Vm: Apache do not start after SSL with Let's Encrypt

[mr-manuel]

Steps to reproduce

1. Install empty Ubuntu 18.04 LTS Server with 2 disks
2. Execute the install script "https://raw.githubusercontent.com/nextcloud/vm/master/nextcloud_install_production.sh" and go trough the whole process.
3. After the reboot I changed the time zone and let the repositorys as the have been
4. In extra configuration I selected "Security" and "Automatic updates"
5. In the postfix configuration I selected "Internet connection" with the system mail name nc.mydomain.tld
6. I seleted automatic updates -> y -> y
7. I installed SSL -> y -> y -> y -> y -> nc.mydomain.tld -> y -> Do you feel brave and want to continue? y -> [email protected] -> enter. The certificate is successfully created and valid.
8. From this point on, the Apache service isn't starting anymore

Expected behaviour

Apache service should start normally with Let's Encrypt generated certificate

Actual behaviour

Apache do not restart, with the autoconfiguration done

Server configuration

Standard settings from install script

Nextcloud server version:
17.0.1

Server OS
Ubuntu 18.04 LTS Server

How did you install the VM? (Scripted install from master OR Released version)
Executed the command from https://docs.hanssonit.se/s/bj0vl1ihv0jgrmfm08j0/build-your-own/d/bj0vl4ahv0jgrmfm0950/nextcloud-vm
https://docs.hanssonit.se/s/bj0vl1ihv0jgrmfm08j0/build-your-own/d/bj0vl4ahv0jgrmfm0950/nextcloud-vm

Network

Do you use DHCP?
Yes

Is port 80 and/or 443 open?
Yes

Logs / Screenshots

# sudo systemctl restart apache2
Job for apache2.service failed because the control process exited with error code.
See "systemctl status apache2.service" and "journalctl -xe" for details.

\# systemctl status apache2.service
● apache2.service - The Apache HTTP Server
   Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/apache2.service.d
           └─apache2-systemd.conf
   Active: failed (Result: exit-code) since Wed 2019-11-13 14:13:02 CET; 5min ago
  Process: 944 ExecStart=/usr/sbin/apachectl start (code=exited, status=1/FAILURE)

Nov 13 14:13:00 nextcloud systemd[1]: Starting The Apache HTTP Server...
Nov 13 14:13:02 nextcloud apachectl[944]: AH00526: Syntax error on line 16 of /etc/apache2/sites-enabled/nc.domain.tld.conf:
Nov 13 14:13:02 nextcloud apachectl[944]: SSLStaplingCache cannot occur within <VirtualHost> section
Nov 13 14:13:02 nextcloud apachectl[944]: Action 'start' failed.
Nov 13 14:13:02 nextcloud apachectl[944]: The Apache error log may have more information.
Nov 13 14:13:02 nextcloud systemd[1]: apache2.service: Control process exited, code=exited status=1
Nov 13 14:13:02 nextcloud systemd[1]: apache2.service: Failed with result 'exit-code'.
Nov 13 14:13:02 nextcloud systemd[1]: Failed to start The Apache HTTP Server.

/etc/apache2/sites-enabled/nc.domain.tld.conf

<VirtualHost *:80>
    RewriteEngine On
    RewriteRule ^(.*)$ https://%{HTTP_HOST} [R=301,L]
</VirtualHost>

<VirtualHost *:443>

    Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
    SSLEngine on
    SSLCompression off
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder on
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    SSLSessionTickets off
    SSLUseStapling On
    SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

### YOUR SERVER ADDRESS ###

    ServerAdmin [email protected]
    ServerName nc.domain.tld

### SETTINGS ###
    <FilesMatch "\.php$">
        SetHandler "proxy:unix:/run/php/php7.2-fpm.nextcloud.sock|fcgi://localhost"
    </FilesMatch>

    DocumentRoot /var/www/nextcloud

    <Directory /var/www/nextcloud>
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
    Satisfy Any
    </Directory>

    <IfModule mod_dav.c>
    Dav off
    </IfModule>

    SetEnv HOME /var/www/nextcloud
    SetEnv HTTP_HOME /var/www/nextcloud

    # The following lines prevent .htaccess and .htpasswd files from being
    # viewed by Web clients.
    <Files ".ht*">
    Require all denied
    </Files>

    # Disable HTTP TRACE method.
    TraceEnable off
    # Disable HTTP TRACK method.
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} ^TRACK
    RewriteRule .* - [R=405,L]

    # Avoid "Sabre\DAV\Exception\BadRequest: expected filesize XXXX got XXXX"
    <IfModule mod_reqtimeout.c>
    RequestReadTimeout body=0
    </IfModule>

### LOCATION OF CERT FILES ###

    SSLCertificateChainFile /etc/letsencrypt/live/nc.domain.tld/chain.pem
    SSLCertificateFile /etc/letsencrypt/live/nc.domain.tld/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/nc.domain.tld/privkey.pem
    SSLOpenSSLConfCmd DHParameters /etc/letsencrypt/live/nc.domain.tld/dhparam.pem

</VirtualHost>

Log file (/mnt/ncdata/nextcloud.log)

no log is written

Installation log (command output)

no output

[enoch85]

Hi!

Thanks for your detailed report!

Nov 13 14:13:02 nextcloud apachectl[944]: SSLStaplingCache cannot occur within section
Nov 13 14:13:02 nextcloud apachectl[944]: Action 'start' failed.

What happens if you remove

    SSLUseStapling On
    SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

and then issues sudo service apache2 restart?

[mr-manuel]

Hi,

you're welcome. When I comment/remove the two lines the apache2 service successfully boots up.

Another thing that I noticed now: Every time I logon with the user with whom I lauched the script I get the "first setup" screen, even if I completed the setup successfully.

+-----------------------------------------------------------------------+
|      Welcome to the first setup of your own Nextcloud Server! :)      |
|                                                                       |
| To run the startup script type the sudoer password, then hit [ENTER]. |
| The default sudoer password is: nextcloud                             |
|                                                                       |
| You can find the complete install instructions here:                  |
| Nextcloud VM              = https://bit.ly/2S8eGfS                    |
| Nextcloud Home/SME Server = https://bit.ly/2k2TNaM                    |
|                                                                       |
| To be 100% sure that all the keystrokes work correctly (like @),      |
| please use an SSH terminal like Putty. You can download it here:      |
| https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html        |
| Connect like this: [email protected]                    |
|                                                                       |
| You can schedule the Nextcloud update process using a cron job.       |
| This is done using a script built into this server that automatically |
| updates Nextcloud, sets secure permissions, and logs the successful   |
| update to /var/log/nextcloud/update_run.log                           |
| Just choose to configure it when asked to do so later in this script. |
|                                                                       |
|  ###################### T&M Hansson IT - 2019 ######################  |
+-----------------------------------------------------------------------+

[enoch85]

Great! Thanks for the info, I will fix that right away!

You need to redo the whole process again.

1. Remove the VM completely
2. Import it
3. Run the first setup.

Hope it helps!

[enoch85]

The issue should now be fixed, please report back how it went.

Thanks!

[mr-manuel]

I installed it now on 3 different virtual machines and it works perfect now, thank you!

[enoch85]

Thanks for confirming!