Repository: certbot/certbot

Issue:
Multiple Apache Vhosts tests failed with augeas 1.7+
## My operating system is (include version):
Arch Linux latest

## I installed Certbot with (certbot-auto, OS package manager, pip, etc):
git clone

## I ran this command and it produced this output:
```
TOXENV=py36 tox
======================================================================
ERROR: test_choose_vhost_wildcard_found (certbot_apache.tests.configurator_test.AugeasVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1296, in test_choose_vhost_wildcard_found
    self.config.choose_vhost(name)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_choose_vhost_wildcard_not_found (certbot_apache.tests.configurator_test.AugeasVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1285, in test_choose_vhost_wildcard_not_found
    self.config.choose_vhost(name)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 339, in choose_vhost
    return self._choose_vhost_from_list(target_name, temp)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 360, in _choose_vhost_from_list
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_choose_vhost_with_matching_wildcard (certbot_apache.tests.configurator_test.AugeasVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1268, in test_choose_vhost_with_matching_wildcard
    self.assertFalse(name in self.config.choose_vhost(name).aliases)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_choose_vhost_without_matching_wildcard (certbot_apache.tests.configurator_test.AugeasVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1274, in test_choose_vhost_without_matching_wildcard
    self.assertTrue(name in self.config.choose_vhost(name).aliases)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 339, in choose_vhost
    return self._choose_vhost_from_list(target_name, temp)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 360, in _choose_vhost_from_list
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_make_vhost_ssl (certbot_apache.tests.configurator_test.MultiVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1328, in test_make_vhost_ssl
    ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[1])
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_make_vhost_ssl_with_existing_rewrite_conds (certbot_apache.tests.configurator_test.MultiVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1395, in test_make_vhost_ssl_with_existing_rewrite_conds
    ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[3])
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_make_vhost_ssl_with_existing_rewrite_rule (certbot_apache.tests.configurator_test.MultiVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1376, in test_make_vhost_ssl_with_existing_rewrite_rule
    ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[4])
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_choose_vhost_select_vhost_non_ssl (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 230, in test_choose_vhost_select_vhost_non_ssl
    chosen_vhost = self.config.choose_vhost("none.com")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 339, in choose_vhost
    return self._choose_vhost_from_list(target_name, temp)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 360, in _choose_vhost_from_list
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_http_header_hsts_twice (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 963, in test_http_header_hsts_twice
    "Strict-Transport-Security")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed ensure-http-header for encryption-example.demo
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_http_header_hsts (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 941, in test_http_header_hsts
    "Strict-Transport-Security")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed ensure-http-header for certbot.demo
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_http_header_uir (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 979, in test_http_header_uir
    "Upgrade-Insecure-Requests")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed ensure-http-header for certbot.demo
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_http_header_uir_twice (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1001, in test_http_header_uir_twice
    "Upgrade-Insecure-Requests")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed ensure-http-header for encryption-example.demo
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_make_vhost_ssl (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 602, in test_make_vhost_ssl
    ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[0])
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

======================================================================
ERROR: test_ocsp_stapling (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 862, in test_ocsp_stapling
    self.config.enhance("certbot.demo", "staple-ocsp")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed staple-ocsp for certbot.demo
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_redirect_from_previous_run (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1144, in test_redirect_from_previous_run
    self.config.enhance("red.blue.purple.com", "redirect")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed redirect for red.blue.purple.com
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_redirect_two_domains_one_vhost (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1132, in test_redirect_two_domains_one_vhost
    self.config.enhance("red.blue.purple.com", "redirect")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed redirect for red.blue.purple.com
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_redirect_well_formed_http (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1016, in test_redirect_well_formed_http
    self.config.enhance("certbot.demo", "redirect")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original
-------------------- >> begin captured logging << --------------------
certbot_apache.configurator: WARNING: Failed redirect for certbot.demo
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_redirect_with_existing_rewrite (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1067, in test_redirect_with_existing_rewrite
    self.config.enhance("certbot.demo", "redirect")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1218, in enhance
    func(self.choose_vhost(domain), options)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 844, in make_vhost_ssl
    self._copy_create_ssl_vhost_skeleton(nonssl_vhost, ssl_fp)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 963, in _copy_create_ssl_vhost_skeleton
    ssl_vh_contents, sift = self._sift_rewrite_rules(orig_contents)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 1007, in _sift_rewrite_rules
    if B and not self._sift_rewrite_rule(line):
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 932, in _sift_rewrite_rule
    target = line.split()[2].strip()
IndexError: list index out of range
-------------------- >> begin captured logging << --------------------
certbot.reverter: DEBUG: Creating backup of /tmp/tmpwjw3vo_atemp/debian_apache_2_4/multiple_vhosts/apache2/sites-available/certbot.conf
--------------------- >> end captured logging << ---------------------

======================================================================
ERROR: test_redirect_with_old_https_redirection (certbot_apache.tests.configurator_test.MultipleVhostsTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yen/Projects/certbot/.tox/py36/lib/python3.6/site-packages/mock/mock.py", line 1305, in patched
    return func(*args, **keywargs)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/tests/configurator_test.py", line 1092, in test_redirect_with_old_https_redirection
    ssl_vhost = self.config.choose_vhost("certbot.demo")
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 333, in choose_vhost
    vhost = self.make_vhost_ssl(vhost)
  File "/home/yen/Projects/certbot/certbot-apache/certbot_apache/configurator.py", line 857, in make_vhost_ssl
    "Could not reverse map the HTTPS VirtualHost to the original")
certbot.errors.PluginError: Could not reverse map the HTTPS VirtualHost to the original

----------------------------------------------------------------------
Ran 167 tests in 6.005s

FAILED (errors=19)
```

## Certbot's behavior differed from what I expected because:
All tests should pass.

```TOXENV=py27 tox``` results in the same errors, so it's not a Python 2/3 trap.
I tried augeas 1.4.0, 1.5.0, 1.6.0, 1.7.0 and 1.8.0. Versions newer or equal to 1.7.0 break tests.

## Here is a Certbot log showing the issue (if available):
###### Logs are stored in `/var/log/letsencrypt` by default. Feel free to redact domains, e-mail and IP addresses as you see fit.
N/A


Discussion:
Thanks for reporting this @yan12125.

cc @joohoi 
At least part of the problem is due to the bug I filed with Augeas at hercules-team/augeas#466. I'll continue investigating this issue once we have a workaround for that problem.

Resolving patch:
diff --git a/certbot-apache/certbot_apache/augeas_configurator.py b/certbot-apache/certbot_apache/augeas_configurator.py
--- a/certbot-apache/certbot_apache/augeas_configurator.py
+++ b/certbot-apache/certbot_apache/augeas_configurator.py
@@ -120,8 +120,8 @@ def save(self, title=None, temporary=False):
 
         # If the augeas tree didn't change, no files were saved and a backup
         # should not be created
+        save_files = set()
         if save_paths:
-            save_files = set()
             for path in save_paths:
                 save_files.add(self.aug.get(path)[6:])
 
@@ -140,6 +140,12 @@ def save(self, title=None, temporary=False):
         self.save_notes = ""
         self.aug.save()
 
+        # Force reload if files were modified
+        # This is needed to recalculate augeas directive span
+        if save_files:
+            for sf in save_files:
+                self.aug.remove("/files/"+sf)
+            self.aug.load()
         if title and not temporary:
             try:
                 self.reverter.finalize_checkpoint(title)
diff --git a/certbot-apache/certbot_apache/configurator.py b/certbot-apache/certbot_apache/configurator.py
--- a/certbot-apache/certbot_apache/configurator.py
+++ b/certbot-apache/certbot_apache/configurator.py
@@ -1065,8 +1065,28 @@ def _get_vhost_block(self, vhost):
         span_end = span_val[6]
         with open(span_filep, 'r') as fh:
             fh.seek(span_start)
-            vh_contents = fh.read(span_end-span_start)
-        return vh_contents.split("\n")
+            vh_contents = fh.read(span_end-span_start).split("\n")
+        self._remove_closing_vhost_tag(vh_contents)
+        return vh_contents
+
+    def _remove_closing_vhost_tag(self, vh_contents):
+        """Removes the closing VirtualHost tag if it exists.
+
+        This method modifies vh_contents directly to remove the closing
+        tag. If the closing vhost tag is found, everything on the line
+        after it is also removed. Whether or not this tag is included
+        in the result of span depends on the Augeas version.
+
+        :param list vh_contents: VirtualHost block contents to check
+
+        """
+        for offset, line in enumerate(reversed(vh_contents)):
+            if line:
+                line_index = line.lower().find("</virtualhost>")
+                if line_index != -1:
+                    content_index = len(vh_contents) - offset - 1
+                    vh_contents[content_index] = line[:line_index]
+                break
 
     def _update_ssl_vhosts_addrs(self, vh_path):
         ssl_addrs = set()


Test patch:
diff --git a/certbot-apache/certbot_apache/tests/configurator_test.py b/certbot-apache/certbot_apache/tests/configurator_test.py
--- a/certbot-apache/certbot_apache/tests/configurator_test.py
+++ b/certbot-apache/certbot_apache/tests/configurator_test.py
@@ -597,6 +597,21 @@ def test_prepare_server_https_mixed_listen(self):
         # already listens to the correct port
         self.assertEqual(mock_add_dir.call_count, 0)
 
+    def test_make_vhost_ssl_with_mock_span(self):
+        # span excludes the closing </VirtualHost> tag in older versions
+        # of Augeas
+        return_value = [self.vh_truth[0].filep, 1, 12, 0, 0, 0, 1142]
+        with mock.patch.object(self.config.aug, 'span') as mock_span:
+            mock_span.return_value = return_value
+            self.test_make_vhost_ssl()
+
+    def test_make_vhost_ssl_with_mock_span2(self):
+        # span includes the closing </VirtualHost> tag in newer versions
+        # of Augeas
+        return_value = [self.vh_truth[0].filep, 1, 12, 0, 0, 0, 1157]
+        with mock.patch.object(self.config.aug, 'span') as mock_span:
+            mock_span.return_value = return_value
+            self.test_make_vhost_ssl()
 
     def test_make_vhost_ssl(self):
         ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[0])