{"action":"created","issue":{"url":"https://api.github.com/repos/certbot/certbot/issues/5199","repository_url":"https://api.github.com/repos/certbot/certbot","labels_url":"https://api.github.com/repos/certbot/certbot/issues/5199/labels{/name}","comments_url":"https://api.github.com/repos/certbot/certbot/issues/5199/comments","events_url":"https://api.github.com/repos/certbot/certbot/issues/5199/events","html_url":"https://github.com/certbot/certbot/issues/5199","id":267401961,"number":5199,"title":"certbot with nginx fails if directives are already defined","user":{"login":"pwaring","id":433556,"avatar_url":"https://avatars3.githubusercontent.com/u/433556?v=4","gravatar_id":"","url":"https://api.github.com/users/pwaring","html_url":"https://github.com/pwaring","followers_url":"https://api.github.com/users/pwaring/followers","following_url":"https://api.github.com/users/pwaring/following{/other_user}","gists_url":"https://api.github.com/users/pwaring/gists{/gist_id}","starred_url":"https://api.github.com/users/pwaring/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwaring/subscriptions","organizations_url":"https://api.github.com/users/pwaring/orgs","repos_url":"https://api.github.com/users/pwaring/repos","events_url":"https://api.github.com/users/pwaring/events{/privacy}","received_events_url":"https://api.github.com/users/pwaring/received_events","type":"User","site_admin":false},"labels":[{"id":258836706,"url":"https://api.github.com/repos/certbot/certbot/labels/area:%20nginx","name":"area: nginx","color":"c5def5","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-10-21T18:10:18Z","updated_at":"2017-10-24T07:42:48Z","closed_at":"2017-10-23T20:34:50Z","author_association":"NONE","body":"## My operating system is (include version):\r\n\r\nUbuntu 16.04.3 LTS (GNU/Linux 4.4.0-96-generic x86_64)\r\n\r\nnginx version: nginx/1.10.3 (Ubuntu)\r\ncertbot version: 0.17.0\r\n\r\n## I installed Certbot with (certbot-auto, OS package manager, pip, etc):\r\n\r\nPackage manager (apt) using the certbot PPA (`ppa:certbot/certbot`). The package I installed was: `python-certbot-nginx`.\r\n\r\n## I ran this command and it produced this output:\r\n\r\n```\r\n# certbot certonly --nginx -d baldursgate.rixort.com\r\nSaving debug log to /var/log/letsencrypt/letsencrypt.log\r\nObtaining a new certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for baldursgate.rixort.com\r\nnginx: [emerg] \"server_names_hash_bucket_size\" directive is duplicate in /etc/nginx/conf.d/01-server-names.conf:1\r\nCleaning up challenges\r\nnginx restart failed:\r\n```\r\n\r\n## Certbot's behavior differed from what I expected because:\r\n\r\nI expected the certificate to be created. I've run the same command (`certbot certonly --nginx -d [domain]`) on another machine without any problems.\r\n\r\nThe issue seems to be that certbot adds a `server_names_hash_bucket_size 128;` entry to the `nginx.conf` file that it tries to generate (I'm assuming it shuts down nginx, starts a new instance, gets the certificates and then restarts the system nginx?). However, I've already defined `server_names_hash_bucket_size 64;` in `/etc/nginx/conf.d/01-server-names.conf`. As a result, nginx fails to restart because there are two definitions of the same directive.\r\n\r\nIf I run `nginx -t` on my configuration *without* certbot then it returns:\r\n\r\n```\r\nnginx: the configuration file /etc/nginx/nginx.conf syntax is ok\r\nnginx: configuration file /etc/nginx/nginx.conf test is successful\r\n```\r\n\r\nSo I think the problem is with certbot, rather than my configuration. All my sites load correctly as well when I'm not using certbot.\r\n\r\n## Here is a Certbot log showing the issue (if available):\r\n###### Logs are stored in `/var/log/letsencrypt` by default. Feel free to redact domains, e-mail and IP addresses as you see fit.\r\n\r\nContents of `/var/log/letsencrypt/letsencrypt.log`:\r\n\r\n```\r\n2017-10-21 17:37:51,497:DEBUG:certbot.main:certbot version: 0.17.0\r\n2017-10-21 17:37:51,497:DEBUG:certbot.main:Arguments: ['--nginx', '-d', 'baldursgate.rixort.com']\r\n2017-10-21 17:37:51,497:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)\r\n2017-10-21 17:37:51,515:DEBUG:certbot.log:Root logging level set at 20\r\n2017-10-21 17:37:51,516:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log\r\n2017-10-21 17:37:51,517:DEBUG:certbot.plugins.selection:Requested authenticator nginx and installer nginx\r\n2017-10-21 17:37:51,704:DEBUG:certbot.plugins.selection:Single candidate plugin: * nginx\r\nDescription: Nginx Web Server plugin - Alpha\r\nInterfaces: IAuthenticator, IInstaller, IPlugin\r\nEntry point: nginx = certbot_nginx.configurator:NginxConfigurator\r\nInitialized: <certbot_nginx.configurator.NginxConfigurator object at 0x7f5e6b4df990>\r\nPrep: True\r\n2017-10-21 17:37:51,706:DEBUG:certbot.plugins.selection:Single candidate plugin: * nginx\r\nDescription: Nginx Web Server plugin - Alpha\r\nInterfaces: IAuthenticator, IInstaller, IPlugin\r\nEntry point: nginx = certbot_nginx.configurator:NginxConfigurator\r\nInitialized: <certbot_nginx.configurator.NginxConfigurator object at 0x7f5e6b4df990>\r\nPrep: True\r\n2017-10-21 17:37:51,706:DEBUG:certbot.plugins.selection:Selected authenticator <certbot_nginx.configurator.NginxConfigurator object at 0x7f5e6b4df990> and installer <certbot_nginx.configurator.NginxConfigurator object at 0x7f5e6b4df990>\r\n2017-10-21 17:37:51,710:DEBUG:certbot.main:Picked account: <Account(RegistrationResource(body=Registration(status=None, contact=(u'mailto:paul@xk7.net',), agreement=u'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf', key=JWKRSA(key=<ComparableRSAKey(<cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0x7f5e6ff22150>)>)), uri=u'https://acme-v01.api.letsencrypt.org/acme/reg/23041370', new_authzr_uri=u'https://acme-v01.api.letsencrypt.org/acme/new-authz', terms_of_service=u'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf'), 530e68ede5c3d15b8b84c8aabba88044, Meta(creation_host=u'quark.default.pwaring.uk0.bigv.io', creation_dt=datetime.datetime(2017, 10, 21, 16, 43, 23, tzinfo=<UTC>)))>\r\n2017-10-21 17:37:51,712:DEBUG:acme.client:Sending GET request to https://acme-v01.api.letsencrypt.org/directory.\r\n2017-10-21 17:37:51,732:DEBUG:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org\r\n2017-10-21 17:37:51,952:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"GET /directory HTTP/1.1\" 200 561\r\n2017-10-21 17:37:51,953:DEBUG:acme.client:Received response:\r\nHTTP 200\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 561\r\nReplay-Nonce: ifQQwU3PMlcfrWLFBkQwHdprHrxewWEK5DyfHLzixI8\r\nX-Frame-Options: DENY\r\nStrict-Transport-Security: max-age=604800\r\nExpires: Sat, 21 Oct 2017 17:37:51 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Sat, 21 Oct 2017 17:37:51 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"key-change\": \"https://acme-v01.api.letsencrypt.org/acme/key-change\",\r\n  \"meta\": {\r\n    \"terms-of-service\": \"https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf\"\r\n  },\r\n  \"new-authz\": \"https://acme-v01.api.letsencrypt.org/acme/new-authz\",\r\n  \"new-cert\": \"https://acme-v01.api.letsencrypt.org/acme/new-cert\",\r\n  \"new-reg\": \"https://acme-v01.api.letsencrypt.org/acme/new-reg\",\r\n  \"revoke-cert\": \"https://acme-v01.api.letsencrypt.org/acme/revoke-cert\",\r\n  \"w3n51rRvSp4\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"\r\n}\r\n2017-10-21 17:37:51,956:INFO:certbot.main:Obtaining a new certificate\r\n2017-10-21 17:37:51,957:DEBUG:acme.client:Requesting fresh nonce\r\n2017-10-21 17:37:51,957:DEBUG:acme.client:Sending HEAD request to https://acme-v01.api.letsencrypt.org/acme/new-authz.\r\n2017-10-21 17:37:52,148:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"HEAD /acme/new-authz HTTP/1.1\" 405 0\r\n2017-10-21 17:37:52,149:DEBUG:acme.client:Received response:\r\nHTTP 405\r\nServer: nginx\r\nContent-Type: application/problem+json\r\nContent-Length: 91\r\nAllow: POST\r\nReplay-Nonce: aVafyNZChyGzVxP43hqhZ1d9pb7zoo1wTRTSXRR4pkM\r\nExpires: Sat, 21 Oct 2017 17:37:52 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Sat, 21 Oct 2017 17:37:52 GMT\r\nConnection: keep-alive\r\n\r\n\r\n2017-10-21 17:37:52,149:DEBUG:acme.client:Storing nonce: aVafyNZChyGzVxP43hqhZ1d9pb7zoo1wTRTSXRR4pkM\r\n2017-10-21 17:37:52,150:DEBUG:acme.client:JWS payload:\r\n{\r\n  \"identifier\": {\r\n    \"type\": \"dns\", \r\n    \"value\": \"baldursgate.rixort.com\"\r\n  }, \r\n  \"resource\": \"new-authz\"\r\n}\r\n2017-10-21 17:37:52,153:DEBUG:acme.client:Sending POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz:\r\n{\r\n  \"protected\": \"eyJub25jZSI6ICJhVmFmeU5aQ2h5R3pWeFA0M2hxaFoxZDlwYjd6b28xd1RSVFNYUlI0cGtNIiwgImFsZyI6ICJSUzI1NiIsICJqd2siOiB7ImUiOiAiQVFBQiIsICJrdHkiOiAiUlNBIiwgIm4iOiAiMFVaWUM3U0E2S0VhTFpjTGlHSUwtZlZPUlQtNjlTdVFGaGdGTDNDajkyUGM0MFh4UzNrMm8ya2lONUtwaTdQREJwVmQ5djBfSXljZFFGZTVxQ1BCV1hHSk90d2xxOUhxOVNERXN1QXN6M00wSkY0NThMS1B2UDhMVW9ETUJ4NWZaZXo3NkxubGtPeU5CODZlM3lXWVN1SVB4VG4wdU5UWDZoS3JjZHBnaG5UYjNjVU9IUl9MV1R3X3RoTVVpWHVrbVFtYzJ2TE9JYlNrU3ZMSmh6dWVaZDh3VW9vLXJHQTVmUV82My02UW0xYlluWEtFVF9aRllIY3BYNW9oNE9WSjhNVkpmbTdOa0hHLWl4RG81bDUyNnBHU2NCckZEcUgzQTM0Y1pmNjkzTW1rRHVuQVdLVUF5TkZaXzNDNDZ4TGpoclkyZi1hekFkM3ZZVHFGa3JSaTJRIn19\", \r\n  \"payload\": \"ewogICJpZGVudGlmaWVyIjogewogICAgInR5cGUiOiAiZG5zIiwgCiAgICAidmFsdWUiOiAiYmFsZHVyc2dhdGUucml4b3J0LmNvbSIKICB9LCAKICAicmVzb3VyY2UiOiAibmV3LWF1dGh6Igp9\", \r\n  \"signature\": \"xG9PLFkO48jtJ0rWDrjyaHoIVv7WpreoeLeBTbvzDC6Mt5AiENBNoEMtMQYn1URMaDq50pdUw_ciyvHt0-H1BSb8LD0Aj0Ee7y5hkhZj7uyhrfrMWLY7zxDQ-SMT254ACBle8xFT-7rJOq6ueCYh9eMKQ8yXUmM9ZqbPn0B1-nB1LuwQ3NVq7UPhFRb7UP2pmZwlzkAsR7aCGKovIqEQ2O79tVQBi9rS5sKlbWNecJNbvEe-0MtUNIg5Z2QvCZAMJFmpZ9jaMCXfHDb5eNBmH087kl1fYhjbe9jcq4_DPFBrIuhfRGWWnW9Na72PIA4B6rdqSeHmVM_5Ps-gkxez7Q\"\r\n}\r\n2017-10-21 17:37:52,359:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 \"POST /acme/new-authz HTTP/1.1\" 201 1000\r\n2017-10-21 17:37:52,360:DEBUG:acme.client:Received response:\r\nHTTP 201\r\nServer: nginx\r\nContent-Type: application/json\r\nContent-Length: 1000\r\nBoulder-Requester: 23041370\r\nLink: <https://acme-v01.api.letsencrypt.org/acme/new-cert>;rel=\"next\"\r\nLocation: https://acme-v01.api.letsencrypt.org/acme/authz/3Iiab4sxjF2BZaG8CwDvMZRtBnJMLsQgs7ItqVqhCvo\r\nReplay-Nonce: yxYML9unpcpmcoENrOHaKJmyIs2RzoOz5_upaBzT7H8\r\nX-Frame-Options: DENY\r\nStrict-Transport-Security: max-age=604800\r\nExpires: Sat, 21 Oct 2017 17:37:52 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Sat, 21 Oct 2017 17:37:52 GMT\r\nConnection: keep-alive\r\n\r\n{\r\n  \"identifier\": {\r\n    \"type\": \"dns\",\r\n    \"value\": \"baldursgate.rixort.com\"\r\n  },\r\n  \"status\": \"pending\",\r\n  \"expires\": \"2017-10-28T17:14:19Z\",\r\n  \"challenges\": [\r\n    {\r\n      \"type\": \"tls-sni-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/3Iiab4sxjF2BZaG8CwDvMZRtBnJMLsQgs7ItqVqhCvo/2267292169\",\r\n      \"token\": \"Ox6GxItCCa7iOc8HBjvdRXDEZOZ3QhdGlYsOa-2CWAw\"\r\n    },\r\n    {\r\n      \"type\": \"dns-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/3Iiab4sxjF2BZaG8CwDvMZRtBnJMLsQgs7ItqVqhCvo/2267292170\",\r\n      \"token\": \"iVM9nHEuOQFMTf90Ut8gbylaIvFUNrFxyKmvCMRcvKc\"\r\n    },\r\n    {\r\n      \"type\": \"http-01\",\r\n      \"status\": \"pending\",\r\n      \"uri\": \"https://acme-v01.api.letsencrypt.org/acme/challenge/3Iiab4sxjF2BZaG8CwDvMZRtBnJMLsQgs7ItqVqhCvo/2267292171\",\r\n      \"token\": \"xF1zb9ypIKh5rjwNTHBLtT5nhIh_-xNdBWWCzFytCSU\"\r\n    }\r\n  ],\r\n  \"combinations\": [\r\n    [\r\n      0\r\n    ],\r\n    [\r\n      1\r\n    ],\r\n    [\r\n      2\r\n    ]\r\n  ]\r\n}\r\n2017-10-21 17:37:52,360:DEBUG:acme.client:Storing nonce: yxYML9unpcpmcoENrOHaKJmyIs2RzoOz5_upaBzT7H8\r\n2017-10-21 17:37:52,361:INFO:certbot.auth_handler:Performing the following challenges:\r\n2017-10-21 17:37:52,362:INFO:certbot.auth_handler:tls-sni-01 challenge for baldursgate.rixort.com\r\n2017-10-21 17:37:52,422:DEBUG:certbot.crypto_util:Generating key (1024 bits): /var/lib/letsencrypt/snakeoil/0005_key.pem\r\n2017-10-21 17:37:52,669:DEBUG:certbot.reverter:Creating backup of /etc/nginx/sites-enabled/quark.xk7.net\r\n2017-10-21 17:37:52,669:DEBUG:certbot.reverter:Creating backup of /etc/nginx/nginx.conf\r\n2017-10-21 17:37:52,669:DEBUG:certbot.reverter:Creating backup of /etc/nginx/mime.types\r\n2017-10-21 17:37:52,670:DEBUG:certbot.reverter:Creating backup of /etc/nginx/sites-enabled/baldursgate.rixort.com\r\n2017-10-21 17:37:52,670:DEBUG:certbot.reverter:Creating backup of /etc/nginx/conf.d/01-server-names.conf\r\n2017-10-21 17:37:52,670:DEBUG:certbot.reverter:Creating backup of /etc/nginx/sites-enabled/default\r\n2017-10-21 17:37:52,670:DEBUG:certbot.reverter:Creating backup of /etc/letsencrypt/options-ssl-nginx.conf\r\n2017-10-21 17:37:52,671:DEBUG:certbot_nginx.parser:Writing nginx conf tree to /etc/nginx/sites-enabled/baldursgate.rixort.com:\r\nserver {\r\n  listen 80;\r\n  listen [::]:80;\r\n  server_name baldursgate.rixort.com;\r\n\r\n  #return 301 https://$host$request_uri;\r\n\r\n    listen 443 ssl; # managed by Certbot\r\n    ssl_certificate /var/lib/letsencrypt/snakeoil/0005_cert.pem; # managed by Certbot\r\n    ssl_certificate_key /var/lib/letsencrypt/snakeoil/0005_key.pem; # managed by Certbot\r\n    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot\r\n}\r\n\r\n#server {\r\n#  listen 443 ssl;\r\n#  listen [::]:443 ssl;\r\n#  server_name baldursgate.rixort.com;\r\n\r\n#  ssl_certificate /etc/letsencrypt/live/baldursgate.rixort.com/fullchain.pem;\r\n#  ssl_certificate_key /etc/letsencrypt/live/baldursgate.rixort.com/privkey.pem;\r\n#  ssl_dhparam /etc/nginx/dhparam.pem;\r\n#  include /etc/letsencrypt/options-ssl-nginx.conf;\r\n\r\n#  root /var/www/baldursgate.rixort.com/public_html;\r\n\r\n#  location / {\r\n#    try_files $uri $uri/ =404;\r\n#  }\r\n#}\r\n\r\n2017-10-21 17:37:52,673:DEBUG:certbot_nginx.parser:Writing nginx conf tree to /etc/nginx/nginx.conf:\r\nuser www-data;\r\nworker_processes auto;\r\npid /run/nginx.pid;\r\n\r\nevents {\r\n\tworker_connections 768;\r\n\t# multi_accept on;\r\n}\r\n\r\nhttp {\r\ninclude /etc/letsencrypt/le_tls_sni_01_cert_challenge.conf;\r\nserver_names_hash_bucket_size 128;\r\n\r\n\t##\r\n\t# Basic Settings\r\n\t##\r\n\r\n\tsendfile on;\r\n\ttcp_nopush on;\r\n\ttcp_nodelay on;\r\n\tkeepalive_timeout 65;\r\n\ttypes_hash_max_size 2048;\r\n\t# server_tokens off;\r\n\r\n\t# server_names_hash_bucket_size 64;\r\n\t# server_name_in_redirect off;\r\n\r\n\tinclude /etc/nginx/mime.types;\r\n\tdefault_type application/octet-stream;\r\n\r\n\t##\r\n\t# SSL Settings\r\n\t##\r\n\r\n\tssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE\r\n\tssl_prefer_server_ciphers on;\r\n\r\n\t##\r\n\t# Logging Settings\r\n\t##\r\n\r\n\taccess_log /var/log/nginx/access.log;\r\n\terror_log /var/log/nginx/error.log;\r\n\r\n\t##\r\n\t# Gzip Settings\r\n\t##\r\n\r\n\tgzip on;\r\n\tgzip_disable \"msie6\";\r\n\r\n\t# gzip_vary on;\r\n\t# gzip_proxied any;\r\n\t# gzip_comp_level 6;\r\n\t# gzip_buffers 16 8k;\r\n\t# gzip_http_version 1.1;\r\n\t# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;\r\n\r\n\t##\r\n\t# Virtual Host Configs\r\n\t##\r\n\r\n\tinclude /etc/nginx/conf.d/*.conf;\r\n\tinclude /etc/nginx/sites-enabled/*;\r\n}\r\n\r\n\r\n#mail {\r\n#\t# See sample authentication script at:\r\n#\t# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript\r\n# \r\n#\t# auth_http localhost/auth.php;\r\n#\t# pop3_capabilities \"TOP\" \"USER\";\r\n#\t# imap_capabilities \"IMAP4rev1\" \"UIDPLUS\";\r\n# \r\n#\tserver {\r\n#\t\tlisten     localhost:110;\r\n#\t\tprotocol   pop3;\r\n#\t\tproxy      on;\r\n#\t}\r\n# \r\n#\tserver {\r\n#\t\tlisten     localhost:143;\r\n#\t\tprotocol   imap;\r\n#\t\tproxy      on;\r\n#\t}\r\n#}\r\n\r\n2017-10-21 17:37:52,693:DEBUG:certbot.error_handler:Encountered exception:\r\nTraceback (most recent call last):\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/auth_handler.py\", line 115, in _solve_challenges\r\n    resp = self.auth.perform(self.achalls)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot_nginx/configurator.py\", line 806, in perform\r\n    self.restart()\r\n  File \"/usr/lib/python2.7/dist-packages/certbot_nginx/configurator.py\", line 590, in restart\r\n    nginx_restart(self.conf('ctl'), self.nginx_conf)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot_nginx/configurator.py\", line 853, in nginx_restart\r\n    \"nginx restart failed:\\n%s\\n%s\" % (out.read(), err.read()))\r\nMisconfigurationError: nginx restart failed:\r\n\r\n\r\n\r\n2017-10-21 17:37:52,693:DEBUG:certbot.error_handler:Calling registered functions\r\n2017-10-21 17:37:52,693:INFO:certbot.auth_handler:Cleaning up challenges\r\n2017-10-21 17:37:53,943:DEBUG:certbot.log:Exiting abnormally:\r\nTraceback (most recent call last):\r\n  File \"/usr/bin/certbot\", line 11, in <module>\r\n    load_entry_point('certbot==0.17.0', 'console_scripts', 'certbot')()\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/main.py\", line 753, in main\r\n    return config.func(config, plugins)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/main.py\", line 692, in certonly\r\n    lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/main.py\", line 82, in _get_and_save_cert\r\n    lineage = le_client.obtain_and_enroll_certificate(domains, certname)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/client.py\", line 357, in obtain_and_enroll_certificate\r\n    certr, chain, key, _ = self.obtain_certificate(domains)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/client.py\", line 318, in obtain_certificate\r\n    self.config.allow_subset_of_names)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/auth_handler.py\", line 74, in get_authorizations\r\n    resp = self._solve_challenges()\r\n  File \"/usr/lib/python2.7/dist-packages/certbot/auth_handler.py\", line 115, in _solve_challenges\r\n    resp = self.auth.perform(self.achalls)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot_nginx/configurator.py\", line 806, in perform\r\n    self.restart()\r\n  File \"/usr/lib/python2.7/dist-packages/certbot_nginx/configurator.py\", line 590, in restart\r\n    nginx_restart(self.conf('ctl'), self.nginx_conf)\r\n  File \"/usr/lib/python2.7/dist-packages/certbot_nginx/configurator.py\", line 853, in nginx_restart\r\n    \"nginx restart failed:\\n%s\\n%s\" % (out.read(), err.read()))\r\nMisconfigurationError: nginx restart failed:\r\n\r\n```\r\n\r\n## Here is the relevant nginx server block or Apache virtualhost for the domain I am configuring:\r\n\r\nI'm not sure if this is relevant as the failure is before nginx gets to the server block, but here it is (I've commented out the HTTPS block as I'm generating the certificate first, then enabling HTTPS, rather than letting certbot update the configuration files for me. This is intentional as I don't want certbot to overwrite files which are in my configuration management system).\r\n\r\n```\r\nserver {\r\n  listen 80;\r\n  listen [::]:80;\r\n  server_name baldursgate.rixort.com;\r\n\r\n  #return 301 https://$host$request_uri;\r\n}\r\n\r\n#server {\r\n#  listen 443 ssl;\r\n#  listen [::]:443 ssl;\r\n#  server_name baldursgate.rixort.com;\r\n\r\n#  ssl_certificate /etc/letsencrypt/live/baldursgate.rixort.com/fullchain.pem;\r\n#  ssl_certificate_key /etc/letsencrypt/live/baldursgate.rixort.com/privkey.pem;\r\n#  ssl_dhparam /etc/nginx/dhparam.pem;\r\n#  include /etc/letsencrypt/options-ssl-nginx.conf;\r\n\r\n#  root /var/www/baldursgate.rixort.com/public_html;\r\n\r\n#  location / {\r\n#    try_files $uri $uri/ =404;\r\n#  }\r\n#}\r\n```"},"comment":{"url":"https://api.github.com/repos/certbot/certbot/issues/comments/338903059","html_url":"https://github.com/certbot/certbot/issues/5199#issuecomment-338903059","issue_url":"https://api.github.com/repos/certbot/certbot/issues/5199","id":338903059,"user":{"login":"pwaring","id":433556,"avatar_url":"https://avatars3.githubusercontent.com/u/433556?v=4","gravatar_id":"","url":"https://api.github.com/users/pwaring","html_url":"https://github.com/pwaring","followers_url":"https://api.github.com/users/pwaring/followers","following_url":"https://api.github.com/users/pwaring/following{/other_user}","gists_url":"https://api.github.com/users/pwaring/gists{/gist_id}","starred_url":"https://api.github.com/users/pwaring/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwaring/subscriptions","organizations_url":"https://api.github.com/users/pwaring/orgs","repos_url":"https://api.github.com/users/pwaring/repos","events_url":"https://api.github.com/users/pwaring/events{/privacy}","received_events_url":"https://api.github.com/users/pwaring/received_events","type":"User","site_admin":false},"created_at":"2017-10-24T07:42:48Z","updated_at":"2017-10-24T07:42:48Z","author_association":"NONE","body":"The problem isn't that cerbot is setting the directive to something other than what I have used, it's that certbot is duplicating an existing directive. Even with `server_names_hash_bucket_size 128;` in my `nginx.conf`, certbot will crash nginx with the same error message.\r\n\r\nAs a simple test, if I forget certbot for a moment and add the following two lines to `nginx.conf`:\r\n\r\n```\r\nserver_names_hash_bucket_size 128;\r\nserver_names_hash_bucket_size 128;\r\n```\r\n\r\nThen I check the configuration syntax:\r\n\r\n```\r\n# nginx -t\r\nnginx: [emerg] \"server_names_hash_bucket_size\" directive is duplicate in /etc/nginx/conf.d/01-server-names.conf:2\r\n```\r\n\r\nSo nginx will fail a configuration check if the same directive is defined twice *regardless of the value of that directive*. This means that if you need to set `server_names_hash_bucket_size` to any value, even the same as used by certbot, you cannot use the nginx plugin."}}
{"actor":{"display_login":"pwaring"}}