Nextcloud-snap: Enabling HTTPS with custom certifcate in unreadable directory results in unhelpful error

[JWise1203]

Using Ubuntu 16.04 server
Certificates located in: /var/snap/nextcloud/common

Command run: sudo nextcloud.enable-https custom -s nextcloud.pem nextcloud.key nextcloud-intermediates.pem

Output:

Installing custom certificate... done
Restarting apache... error
Certificates have been activated: using HTTPS only
Certificates look to be in order: enabling HSTS
AH00526: Syntax error on line 96 of /snap/nextcloud/1284/conf/ssl.conf:
SSLCertificateFile: file '/var/snap/nextcloud/1284/certs/live/cert.pem' does not exist or is empty

[kyrofa]

Well darn that error could be more helpful huh?

Read the help page for the custom subcommand:

$ sudo nextcloud.enable-https custom -h
Usage:
    nextcloud.enable-https custom [-h -s] <cert> <key> <chain>

    Use certificates generated by other means. Note that
    the files provided to this command must be readable
    by the snap, which means they must contained in one
    of four directory trees:
      - /var/snap/nextcloud/current
      - /var/snap/nextcloud/common
      - /root/snap/nextcloud/1284
      - /root/snap/nextcloud/common

    Also note that this command will create copies of the
    files provided; if this command completes
    successfully, they can be safely removed.

    -h: Display this help message.
    -s: Enable HTTP Strict Transport Security (HSTS)
        (default is off-- leave off if self-signed).

Specifically this part:

    <snip> Note that
    the files provided to this command must be readable
    by the snap, which means they must contained in one
    of four directory trees:
      - /var/snap/nextcloud/current
      - /var/snap/nextcloud/common
      - /root/snap/nextcloud/1284
      - /root/snap/nextcloud/common

The reason for this is confinement: the enable-https command doesn't have permission to access any part of the filesystem outside of those directories. The errors that occur if you don't adhere to that, though, are awful, so I'll fix that.

[JWise1203]

Thanks for the reply. As I noticed in my post, I did put the certificates in: /var/snap/nextcloud/common

Should I be putting them in another directory?

[kyrofa]

Oh! I missed that. The error you got is exactly what I got when I didn't put it in the correct directory. I just walked through putting them in /var/snap/nextcloud/common/ and it worked fine. Can you double check? If you were indeed in that directory, I can't seem to be able to reproduce.

[ysagon]

It seems you need to specify the full path, not only the filename.

[kyrofa]

Indeed, the snap doesn't know where you put it, it just needs to be in an area it can access. And then, yes, you need to tell it the full path.