Self-signed certificates,
the home-lab login killer.

On the desktop you accepted the certificate warning once, and the browser remembered. iOS apps go through Apple's transport security, which requires a certificate the system actually trusts: complete chain, matching hostname, valid dates. A bare self-signed certificate fails those checks before the app sees a single byte of Deck data.

A free Let's Encrypt certificate on a public hostname makes every device trust your server with zero per-device setup. If your Nextcloud must stay unreachable from the internet, a DNS-01 challenge issues valid certificates without exposing anything: your reverse proxy (Caddy, Traefik, Nginx Proxy Manager) proves domain ownership through your DNS provider instead of an open port.

Install your CA's root certificate on the iPhone (Settings, General, VPN & Device Management), then enable full trust for it under Settings, General, About, Certificate Trust Settings. Both steps are required; the second is the one everyone misses. The server certificate must be issued by that CA with the exact hostname you type into the app.

Open the server URL in Safari on the iPhone itself. Safari's error tells you which rule is broken: untrusted issuer, hostname mismatch, or expired. If Safari on the phone loads the site cleanly with a lock icon, certificates are fine and your problem is elsewhere, usually DNS or reachability.