- [webUIWebdavLockProtection/upload.feature:51](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L51)
-- [webUIWebdavLockProtection/upload.feature:52](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L52)
-- [webUIWebdavLockProtection/upload.feature:71](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L71)
-- [webUIWebdavLockProtection/upload.feature:72](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L72)
-
-### [Resources cannot be locked under ocis](https://github.com/owncloud/ocis/issues/1284)
-- [webUIWebdavLockProtection/delete.feature:73](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/delete.feature#L73)
-- [webUIWebdavLockProtection/delete.feature:74](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/delete.feature#L74)
-- [webUIWebdavLockProtection/move.feature:123](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L123)
-- [webUIWebdavLockProtection/move.feature:124](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/move.feature#L124)
-
-### [Writing to locked files/folders give only a generic error message](https://github.com/owncloud/web/issues/5741)
-- [webUIWebdavLockProtection/upload.feature:90](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L90)
-- [webUIWebdavLockProtection/upload.feature:91](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L91)
+- [webUIWebdavLockProtection/upload.feature:33](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIWebdavLockProtection/upload.feature#L33)
 
 ### [Federated shares not showing in shared with me page](https://github.com/owncloud/web/issues/2510)
 - [webUISharingExternal/federationSharing.feature:38](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingExternal/federationSharing.feature#L38)
 - [webUISharingExternal/federationSharing.feature:166](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingExternal/federationSharing.feature#L166)
 
-### [Upload of folder with same name shows error](https://github.com/owncloud/web/issues/6996)
-- [webUIUpload/upload.feature:129](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIUpload/upload.feature#L129)
-- [webUIUpload/upload.feature:142](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIUpload/upload.feature#L142)
-- [webUIUpload/upload.feature:159](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIUpload/upload.feature#L159)
-- [webUIUpload/uploadEdgecases.feature:69](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIUpload/uploadEdgecases.feature#L69)
-
-### [browsing directly to a details tab is not possible](https://github.com/owncloud/web/issues/5464)
-- [webUIFiles/browseDirectlyToDetailsTab.feature:21](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFiles/browseDirectlyToDetailsTab.feature#L21)
-- [webUIFiles/browseDirectlyToDetailsTab.feature:22](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFiles/browseDirectlyToDetailsTab.feature#L22)
-- [webUIFiles/browseDirectlyToDetailsTab.feature:31](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFiles/browseDirectlyToDetailsTab.feature#L31)
-- [webUIFiles/browseDirectlyToDetailsTab.feature:32](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFiles/browseDirectlyToDetailsTab.feature#L32)
-- [webUIFiles/browseDirectlyToDetailsTab.feature:41](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFiles/browseDirectlyToDetailsTab.feature#L41)
-- [webUIFiles/browseDirectlyToDetailsTab.feature:42](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFiles/browseDirectlyToDetailsTab.feature#L42)
-
 ### [reshared share that is shared with a group the sharer is part of shows twice on "Share with me" page](https://github.com/owncloud/web/issues/2512)
-- [webUISharingAcceptShares/acceptShares.feature:32](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L32)
+- [webUISharingAcceptShares/acceptShares.feature:31](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L31)
 
 ### [[oCIS] Received share cannot be deleted/unshared if not shared with full permissions](https://github.com/owncloud/web/issues/5531)
-- [webUISharingAcceptShares/acceptShares.feature:50](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L50)
-- [webUISharingAcceptShares/acceptShares.feature:162](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L162)
-- [webUISharingAcceptShares/acceptShares.feature:201](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L201)
+- [webUISharingAcceptShares/acceptShares.feature:49](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L49)
+- [webUISharingAcceptShares/acceptShares.feature:161](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L161)
+- [webUISharingAcceptShares/acceptShares.feature:200](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L200)
 
 ### [not possible to overwrite a received shared file](https://github.com/owncloud/ocis/issues/2267)
 - [webUISharingInternalGroups/shareWithGroups.feature:79](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingInternalGroups/shareWithGroups.feature#L79)
-- [webUISharingInternalUsers/shareWithUsers.feature:59](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingInternalUsers/shareWithUsers.feature#L59)
+- [webUISharingInternalUsers/shareWithUsers.feature:55](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingInternalUsers/shareWithUsers.feature#L55)
 
 ### [web config update is not properly reflected after the ocis start](https://github.com/owncloud/ocis/issues/2944)
 - [webUIFiles/breadcrumb.feature:50](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFiles/breadcrumb.feature#L50)
@@ -277,5 +223,4 @@ Other free text and Markdown formatting can be used elsewhere in the document if
 - [webUIFilesCopy/copy.feature:101](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUIFilesCopy/copy.feature#L101)
 
 ### [PROPFIND to sub-folder of a shared resources with same name gives 404](https://github.com/owncloud/ocis/issues/3859)
-- [webUISharingAcceptShares/acceptShares.feature:245](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L245)
-
+- [webUISharingAcceptShares/acceptShares.feature:244](https://github.com/owncloud/web/blob/master/tests/acceptance/features/webUISharingAcceptShares/acceptShares.feature#L244)