diff --git a/demo/nextcloud/flake.nix b/demo/nextcloud/flake.nix
index 6382bca..d397cdd 100644
--- a/demo/nextcloud/flake.nix
+++ b/demo/nextcloud/flake.nix
@@ -92,6 +92,8 @@
             };
           };
         };
+        shb.nextcloud.ssl = config.shb.certs.certs.selfsigned.n;
+        shb.ldap.ssl = config.shb.certs.certs.selfsigned.n;
 
         services.dnsmasq = {
           enable = true;
diff --git a/modules/services/nextcloud-server.nix b/modules/services/nextcloud-server.nix
index fee6407..a716c88 100644
--- a/modules/services/nextcloud-server.nix
+++ b/modules/services/nextcloud-server.nix
@@ -1061,9 +1061,13 @@ in
     in lib.mkIf (cfg.enable && cfg.apps.sso.enable) {
       assertions = [
         {
-          assertion = cfg.apps.sso.enable -> cfg.apps.ldap.enable;
+          assertion = cfg.apps.ldap.enable;
           message = "SSO app requires LDAP app to work correctly.";
         }
+        {
+          assertion = cfg.ssl != null;
+          message = "To integrate SSO, SSL must be enabled, set the shb.nextcloud.ssl option.";
+        }
       ];
 
       systemd.services.nextcloud-setup.script =