Repository: certbot/certbot

Issue:
[nginx] Failed to obtain certificate: "tried to insert directive"
## My operating system is (include version):
```
$ uname -a
Linux dev 4.10.13-1-ARCH #1 SMP PREEMPT Thu Apr 27 12:15:09 CEST 2017 x86_64 GNU/Linux
$ pacman -Q | grep certbot
certbot 0.14.0-1
certbot-nginx 0.14.0-1
```

## I installed Certbot with (certbot-auto, OS package manager, pip, etc):
Arch Linux's `pacman`


## I ran this command and it produced this output:
```
$ sudo certbot --nginx -d www.getfambit.com,getfambit.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for www.getfambit.com
tls-sni-01 challenge for getfambit.com
Cleaning up challenges
2017/05/13 16:50:12 [notice] 16115#16115: signal process started
Problem in /etc/nginx/sites-enabled/www.getfambit.com: tried to insert directive "['#', ' Using list of ciphers from "Bulletproof SSL and TLS"']" but found conflicting "['#', ' managed by Certbot']".
```

## Certbot's behavior differed from what I expected because:
I expected it to obtain a certificate for "getfambit.com", but it failed with a directive error

## Here is a Certbot log showing the issue (if available):
###### Logs are stored in `/var/log/letsencrypt` by default. Feel free to redact domains, e-mail and IP addresses as you see fit.
I'm assuming that it's OK that tokens are in this log output. Worst comes to worst I can clear config and re-setup if these give away too much information:

```
2017-05-13 23:52:49,986:DEBUG:certbot.main:certbot version: 0.14.0
2017-05-13 23:52:49,988:DEBUG:certbot.main:Arguments: ['--nginx', '-d', 'www.getfambit.com,getfambit.com']
2017-05-13 23:52:49,988:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2017-05-13 23:52:50,080:DEBUG:certbot.plugins.selection:Requested authenticator nginx and installer nginx
2017-05-13 23:52:50,080:DEBUG:certbot.cli:Default Detector is Namespace(account=<certbot.cli._Default object at 0x7f63ff337550>, agree_dev_preview=None, allow_subset_of_names=<certbot.cli._Default object at 0x7f63ff337310>, apache=<certbot.cli._Default object at 0x7f63ff3480d0>, authenticator='nginx', break_my_certs=<certbot.cli._Default object at 0x7f63ff343190>, cert_path=<certbot.cli._Default object at 0x7f63ff3374d0>, certname=<certbot.cli._Default object at 0x7f63ff38aa10>, chain_path=<certbot.cli._Default object at 0x7f63ff31cc10>, checkpoints=<certbot.cli._Default object at 0x7f63ff337ed0>, config_dir=<certbot.cli._Default object at 0x7f63ff31c790>, config_file=None, configurator=<certbot.cli._Default object at 0x7f63ff38a4d0>, csr=<certbot.cli._Default object at 0x7f63ff343310>, debug=<certbot.cli._Default object at 0x7f63ff337c50>, debug_challenges=<certbot.cli._Default object at 0x7f63ff337d50>, dialog=None, domains='www.getfambit.com,getfambit.com', dry_run=<certbot.cli._Default object at 0x7f63ff38ac50>, duplicate=<certbot.cli._Default object at 0x7f63ff337650>, eff_email=<certbot.cli._Default object at 0x7f63ff31c5d0>, email=<certbot.cli._Default object at 0x7f63ff31c390>, expand=<certbot.cli._Default object at 0x7f63ff31cc90>, force_interactive=<certbot.cli._Default object at 0x7f63ff38a250>, fullchain_path=<certbot.cli._Default object at 0x7f63ff337090>, func=<function run at 0x7f63ff5ffde8>, hsts=<certbot.cli._Default object at 0x7f63ff343690>, http01_port=<certbot.cli._Default object at 0x7f63ff343090>, ifaces=<certbot.cli._Default object at 0x7f63ff3378d0>, init=<certbot.cli._Default object at 0x7f63ff337cd0>, installer='nginx', key_path=<certbot.cli._Default object at 0x7f63ff337290>, logs_dir=<certbot.cli._Default object at 0x7f63ff38ae10>, manual=<certbot.cli._Default object at 0x7f63ff3483d0>, manual_auth_hook=<certbot.cli._Default object at 0x7f63ff348610>, manual_cleanup_hook=<certbot.cli._Default object at 0x7f63ff348750>, manual_public_ip_logging_ok=<certbot.cli._Default object at 0x7f63ff348850>, must_staple=<certbot.cli._Default object at 0x7f63ff343390>, nginx=True, nginx_ctl=<certbot.cli._Default object at 0x7f63ff348a90>, nginx_server_root=<certbot.cli._Default object at 0x7f63ff3485d0>, no_bootstrap=<certbot.cli._Default object at 0x7f63ff337950>, no_self_upgrade=<certbot.cli._Default object at 0x7f63ff337850>, no_verify_ssl=<certbot.cli._Default object at 0x7f63ff337e50>, noninteractive_mode=<certbot.cli._Default object at 0x7f63ff38a510>, num=<certbot.cli._Default object at 0x7f63ff343710>, os_packages_only=<certbot.cli._Default object at 0x7f63ff337750>, post_hook=<certbot.cli._Default object at 0x7f63ff343f90>, pre_hook=<certbot.cli._Default object at 0x7f63ff343e90>, pref_challs=<certbot.cli._Default object at 0x7f63ff343d90>, prepare=<certbot.cli._Default object at 0x7f63ff337ad0>, quiet=<certbot.cli._Default object at 0x7f63ff337a50>, reason=<certbot.cli._Default object at 0x7f63ff343110>, redirect=<certbot.cli._Default object at 0x7f63ff343490>, register_unsafely_without_email=<certbot.cli._Default object at 0x7f63ff38ae90>, reinstall=<certbot.cli._Default object at 0x7f63ff31ca50>, renew_by_default=<certbot.cli._Default object at 0x7f63ff337110>, renew_hook=<certbot.cli._Default object at 0x7f63ff343e10>, renew_with_new_domains=<certbot.cli._Default object at 0x7f63ff337210>, rsa_key_size=<certbot.cli._Default object at 0x7f63ff343290>, server=<certbot.cli._Default object at 0x7f63ff38a990>, staging=<certbot.cli._Default object at 0x7f63ff337b50>, standalone=<certbot.cli._Default object at 0x7f63ff3482d0>, standalone_supported_challenges=<certbot.cli._Default object at 0x7f63ff348b90>, staple=<certbot.cli._Default object at 0x7f63ff343a90>, strict_permissions=<certbot.cli._Default object at 0x7f63ff343c90>, text_mode=<certbot.cli._Default object at 0x7f63ff322850>, tls_sni_01_port=<certbot.cli._Default object at 0x7f63ff337f50>, tos=<certbot.cli._Default object at 0x7f63ff337450>, uir=<certbot.cli._Default object at 0x7f63ff343890>, update_registration=<certbot.cli._Default object at 0x7f63ff31c150>, user_agent=<certbot.cli._Default object at 0x7f63ff343510>, validate_hooks=<certbot.cli._Default object at 0x7f63ff343c10>, verb='run', verbose_count=<certbot.cli._Default object at 0x7f63ff322550>, webroot=<certbot.cli._Default object at 0x7f63ff3484d0>, webroot_map=<certbot.cli._Default object at 0x7f63ff348d90>, webroot_path=<certbot.cli._Default object at 0x7f63ff348990>, work_dir=<certbot.cli._Default object at 0x7f63ff31c310>)
2017-05-13 23:52:50,105:DEBUG:certbot.log:Root logging level set at 20
2017-05-13 23:52:50,107:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2017-05-13 23:52:50,109:DEBUG:certbot.plugins.selection:Requested authenticator nginx and installer nginx
2017-05-13 23:52:51,240:DEBUG:certbot.plugins.selection:Single candidate plugin: * nginx
Description: Nginx Web Server plugin - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: nginx = certbot_nginx.configurator:NginxConfigurator
Initialized: <certbot_nginx.configurator.NginxConfigurator object at 0x7f6406e06810>
Prep: True
2017-05-13 23:52:51,243:DEBUG:certbot.plugins.selection:Selected authenticator <certbot_nginx.configurator.NginxConfigurator object at 0x7f6406e06810> and installer <certbot_nginx.configurator.NginxConfigurator object at 0x7f6406e06810>
2017-05-13 23:52:51,252:DEBUG:certbot.main:Picked account: <Account(RegistrationResource(body=Registration(status=None, contact=(u'mailto:mitchhentges@protonmail.com',), agreement=u'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf', key=JWKRSA(key=<ComparableRSAKey(<cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0x7f64020bf210>)>)), uri=u'https://acme-v01.api.letsencrypt.org/acme/reg/3196126', new_authzr_uri=u'https://acme-v01.api.letsencrypt.org/acme/new-authz', terms_of_service=u'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf'), bf082f2455ef934a1188a527cdf4d478, Meta(creation_host=u'dev', creation_dt=datetime.datetime(2016, 8, 14, 19, 8, 49, tzinfo=<UTC>)))>
2017-05-13 23:52:51,256:DEBUG:acme.client:Sending GET request to https://acme-v01.api.letsencrypt.org/directory.
2017-05-13 23:52:51,265:DEBUG:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
2017-05-13 23:52:51,735:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 352
2017-05-13 23:52:51,739:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Content-Type: application/json
Content-Length: 352
Boulder-Request-Id: OMR4R8wq1guxGXGHETL7vqOvmLH4GbiTiQawtAfntEI
Replay-Nonce: W7w1cNioH68MOP4wx6T_z12O9P5H8othNdXU4y85GKA
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Sat, 13 May 2017 23:52:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 13 May 2017 23:52:51 GMT
Connection: keep-alive

{
  "key-change": "https://acme-v01.api.letsencrypt.org/acme/key-change",
  "new-authz": "https://acme-v01.api.letsencrypt.org/acme/new-authz",
  "new-cert": "https://acme-v01.api.letsencrypt.org/acme/new-cert",
  "new-reg": "https://acme-v01.api.letsencrypt.org/acme/new-reg",
  "revoke-cert": "https://acme-v01.api.letsencrypt.org/acme/revoke-cert"
}
2017-05-13 23:52:51,792:INFO:certbot.main:Obtaining a new certificate
2017-05-13 23:52:51,793:DEBUG:acme.client:Requesting fresh nonce
2017-05-13 23:52:51,794:DEBUG:acme.client:Sending HEAD request to https://acme-v01.api.letsencrypt.org/acme/new-authz.
2017-05-13 23:52:51,925:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 "HEAD /acme/new-authz HTTP/1.1" 405 0
2017-05-13 23:52:51,928:DEBUG:acme.client:Received response:
HTTP 405
Server: nginx
Content-Type: application/problem+json
Content-Length: 91
Allow: POST
Boulder-Request-Id: 3_Fjlgzdiry-j4XkmiRsc87a-DXCR-ydhp7dQchgTfQ
Replay-Nonce: YNTBUXhU-NOwFDJU97UJsqqpkEZzZ8vgPU7XncClKP0
Expires: Sat, 13 May 2017 23:52:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 13 May 2017 23:52:51 GMT
Connection: keep-alive


2017-05-13 23:52:51,929:DEBUG:acme.client:Storing nonce: YNTBUXhU-NOwFDJU97UJsqqpkEZzZ8vgPU7XncClKP0
2017-05-13 23:52:51,930:DEBUG:acme.client:JWS payload:
{
  "identifier": {
    "type": "dns", 
    "value": "www.getfambit.com"
  }, 
  "resource": "new-authz"
}
2017-05-13 23:52:51,943:DEBUG:acme.client:Sending POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz:
{
  "header": {
    "alg": "RS256", 
    "jwk": {
      "e": "AQAB", 
      "kty": "RSA", 
      "n": "qKzvmq5FtrP9xrKEy3TvteE1bTRQbWL9YHAdQ5OL224jJfImIzH7TbD8f9fNzGJI3_rNAAfYhlfrzsBx1-J01iofO7BoIm2DBlf-7QDCFKiwkY0SAwFgEyOMbOx3Hc_0Dho9Tjx1WAyyjcMIpKGnNupE4xu1cysqliO52XnW06jx4XS0-tsLPcjcotDs2Vh0u7II3qPPUNuXP9Die_8PQA811waG3hDKGtCGpPB-0Y4IyKEGT22suczNwXVLBH6ooMNABTrDalIcn1DqaRx9fMjG5W2JqWiKohMPfTl5_JoVQ6MMoS8xTguZyYn2rrL2LWVSE1dRjwpBtBr89Y7qsQ"
    }
  }, 
  "protected": "eyJub25jZSI6ICJZTlRCVVhoVS1OT3dGREpVOTdVSnNxcXBrRVp6Wjh2Z1BVN1huY0NsS1AwIn0", 
  "payload": "ewogICJpZGVudGlmaWVyIjogewogICAgInR5cGUiOiAiZG5zIiwgCiAgICAidmFsdWUiOiAid3d3LmdldGZhbWJpdC5jb20iCiAgfSwgCiAgInJlc291cmNlIjogIm5ldy1hdXRoeiIKfQ", 
  "signature": "G_ZseP4ZqVjf9RHICR13-XU7wC32W60M_uVZxHCcAeqLR4-sC79_lD-d6JoLD6DiDgkBRpdYjSMxizYzuvvnSvpfQ7q92xq0sJToPPr0tABZfbHkBctYtf1YHH_K3HmfoZ05QQ8BRVqAmgJzcjTc8W12U13lmhy8Dh2726g7E93WAiC-smhs0IwWvsLNf-6VC36xW3wxrkj1gYydFYTwB9nTZci80zmvsmXQCuSYvDyPCqinOabSJfb23gZZz5s5Vg6IhOMOutHQ2F7rTQ6BLhWfn7wsFnUpVjUJX8fhjyX8RNx5XtpSBMkq0-Solh8AU6ldxiXrGRh7eQ_rMqE3tw"
}
2017-05-13 23:52:52,068:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 "POST /acme/new-authz HTTP/1.1" 201 1380
2017-05-13 23:52:52,071:DEBUG:acme.client:Received response:
HTTP 201
Server: nginx
Content-Type: application/json
Content-Length: 1380
Boulder-Request-Id: R-nKmPa8ajB0zAWiNzJPG91DYwTXmMCIjRQ8Scv6vec
Boulder-Requester: 3196126
Link: <https://acme-v01.api.letsencrypt.org/acme/new-cert>;rel="next"
Location: https://acme-v01.api.letsencrypt.org/acme/authz/jIMRLYYpHrMHTaOc7GxV0Tbv8uxDVadyxmLGBerN9gI
Replay-Nonce: nPjGlho_DTtqt_5GYt4PakDmK3tgLgkra0gi7T_3oLE
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Sat, 13 May 2017 23:52:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 13 May 2017 23:52:52 GMT
Connection: keep-alive

{
  "identifier": {
    "type": "dns",
    "value": "www.getfambit.com"
  },
  "status": "valid",
  "expires": "2017-06-08T07:03:47Z",
  "challenges": [
    {
      "type": "tls-sni-01",
      "status": "valid",
      "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/jIMRLYYpHrMHTaOc7GxV0Tbv8uxDVadyxmLGBerN9gI/1146990608",
      "token": "QMqxfC1xiolDCJ4WdAO87AD5pqFNxSINUJdMVlcFvZY",
      "keyAuthorization": "QMqxfC1xiolDCJ4WdAO87AD5pqFNxSINUJdMVlcFvZY.X_DbWKZ4dYQLc-h1OAMwZlxtXKp5rVNoI_65PAm1Xr4",
      "validationRecord": [
        {
          "hostname": "www.getfambit.com",
          "port": "443",
          "addressesResolved": [
            "24.67.156.140"
          ],
          "addressUsed": "24.67.156.140",
          "addressesTried": []
        }
      ]
    },
    {
      "type": "http-01",
      "status": "pending",
      "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/jIMRLYYpHrMHTaOc7GxV0Tbv8uxDVadyxmLGBerN9gI/1146990609",
      "token": "83h1-baXu7XRJN1fKBcQpRELRMEzxK5forqN4NSdY-s"
    },
    {
      "type": "dns-01",
      "status": "pending",
      "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/jIMRLYYpHrMHTaOc7GxV0Tbv8uxDVadyxmLGBerN9gI/1146990610",
      "token": "S7HBezp-qz_g5dlS8qHINlq9nniJXkz6i89kj-MqX-g"
    }
  ],
  "combinations": [
    [
      1
    ],
    [
      0
    ],
    [
      2
    ]
  ]
}
2017-05-13 23:52:52,072:DEBUG:acme.client:Storing nonce: nPjGlho_DTtqt_5GYt4PakDmK3tgLgkra0gi7T_3oLE
2017-05-13 23:52:52,075:DEBUG:acme.client:JWS payload:
{
  "identifier": {
    "type": "dns", 
    "value": "getfambit.com"
  }, 
  "resource": "new-authz"
}
2017-05-13 23:52:52,087:DEBUG:acme.client:Sending POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz:
{
  "header": {
    "alg": "RS256", 
    "jwk": {
      "e": "AQAB", 
      "kty": "RSA", 
      "n": "qKzvmq5FtrP9xrKEy3TvteE1bTRQbWL9YHAdQ5OL224jJfImIzH7TbD8f9fNzGJI3_rNAAfYhlfrzsBx1-J01iofO7BoIm2DBlf-7QDCFKiwkY0SAwFgEyOMbOx3Hc_0Dho9Tjx1WAyyjcMIpKGnNupE4xu1cysqliO52XnW06jx4XS0-tsLPcjcotDs2Vh0u7II3qPPUNuXP9Die_8PQA811waG3hDKGtCGpPB-0Y4IyKEGT22suczNwXVLBH6ooMNABTrDalIcn1DqaRx9fMjG5W2JqWiKohMPfTl5_JoVQ6MMoS8xTguZyYn2rrL2LWVSE1dRjwpBtBr89Y7qsQ"
    }
  }, 
  "protected": "eyJub25jZSI6ICJuUGpHbGhvX0RUdHF0XzVHWXQ0UGFrRG1LM3RnTGdrcmEwZ2k3VF8zb0xFIn0", 
  "payload": "ewogICJpZGVudGlmaWVyIjogewogICAgInR5cGUiOiAiZG5zIiwgCiAgICAidmFsdWUiOiAiZ2V0ZmFtYml0LmNvbSIKICB9LCAKICAicmVzb3VyY2UiOiAibmV3LWF1dGh6Igp9", 
  "signature": "EGJNrZ0-QOObWtVnWh4JLFXICH1r7SN2Ht-ASekBb_rq-Em10_GzQIPyqowB0q0icXSLoGiyVo0C4si62dJ5MG-EG6VztJ14uVDHQSablEaYCQGr55bp8BryNEMeEe0yA2JqKdfXEfYCVcx-ZINlY_Qwj_KrRUgqICgeWENarEgwC1CXfbYxP_Coa5l9plGnMTW7UsG-P-ZNkLD_TL_xGnHU7dCOM3-daA7WSYSui_8a8LhiS_4h17YR4JXTJixI_Poqm5z6RcVm7KUfdiCUWXVzePeQyobnhEGPFopIHW98drELn0lSebTKKNu1mWqtHvrNDSeUtOA5jnJsvE96eA"
}
2017-05-13 23:52:52,208:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 "POST /acme/new-authz HTTP/1.1" 201 1372
2017-05-13 23:52:52,212:DEBUG:acme.client:Received response:
HTTP 201
Server: nginx
Content-Type: application/json
Content-Length: 1372
Boulder-Request-Id: gGlV26_VP4n-gSeXMueIhc2EFSWcCeyojh1CvsZrmDA
Boulder-Requester: 3196126
Link: <https://acme-v01.api.letsencrypt.org/acme/new-cert>;rel="next"
Location: https://acme-v01.api.letsencrypt.org/acme/authz/PnoKfO714CAMcFnn8E_Z3vYhzFD8e2wMMKBucNgf6VE
Replay-Nonce: yyyTIER9VJsl3bjDeGdy8hRzd-8SSdRQethsbJgnveA
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
Expires: Sat, 13 May 2017 23:52:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 13 May 2017 23:52:52 GMT
Connection: keep-alive

{
  "identifier": {
    "type": "dns",
    "value": "getfambit.com"
  },
  "status": "valid",
  "expires": "2017-06-08T07:04:20Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "pending",
      "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/PnoKfO714CAMcFnn8E_Z3vYhzFD8e2wMMKBucNgf6VE/1146992312",
      "token": "ooslRJEWDlVW6IfKwqS__te2WWLoI7N9u1mF9AJm6M4"
    },
    {
      "type": "dns-01",
      "status": "pending",
      "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/PnoKfO714CAMcFnn8E_Z3vYhzFD8e2wMMKBucNgf6VE/1146992313",
      "token": "uakf1gf3SldfknzRFo1E9na_5jD7MceJ7Gx6145SO3k"
    },
    {
      "type": "tls-sni-01",
      "status": "valid",
      "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/PnoKfO714CAMcFnn8E_Z3vYhzFD8e2wMMKBucNgf6VE/1146992314",
      "token": "gIK0JTQL8qWe6yFZPJG6mjuyaRman4YuXZWSWvSBCkk",
      "keyAuthorization": "gIK0JTQL8qWe6yFZPJG6mjuyaRman4YuXZWSWvSBCkk.X_DbWKZ4dYQLc-h1OAMwZlxtXKp5rVNoI_65PAm1Xr4",
      "validationRecord": [
        {
          "hostname": "getfambit.com",
          "port": "443",
          "addressesResolved": [
            "24.67.156.140"
          ],
          "addressUsed": "24.67.156.140",
          "addressesTried": []
        }
      ]
    }
  ],
  "combinations": [
    [
      1
    ],
    [
      2
    ],
    [
      0
    ]
  ]
}
2017-05-13 23:52:52,212:DEBUG:acme.client:Storing nonce: yyyTIER9VJsl3bjDeGdy8hRzd-8SSdRQethsbJgnveA
2017-05-13 23:52:52,215:INFO:certbot.auth_handler:Performing the following challenges:
2017-05-13 23:52:52,216:INFO:certbot.auth_handler:tls-sni-01 challenge for www.getfambit.com
2017-05-13 23:52:52,217:INFO:certbot.auth_handler:tls-sni-01 challenge for getfambit.com
2017-05-13 23:52:52,508:DEBUG:certbot.crypto_util:Generating key (1024 bits): /var/lib/letsencrypt/snakeoil/0070_key.pem
2017-05-13 23:52:52,539:DEBUG:certbot.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/certbot/auth_handler.py", line 115, in _solve_challenges
    resp = self.auth.perform(self.achalls)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 805, in perform
    sni_response = chall_doer.perform()
  File "/usr/lib/python2.7/site-packages/certbot_nginx/tls_sni_01.py", line 55, in perform
    vhost = self.configurator.choose_vhost(achall.domain)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 247, in choose_vhost
    self._make_server_ssl(vhost)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 462, in _make_server_ssl
    vhost, ssl_block, replace=False)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/parser.py", line 313, in add_server_directives
    raise errors.MisconfigurationError("Problem in %s: %s" % (filename, str(err)))
MisconfigurationError: Problem in /etc/nginx/sites-enabled/www.getfambit.com: tried to insert directive "['#', ' Using list of ciphers from "Bulletproof SSL and TLS"']" but found conflicting "['#', ' managed by Certbot']".

2017-05-13 23:52:52,539:DEBUG:certbot.error_handler:Calling registered functions
2017-05-13 23:52:52,540:INFO:certbot.auth_handler:Cleaning up challenges
2017-05-13 23:52:54,594:DEBUG:certbot.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/certbot", line 11, in <module>
    load_entry_point('certbot==0.14.0', 'console_scripts', 'certbot')()
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 742, in main
    return config.func(config, plugins)
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 597, in run
    certname, lineage)
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 82, in _get_and_save_cert
    lineage = le_client.obtain_and_enroll_certificate(domains, certname)
  File "/usr/lib/python2.7/site-packages/certbot/client.py", line 344, in obtain_and_enroll_certificate
    certr, chain, key, _ = self.obtain_certificate(domains)
  File "/usr/lib/python2.7/site-packages/certbot/client.py", line 313, in obtain_certificate
    self.config.allow_subset_of_names)
  File "/usr/lib/python2.7/site-packages/certbot/auth_handler.py", line 74, in get_authorizations
    resp = self._solve_challenges()
  File "/usr/lib/python2.7/site-packages/certbot/auth_handler.py", line 115, in _solve_challenges
    resp = self.auth.perform(self.achalls)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 805, in perform
    sni_response = chall_doer.perform()
  File "/usr/lib/python2.7/site-packages/certbot_nginx/tls_sni_01.py", line 55, in perform
    vhost = self.configurator.choose_vhost(achall.domain)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 247, in choose_vhost
    self._make_server_ssl(vhost)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/configurator.py", line 462, in _make_server_ssl
    vhost, ssl_block, replace=False)
  File "/usr/lib/python2.7/site-packages/certbot_nginx/parser.py", line 313, in add_server_directives
    raise errors.MisconfigurationError("Problem in %s: %s" % (filename, str(err)))
MisconfigurationError: Problem in /etc/nginx/sites-enabled/www.getfambit.com: tried to insert directive "['#', ' Using list of ciphers from "Bulletproof SSL and TLS"']" but found conflicting "['#', ' managed by Certbot']".
```

Contents of /etc/nginx/sites-enabled/www.getfambit.com:
```
server {
    listen 80;
    server_name getfambit.com  www.getfambit.com;
    root /usr/share/nginx/www.getfambit.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

```



Discussion:
Hmm this seems like a bug. We're conflicting on a comment line.
In theory you should just be able to remove that bulletproof ssl line and it should work, but I'm going to pin @joohoi who has dealt with this part of apache config management before and might be able to fix it in the code.
Oh my mistake - this is nginx so I should ping @ohemorange 
Interestingly, there is no "bulletproof ssl line" to remove. I've posted my `nginx` config for that site, and it doesn't have any ssl-related configuration. Weird
@mitchhentges this is a bug, thanks for pointing it out. The correct fix in the meantime is to delete `/etc/letsencrypt/options-ssl-nginx.conf`.
Done. I had to remove the LetsEncrypt config from each of my virtual hosts and re-set it up, but now it's working again. Thanks!

Resolving patch:
diff --git a/certbot-nginx/certbot_nginx/parser.py b/certbot-nginx/certbot_nginx/parser.py
--- a/certbot-nginx/certbot_nginx/parser.py
+++ b/certbot-nginx/certbot_nginx/parser.py
@@ -529,7 +529,10 @@ def _add_directive(block, directive, replace):
 
     """
     directive = nginxparser.UnspacedList(directive)
-    if len(directive) == 0 or directive[0] == '#':
+    def is_whitespace_or_comment(directive):
+        """Is this directive either a whitespace or comment directive?"""
+        return len(directive) == 0 or directive[0] == '#'
+    if is_whitespace_or_comment(directive):
         # whitespace or comment
         block.append(directive)
         return
@@ -574,7 +577,8 @@ def can_append(loc, dir_name):
             for included_directive in included_directives:
                 included_dir_loc = find_location(included_directive)
                 included_dir_name = included_directive[0]
-                if not can_append(included_dir_loc, included_dir_name):
+                if not is_whitespace_or_comment(included_directive) \
+                    and not can_append(included_dir_loc, included_dir_name):
                     if block[included_dir_loc] != included_directive:
                         raise errors.MisconfigurationError(err_fmt.format(included_directive,
                             block[included_dir_loc]))


Test patch:
diff --git a/certbot-nginx/certbot_nginx/tests/parser_test.py b/certbot-nginx/certbot_nginx/tests/parser_test.py
--- a/certbot-nginx/certbot_nginx/tests/parser_test.py
+++ b/certbot-nginx/certbot_nginx/tests/parser_test.py
@@ -13,7 +13,7 @@
 from certbot_nginx.tests import util
 
 
-class NginxParserTest(util.NginxTest):
+class NginxParserTest(util.NginxTest): #pylint: disable=too-many-public-methods
     """Nginx Parser Test."""
 
     def setUp(self):
@@ -230,6 +230,33 @@ def test_add_server_directives(self):
                            ['ssl_certificate', '/etc/ssl/cert2.pem']],
                           replace=False)
 
+    def test_comment_is_repeatable(self):
+        nparser = parser.NginxParser(self.config_path)
+        example_com = nparser.abs_path('sites-enabled/example.com')
+        mock_vhost = obj.VirtualHost(example_com,
+                                     None, None, None,
+                                     set(['.example.com', 'example.*']),
+                                     None, [0])
+        nparser.add_server_directives(mock_vhost,
+                                      [['\n  ', '#', ' ', 'what a nice comment']],
+                                      replace=False)
+        nparser.add_server_directives(mock_vhost,
+                                      [['\n  ', 'include', ' ',
+                                      nparser.abs_path('comment_in_file.conf')]],
+                                      replace=False)
+        from certbot_nginx.parser import COMMENT
+        self.assertEqual(nparser.parsed[example_com],
+            [[['server'], [['listen', '69.50.225.155:9000'],
+                           ['listen', '127.0.0.1'],
+                           ['server_name', '.example.com'],
+                           ['server_name', 'example.*'],
+                           ['#', ' ', 'what a nice comment'],
+                           [],
+                           ['include', nparser.abs_path('comment_in_file.conf')],
+                           ['#', COMMENT],
+                           []]]]
+)
+
     def test_replace_server_directives(self):
         nparser = parser.NginxParser(self.config_path)
         target = set(['.example.com', 'example.*'])
diff --git a/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/comment_in_file.conf b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/comment_in_file.conf
new file mode 100644
--- /dev/null
+++ b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/comment_in_file.conf
@@ -0,0 +1 @@
+# a comment inside a file
\ No newline at end of file