Merge remote-tracking branch 'origin/master' into non-interactive

(Merge conflict due to PEP8iness)
2026-01-24 19:22:07 +03:00 · 2016-01-15 16:04:38 -08:00
parent 3c70af7da5 10214e2668
commit bbb25c7d1b
61 changed files with 1304 additions and 323 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -22,11 +22,19 @@ env:
  matrix:
    - TOXENV=py26 BOULDER_INTEGRATION=1
    - TOXENV=py27 BOULDER_INTEGRATION=1
+    - TOXENV=py26-oldest BOULDER_INTEGRATION=1
+    - TOXENV=py27-oldest BOULDER_INTEGRATION=1
+    - TOXENV=py33
+    - TOXENV=py34
    - TOXENV=lint
    - TOXENV=cover
 # Disabled for now due to requiring sudo -> causing more boulder integration
 # DNS timeouts :(
 #    - TOXENV=apacheconftest
+matrix:
+  include:
+    - env: TOXENV=py35
+      python: 3.5


 # Only build pushes to the master branch, PRs, and branches beginning with
--- a/acme/.pylintrc
+++ b/acme/.pylintrc
@@ -0,0 +1,383 @@
+[MASTER]
+
+# Specify a configuration file.
+#rcfile=
+
+# Python code to execute, usually for sys.path manipulation such as
+# pygtk.require().
+#init-hook=
+
+# Profiled execution.
+profile=no
+
+# Add files or directories to the blacklist. They should be base names, not
+# paths.
+ignore=CVS
+
+# Pickle collected data for later comparisons.
+persistent=yes
+
+# List of plugins (as comma separated values of python modules names) to load,
+# usually to register additional checkers.
+load-plugins=linter_plugin
+
+# DEPRECATED
+include-ids=no
+
+# DEPRECATED
+symbols=no
+
+# Use multiple processes to speed up Pylint.
+jobs=1
+
+# Allow loading of arbitrary C extensions. Extensions are imported into the
+# active Python interpreter and may run arbitrary code.
+unsafe-load-any-extension=no
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code
+extension-pkg-whitelist=
+
+
+[MESSAGES CONTROL]
+
+# Only show warnings with the listed confidence levels. Leave empty to show
+# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
+confidence=
+
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time. See also the "--disable" option for examples.
+#enable=
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifiers separated by comma (,) or put this
+# option multiple times (only on the command line, not in the configuration
+# file where it should appear only once).You can also use "--disable=all" to
+# disable everything first and then reenable specific checks. For example, if
+# you want to run only the similarities checker, you can use "--disable=all
+# --enable=similarities". If you want to run only the classes checker, but have
+# no Warning level messages displayed, use"--disable=all --enable=classes
+# --disable=W"
+disable=fixme,locally-disabled,abstract-class-not-used
+# bstract-class-not-used cannot be disabled locally (at least in
+# pylint 1.4.1/2)
+
+
+
+[REPORTS]
+
+# Set the output format. Available formats are text, parseable, colorized, msvs
+# (visual studio) and html. You can also give a reporter class, eg
+# mypackage.mymodule.MyReporterClass.
+output-format=text
+
+# Put messages in a separate file for each module / package specified on the
+# command line instead of printing them on stdout. Reports (if any) will be
+# written in a file name "pylint_global.[txt|html]".
+files-output=no
+
+# Tells whether to display a full report or only the messages
+reports=yes
+
+# Python expression which should return a note less than 10 (10 is the highest
+# note). You have access to the variables errors warning, statement which
+# respectively contain the number of errors / warnings messages and the total
+# number of statements analyzed. This is used by the global evaluation report
+# (RP0004).
+evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
+
+# Add a comment according to your evaluation note. This is used by the global
+# evaluation report (RP0004).
+comment=no
+
+# Template used to display messages. This is a python new-style format string
+# used to format the message information. See doc for all details
+#msg-template=
+
+
+[FORMAT]
+
+# Maximum number of characters on a single line.
+max-line-length=80
+
+# Regexp for a line that is allowed to be longer than the limit.
+ignore-long-lines=^\s*(# )?<?https?://\S+>?$
+
+# Allow the body of an if to be on the same line as the test if there is no
+# else.
+single-line-if-stmt=no
+
+# List of optional constructs for which whitespace checking is disabled
+no-space-check=trailing-comma,dict-separator
+
+# Maximum number of lines in a module
+max-module-lines=1000
+
+# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1
+# tab).
+indent-string='    '
+
+# Number of spaces of indent required inside a hanging or continued line.
+indent-after-paren=4
+
+# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
+expected-line-ending-format=
+
+
+[MISCELLANEOUS]
+
+# List of note tags to take in consideration, separated by a comma.
+notes=FIXME,XXX,TODO
+
+
+[LOGGING]
+
+# Logging modules to check that the string format arguments are in logging
+# function parameter format
+logging-modules=logging,logger
+
+
+[SPELLING]
+
+# Spelling dictionary name. Available dictionaries: none. To make it working
+# install python-enchant package.
+spelling-dict=
+
+# List of comma separated words that should not be checked.
+spelling-ignore-words=
+
+# A path to a file that contains private dictionary; one word per line.
+spelling-private-dict-file=
+
+# Tells whether to store unknown words to indicated private dictionary in
+# --spelling-private-dict-file option instead of raising a message.
+spelling-store-unknown-words=no
+
+
+[TYPECHECK]
+
+# Tells whether missing members accessed in mixin class should be ignored. A
+# mixin class is detected if its name ends with "mixin" (case insensitive).
+ignore-mixin-members=yes
+
+# List of module names for which member attributes should not be checked
+# (useful for modules/projects where namespaces are manipulated during runtime
+# and thus existing member attributes cannot be deduced by static analysis
+ignored-modules=
+
+# List of classes names for which member attributes should not be checked
+# (useful for classes with attributes dynamically set).
+ignored-classes=SQLObject
+
+# When zope mode is activated, add a predefined set of Zope acquired attributes
+# to generated-members.
+zope=no
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E0201 when accessed. Python regular
+# expressions are accepted.
+generated-members=REQUEST,acl_users,aq_parent
+
+
+[SIMILARITIES]
+
+# Minimum lines number of a similarity.
+min-similarity-lines=4
+
+# Ignore comments when computing similarities.
+ignore-comments=yes
+
+# Ignore docstrings when computing similarities.
+ignore-docstrings=yes
+
+# Ignore imports when computing similarities.
+ignore-imports=no
+
+
+[VARIABLES]
+
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
+
+# A regular expression matching the name of dummy variables (i.e. expectedly
+# not used).
+dummy-variables-rgx=_$|dummy|unused
+
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid to define new builtins when possible.
+additional-builtins=
+
+# List of strings which can identify a callback function by name. A callback
+# name must start or end with one of those strings.
+callbacks=cb_,_cb
+
+
+[BASIC]
+
+# Required attributes for module, separated by a comma
+required-attributes=
+
+# List of builtins function names that should not be used, separated by a comma
+bad-functions=map,filter,input
+
+# Good variable names which should always be accepted, separated by a comma
+good-names=i,j,k,ex,Run,_,logger
+
+# Bad variable names which should always be refused, separated by a comma
+bad-names=foo,bar,baz,toto,tutu,tata
+
+# Colon-delimited sets of names that determine each other's naming style when
+# the name regexes allow several styles.
+name-group=
+
+# Include a hint for the correct naming format with invalid-name
+include-naming-hint=no
+
+# Regular expression matching correct function names
+function-rgx=[a-z_][a-z0-9_]{2,40}$
+
+# Naming hint for function names
+function-name-hint=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression matching correct variable names
+variable-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Naming hint for variable names
+variable-name-hint=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression matching correct constant names
+const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$
+
+# Naming hint for constant names
+const-name-hint=(([A-Z_][A-Z0-9_]*)|(__.*__))$
+
+# Regular expression matching correct attribute names
+attr-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Naming hint for attribute names
+attr-name-hint=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression matching correct argument names
+argument-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Naming hint for argument names
+argument-name-hint=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression matching correct class attribute names
+class-attribute-rgx=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
+
+# Naming hint for class attribute names
+class-attribute-name-hint=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
+
+# Regular expression matching correct inline iteration names
+inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
+
+# Naming hint for inline iteration names
+inlinevar-name-hint=[A-Za-z_][A-Za-z0-9_]*$
+
+# Regular expression matching correct class names
+class-rgx=[A-Z_][a-zA-Z0-9]+$
+
+# Naming hint for class names
+class-name-hint=[A-Z_][a-zA-Z0-9]+$
+
+# Regular expression matching correct module names
+module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
+
+# Naming hint for module names
+module-name-hint=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
+
+# Regular expression matching correct method names
+method-rgx=[a-z_][a-z0-9_]{2,49}$
+
+# Naming hint for method names
+method-name-hint=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression which should only match function or class names that do
+# not require a docstring.
+no-docstring-rgx=__.*__|test_[A-Za-z0-9_]*|_.*|.*Test
+
+# Minimum line length for functions/classes that require docstrings, shorter
+# ones are exempt.
+docstring-min-length=-1
+
+
+[CLASSES]
+
+# List of interface methods to ignore, separated by a comma. This is used for
+# instance to not check methods defines in Zope's Interface base class.
+ignore-iface-methods=isImplementedBy,deferred,extends,names,namesAndDescriptions,queryDescriptionFor,getBases,getDescriptionFor,getDoc,getName,getTaggedValue,getTaggedValueTags,isEqualOrExtendedBy,setTaggedValue,isImplementedByInstancesOf,adaptWith,is_implemented_by
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,__new__,setUp
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls
+
+# List of valid names for the first argument in a metaclass class method.
+valid-metaclass-classmethod-first-arg=mcs
+
+# List of member names, which should be excluded from the protected access
+# warning.
+exclude-protected=_asdict,_fields,_replace,_source,_make
+
+
+[DESIGN]
+
+# Maximum number of arguments for function / method
+max-args=6
+
+# Argument names that match this expression will be ignored. Default to name
+# with leading underscore
+ignored-argument-names=_.*
+
+# Maximum number of locals for function / method body
+max-locals=15
+
+# Maximum number of return / yield for function / method body
+max-returns=6
+
+# Maximum number of branch for function / method body
+max-branches=12
+
+# Maximum number of statements in function / method body
+max-statements=50
+
+# Maximum number of parents for a class (see R0901).
+max-parents=12
+
+# Maximum number of attributes for a class (see R0902).
+max-attributes=7
+
+# Minimum number of public methods for a class (see R0903).
+min-public-methods=2
+
+# Maximum number of public methods for a class (see R0904).
+max-public-methods=20
+
+
+[IMPORTS]
+
+# Deprecated modules which should not be used, separated by a comma
+deprecated-modules=regsub,TERMIOS,Bastion,rexec
+
+# Create a graph of every (i.e. internal and external) dependencies in the
+# given file (report RP0402 must not be disabled)
+import-graph=
+
+# Create a graph of external dependencies in the given file (report RP0402 must
+# not be disabled)
+ext-import-graph=
+
+# Create a graph of internal dependencies in the given file (report RP0402 must
+# not be disabled)
+int-import-graph=
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when being caught. Defaults to
+# "Exception"
+overgeneral-exceptions=Exception
--- a/acme/acme/challenges.py
+++ b/acme/acme/challenges.py
@@ -236,10 +236,8 @@ class HTTP01Response(KeyAuthorizationChallengeResponse):

        :param challenges.SimpleHTTP chall: Corresponding challenge.
        :param unicode domain: Domain name being verified.
-        :param account_public_key: Public key for the key pair
-            being authorized. If ``None`` key verification is not
-            performed!
-        :param JWK account_public_key:
+        :param JWK account_public_key: Public key for the key pair
+            being authorized.
        :param int port: Port used in the validation.

        :returns: ``True`` iff validation is successful, ``False``
@@ -336,7 +334,7 @@ class TLSSNI01Response(KeyAuthorizationChallengeResponse):
    """

    @property
-    def z(self):
+    def z(self):  # pylint: disable=invalid-name
        """``z`` value used for verification.

        :rtype bytes:
@@ -391,7 +389,14 @@ class TLSSNI01Response(KeyAuthorizationChallengeResponse):
        return crypto_util.probe_sni(**kwargs)

    def verify_cert(self, cert):
-        """Verify tls-sni-01 challenge certificate."""
+        """Verify tls-sni-01 challenge certificate.
+
+        :param OpensSSL.crypto.X509 cert: Challenge certificate.
+
+        :returns: Whether the certificate was successfully verified.
+        :rtype: bool
+
+        """
        # pylint: disable=protected-access
        sans = crypto_util._pyopenssl_cert_or_req_san(cert)
        logging.debug('Certificate %s. SANs: %s', cert.digest('sha1'), sans)
--- a/acme/acme/challenges_test.py
+++ b/acme/acme/challenges_test.py
@@ -13,7 +13,7 @@ from acme import other
 from acme import test_util


-CERT = test_util.load_cert('cert.pem')
+CERT = test_util.load_comparable_cert('cert.pem')
 KEY = jose.JWKRSA(key=test_util.load_rsa_private_key('rsa512_key.pem'))


@@ -73,7 +73,8 @@ class KeyAuthorizationChallengeResponseTest(unittest.TestCase):
    def test_verify_wrong_form(self):
        from acme.challenges import KeyAuthorizationChallengeResponse
        response = KeyAuthorizationChallengeResponse(
-            key_authorization='.foo.oKGqedy-b-acd5eoybm2f-NVFxvyOoET5CNy3xnv8WY')
+            key_authorization='.foo.oKGqedy-b-acd5eoybm2f-'
+            'NVFxvyOoET5CNy3xnv8WY')
        self.assertFalse(response.verify(self.chall, KEY.public_key()))


@@ -273,10 +274,12 @@ class TLSSNI01ResponseTest(unittest.TestCase):
    @mock.patch('acme.challenges.TLSSNI01Response.verify_cert', autospec=True)
    def test_simple_verify(self, mock_verify_cert):
        mock_verify_cert.return_value = mock.sentinel.verification
-        self.assertEqual(mock.sentinel.verification, self.response.simple_verify(
-            self.chall, self.domain, KEY.public_key(),
-            cert=mock.sentinel.cert))
-        mock_verify_cert.assert_called_once_with(self.response, mock.sentinel.cert)
+        self.assertEqual(
+            mock.sentinel.verification, self.response.simple_verify(
+                self.chall, self.domain, KEY.public_key(),
+                cert=mock.sentinel.cert))
+        mock_verify_cert.assert_called_once_with(
+            self.response, mock.sentinel.cert)

    @mock.patch('acme.challenges.TLSSNI01Response.probe_cert')
    def test_simple_verify_false_on_probe_error(self, mock_probe_cert):
@@ -421,7 +424,7 @@ class ProofOfPossessionHintsTest(unittest.TestCase):
            'jwk': jwk,
            'certFingerprints': cert_fingerprints,
            'certs': (jose.encode_b64jose(OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_ASN1, CERT)),),
+                OpenSSL.crypto.FILETYPE_ASN1, CERT.wrapped)),),
            'subjectKeyIdentifiers': subject_key_identifiers,
            'serialNumbers': serial_numbers,
            'issuers': issuers,
@@ -590,7 +593,8 @@ class DNSTest(unittest.TestCase):

    def test_check_validation_wrong_fields(self):
        bad_validation = jose.JWS.sign(
-            payload=self.msg.update(token=b'x' * 20).json_dumps().encode('utf-8'),
+            payload=self.msg.update(
+                token=b'x' * 20).json_dumps().encode('utf-8'),
            alg=jose.RS256, key=KEY)
        self.assertFalse(self.msg.check_validation(
            bad_validation, KEY.public_key()))
--- a/acme/acme/client.py
+++ b/acme/acme/client.py
@@ -66,15 +66,13 @@ class Client(object):  # pylint: disable=too-many-instance-attributes
    @classmethod
    def _regr_from_response(cls, response, uri=None, new_authzr_uri=None,
                            terms_of_service=None):
-        terms_of_service = (
-            response.links['terms-of-service']['url']
-            if 'terms-of-service' in response.links else terms_of_service)
+        if 'terms-of-service' in response.links:
+            terms_of_service = response.links['terms-of-service']['url']
+        if 'next' in response.links:
+            new_authzr_uri = response.links['next']['url']

        if new_authzr_uri is None:
-            try:
-                new_authzr_uri = response.links['next']['url']
-            except KeyError:
-                raise errors.ClientError('"next" link missing')
+            raise errors.ClientError('"next" link missing')

        return messages.RegistrationResource(
            body=messages.Registration.from_json(response.json()),
@@ -483,7 +481,7 @@ class Client(object):  # pylint: disable=too-many-instance-attributes
                'Successful revocation must return HTTP OK status')


-class ClientNetwork(object):
+class ClientNetwork(object):  # pylint: disable=too-many-instance-attributes
    """Client network."""
    JSON_CONTENT_TYPE = 'application/json'
    JSON_ERROR_CONTENT_TYPE = 'application/problem+json'
@@ -539,7 +537,7 @@ class ClientNetwork(object):
            # TODO: response.json() is called twice, once here, and
            # once in _get and _post clients
            jobj = response.json()
-        except ValueError as error:
+        except ValueError:
            jobj = None

        if not response.ok:
--- a/acme/acme/client_test.py
+++ b/acme/acme/client_test.py
@@ -34,8 +34,10 @@ class ClientTest(unittest.TestCase):
        self.net.get.return_value = self.response

        self.directory = messages.Directory({
-            messages.NewRegistration: 'https://www.letsencrypt-demo.org/acme/new-reg',
-            messages.Revocation: 'https://www.letsencrypt-demo.org/acme/revoke-cert',
+            messages.NewRegistration:
+                'https://www.letsencrypt-demo.org/acme/new-reg',
+            messages.Revocation:
+                'https://www.letsencrypt-demo.org/acme/revoke-cert',
        })

        from acme.client import Client
@@ -127,6 +129,13 @@ class ClientTest(unittest.TestCase):
        self.response.json.return_value = self.regr.body.to_json()
        self.assertEqual(self.regr, self.client.query_registration(self.regr))

+    def test_query_registration_updates_new_authzr_uri(self):
+        self.response.json.return_value = self.regr.body.to_json()
+        self.response.links = {'next': {'url': 'UPDATED'}}
+        self.assertEqual(
+            'UPDATED',
+            self.client.query_registration(self.regr).new_authzr_uri)
+
    def test_agree_to_tos(self):
        self.client.update_registration = mock.Mock()
        self.client.agree_to_tos(self.regr)
@@ -331,7 +340,8 @@ class ClientTest(unittest.TestCase):
        self.assertEqual(clock.dt, datetime.datetime(2015, 3, 27, 0, 1, 7))

        # CA sets invalid | TODO: move to a separate test
-        invalid_authzr = mock.MagicMock(times=[], retries=[messages.STATUS_INVALID])
+        invalid_authzr = mock.MagicMock(
+            times=[], retries=[messages.STATUS_INVALID])
        self.assertRaises(
            errors.PollError, self.client.poll_and_request_issuance,
            csr, authzrs=(invalid_authzr,), mintime=mintime)
--- a/acme/acme/crypto_util.py
+++ b/acme/acme/crypto_util.py
@@ -1,11 +1,10 @@
 """Crypto utilities."""
 import contextlib
 import logging
+import re
 import socket
 import sys

-from six.moves import range  # pylint: disable=import-error,redefined-builtin
-
 import OpenSSL

 from acme import errors
@@ -70,7 +69,7 @@ class SSLSocket(object):  # pylint: disable=too-few-public-methods
    class FakeConnection(object):
        """Fake OpenSSL.SSL.Connection."""

-        # pylint: disable=missing-docstring
+        # pylint: disable=too-few-public-methods,missing-docstring

        def __init__(self, connection):
            self._wrapped = connection
@@ -161,31 +160,31 @@ def _pyopenssl_cert_or_req_san(cert_or_req):
    :rtype: `list` of `unicode`

    """
-    # constants based on implementation of
-    # OpenSSL.crypto.X509Error._subjectAltNameString
-    parts_separator = ", "
+    # This function finds SANs by dumping the certificate/CSR to text and
+    # searching for "X509v3 Subject Alternative Name" in the text. This method
+    # is used to support PyOpenSSL version 0.13 where the
+    # `_subjectAltNameString` and `get_extensions` methods are not available
+    # for CSRs.
+
+    # constants based on PyOpenSSL certificate/CSR text dump
    part_separator = ":"
-    extension_short_name = b"subjectAltName"
+    parts_separator = ", "
+    prefix = "DNS" + part_separator

-    if hasattr(cert_or_req, 'get_extensions'):  # X509Req
-        extensions = cert_or_req.get_extensions()
-    else:  # X509
-        extensions = [cert_or_req.get_extension(i)
-                      for i in range(cert_or_req.get_extension_count())]
-
-    # pylint: disable=protected-access,no-member
-    label = OpenSSL.crypto.X509Extension._prefixes[OpenSSL.crypto._lib.GEN_DNS]
-    assert parts_separator not in label
-    prefix = label + part_separator
-
-    san_extensions = [
-        ext._subjectAltNameString().split(parts_separator)
-        for ext in extensions if ext.get_short_name() == extension_short_name]
+    if isinstance(cert_or_req, OpenSSL.crypto.X509):
+        func = OpenSSL.crypto.dump_certificate
+    else:
+        func = OpenSSL.crypto.dump_certificate_request
+    text = func(OpenSSL.crypto.FILETYPE_TEXT, cert_or_req).decode("utf-8")
+    # WARNING: this function does not support multiple SANs extensions.
+    # Multiple X509v3 extensions of the same type is disallowed by RFC 5280.
+    match = re.search(r"X509v3 Subject Alternative Name:\s*(.*)", text)
    # WARNING: this function assumes that no SAN can include
    # parts_separator, hence the split!
+    sans_parts = [] if match is None else match.group(1).split(parts_separator)

-    return [part.split(part_separator)[1] for parts in san_extensions
-            for part in parts if part.startswith(prefix)]
+    return [part.split(part_separator)[1]
+            for part in sans_parts if part.startswith(prefix)]


 def gen_ss_cert(key, domains, not_before=None,
--- a/acme/acme/crypto_util_test.py
+++ b/acme/acme/crypto_util_test.py
@@ -1,9 +1,11 @@
 """Tests for acme.crypto_util."""
+import itertools
 import socket
 import threading
 import time
 import unittest

+import six
 from six.moves import socketserver  # pylint: disable=import-error

 from acme import errors
@@ -15,10 +17,10 @@ class SSLSocketAndProbeSNITest(unittest.TestCase):
    """Tests for acme.crypto_util.SSLSocket/probe_sni."""

    def setUp(self):
-        self.cert = test_util.load_cert('cert.pem')
+        self.cert = test_util.load_comparable_cert('cert.pem')
        key = test_util.load_pyopenssl_private_key('rsa512_key.pem')
        # pylint: disable=protected-access
-        certs = {b'foo': (key, self.cert._wrapped)}
+        certs = {b'foo': (key, self.cert.wrapped)}

        from acme.crypto_util import SSLSocket

@@ -69,6 +71,15 @@ class PyOpenSSLCertOrReqSANTest(unittest.TestCase):
        from acme.crypto_util import _pyopenssl_cert_or_req_san
        return _pyopenssl_cert_or_req_san(loader(name))

+    @classmethod
+    def _get_idn_names(cls):
+        """Returns expected names from '{cert,csr}-idnsans.pem'."""
+        chars = [six.unichr(i) for i in itertools.chain(range(0x3c3, 0x400),
+                                                        range(0x641, 0x6fc),
+                                                        range(0x1820, 0x1877))]
+        return [''.join(chars[i: i + 45]) + '.invalid'
+                for i in range(0, len(chars), 45)]
+
    def _call_cert(self, name):
        return self._call(test_util.load_cert, name)

@@ -82,6 +93,14 @@ class PyOpenSSLCertOrReqSANTest(unittest.TestCase):
        self.assertEqual(self._call_cert('cert-san.pem'),
                         ['example.com', 'www.example.com'])

+    def test_cert_hundred_sans(self):
+        self.assertEqual(self._call_cert('cert-100sans.pem'),
+                         ['example{0}.com'.format(i) for i in range(1, 101)])
+
+    def test_cert_idn_sans(self):
+        self.assertEqual(self._call_cert('cert-idnsans.pem'),
+                         self._get_idn_names())
+
    def test_csr_no_sans(self):
        self.assertEqual(self._call_csr('csr-nosans.pem'), [])

@@ -94,10 +113,18 @@ class PyOpenSSLCertOrReqSANTest(unittest.TestCase):

    def test_csr_six_sans(self):
        self.assertEqual(self._call_csr('csr-6sans.pem'),
-                         ["example.com", "example.org", "example.net",
-                          "example.info", "subdomain.example.com",
-                          "other.subdomain.example.com"])
+                         ['example.com', 'example.org', 'example.net',
+                          'example.info', 'subdomain.example.com',
+                          'other.subdomain.example.com'])
+
+    def test_csr_hundred_sans(self):
+        self.assertEqual(self._call_csr('csr-100sans.pem'),
+                         ['example{0}.com'.format(i) for i in range(1, 101)])
+
+    def test_csr_idn_sans(self):
+        self.assertEqual(self._call_csr('csr-idnsans.pem'),
+                         self._get_idn_names())


-if __name__ == "__main__":
+if __name__ == '__main__':
    unittest.main()  # pragma: no cover
--- a/acme/acme/jose/json_util.py
+++ b/acme/acme/jose/json_util.py
@@ -373,7 +373,7 @@ def encode_cert(cert):

    """
    return encode_b64jose(OpenSSL.crypto.dump_certificate(
-        OpenSSL.crypto.FILETYPE_ASN1, cert))
+        OpenSSL.crypto.FILETYPE_ASN1, cert.wrapped))


 def decode_cert(b64der):
@@ -398,7 +398,7 @@ def encode_csr(csr):

    """
    return encode_b64jose(OpenSSL.crypto.dump_certificate_request(
-        OpenSSL.crypto.FILETYPE_ASN1, csr))
+        OpenSSL.crypto.FILETYPE_ASN1, csr.wrapped))


 def decode_csr(b64der):
--- a/acme/acme/jose/json_util_test.py
+++ b/acme/acme/jose/json_util_test.py
@@ -12,8 +12,8 @@ from acme.jose import interfaces
 from acme.jose import util


-CERT = test_util.load_cert('cert.pem')
-CSR = test_util.load_csr('csr.pem')
+CERT = test_util.load_comparable_cert('cert.pem')
+CSR = test_util.load_comparable_csr('csr.pem')


 class FieldTest(unittest.TestCase):
--- a/acme/acme/jose/jws.py
+++ b/acme/acme/jose/jws.py
@@ -124,7 +124,7 @@ class Header(json_util.JSONObjectWithFields):
    @x5c.encoder
    def x5c(value):  # pylint: disable=missing-docstring,no-self-argument
        return [base64.b64encode(OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_ASN1, cert)) for cert in value]
+            OpenSSL.crypto.FILETYPE_ASN1, cert.wrapped)) for cert in value]

    @x5c.decoder
    def x5c(value):  # pylint: disable=missing-docstring,no-self-argument
--- a/acme/acme/jose/jws_test.py
+++ b/acme/acme/jose/jws_test.py
@@ -13,7 +13,7 @@ from acme.jose import jwa
 from acme.jose import jwk


-CERT = test_util.load_cert('cert.pem')
+CERT = test_util.load_comparable_cert('cert.pem')
 KEY = jwk.JWKRSA.load(test_util.load_vector('rsa512_key.pem'))


@@ -68,13 +68,12 @@ class HeaderTest(unittest.TestCase):
        from acme.jose.jws import Header
        header = Header(x5c=(CERT, CERT))
        jobj = header.to_partial_json()
-        cert_b64 = base64.b64encode(OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_ASN1, CERT))
+        cert_asn1 = OpenSSL.crypto.dump_certificate(
+            OpenSSL.crypto.FILETYPE_ASN1, CERT.wrapped)
+        cert_b64 = base64.b64encode(cert_asn1)
        self.assertEqual(jobj, {'x5c': [cert_b64, cert_b64]})
        self.assertEqual(header, Header.from_json(jobj))
-        jobj['x5c'][0] = base64.b64encode(
-            b'xxx' + OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_ASN1, CERT))
+        jobj['x5c'][0] = base64.b64encode(b'xxx' + cert_asn1)
        self.assertRaises(errors.DeserializationError, Header.from_json, jobj)

    def test_find_key(self):
--- a/acme/acme/jose/util.py
+++ b/acme/acme/jose/util.py
@@ -29,32 +29,41 @@ class abstractclassmethod(classmethod):
 class ComparableX509(object):  # pylint: disable=too-few-public-methods
    """Wrapper for OpenSSL.crypto.X509** objects that supports __eq__.

-    Wraps around:
-
-      - :class:`OpenSSL.crypto.X509`
-      - :class:`OpenSSL.crypto.X509Req`
+    :ivar wrapped: Wrapped certificate or certificate request.
+    :type wrapped: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.

    """
    def __init__(self, wrapped):
        assert isinstance(wrapped, OpenSSL.crypto.X509) or isinstance(
            wrapped, OpenSSL.crypto.X509Req)
-        self._wrapped = wrapped
+        self.wrapped = wrapped

    def __getattr__(self, name):
-        return getattr(self._wrapped, name)
+        return getattr(self.wrapped, name)

    def _dump(self, filetype=OpenSSL.crypto.FILETYPE_ASN1):
-        # pylint: disable=missing-docstring,protected-access
-        if isinstance(self._wrapped, OpenSSL.crypto.X509):
+        """Dumps the object into a buffer with the specified encoding.
+
+        :param int filetype: The desired encoding. Should be one of
+            `OpenSSL.crypto.FILETYPE_ASN1`,
+            `OpenSSL.crypto.FILETYPE_PEM`, or
+            `OpenSSL.crypto.FILETYPE_TEXT`.
+
+        :returns: Encoded X509 object.
+        :rtype: str
+
+        """
+        if isinstance(self.wrapped, OpenSSL.crypto.X509):
            func = OpenSSL.crypto.dump_certificate
        else:  # assert in __init__ makes sure this is X509Req
            func = OpenSSL.crypto.dump_certificate_request
-        return func(filetype, self._wrapped)
+        return func(filetype, self.wrapped)

    def __eq__(self, other):
        if not isinstance(other, self.__class__):
            return NotImplemented
-        return self._dump() == other._dump()  # pylint: disable=protected-access
+        # pylint: disable=protected-access
+        return self._dump() == other._dump()

    def __hash__(self):
        return hash((self.__class__, self._dump()))
@@ -63,7 +72,7 @@ class ComparableX509(object):  # pylint: disable=too-few-public-methods
        return not self == other

    def __repr__(self):
-        return '<{0}({1!r})>'.format(self.__class__.__name__, self._wrapped)
+        return '<{0}({1!r})>'.format(self.__class__.__name__, self.wrapped)


 class ComparableKey(object):  # pylint: disable=too-few-public-methods
--- a/acme/acme/jose/util_test.py
+++ b/acme/acme/jose/util_test.py
@@ -11,14 +11,17 @@ class ComparableX509Test(unittest.TestCase):
    """Tests for acme.jose.util.ComparableX509."""

    def setUp(self):
-        # test_util.load_{csr,cert} return ComparableX509
-        self.req1 = test_util.load_csr('csr.pem')
-        self.req2 = test_util.load_csr('csr.pem')
-        self.req_other = test_util.load_csr('csr-san.pem')
+        # test_util.load_comparable_{csr,cert} return ComparableX509
+        self.req1 = test_util.load_comparable_csr('csr.pem')
+        self.req2 = test_util.load_comparable_csr('csr.pem')
+        self.req_other = test_util.load_comparable_csr('csr-san.pem')

-        self.cert1 = test_util.load_cert('cert.pem')
-        self.cert2 = test_util.load_cert('cert.pem')
-        self.cert_other = test_util.load_cert('cert-san.pem')
+        self.cert1 = test_util.load_comparable_cert('cert.pem')
+        self.cert2 = test_util.load_comparable_cert('cert.pem')
+        self.cert_other = test_util.load_comparable_cert('cert-san.pem')
+
+    def test_getattr_proxy(self):
+        self.assertTrue(self.cert1.has_expired())

    def test_eq(self):
        self.assertEqual(self.req1, self.req2)
@@ -41,8 +44,8 @@ class ComparableX509Test(unittest.TestCase):

    def test_repr(self):
        for x509 in self.req1, self.cert1:
-            self.assertTrue(repr(x509).startswith(
-                '<ComparableX509(<OpenSSL.crypto.X509'))
+            self.assertEqual(repr(x509),
+                             '<ComparableX509({0!r})>'.format(x509.wrapped))


 class ComparableRSAKeyTest(unittest.TestCase):
--- a/acme/acme/messages.py
+++ b/acme/acme/messages.py
@@ -23,7 +23,7 @@ class Error(jose.JSONObjectWithFields, errors.Error):
            ('badCSR', 'The CSR is unacceptable (e.g., due to a short key)'),
            ('badNonce', 'The client sent an unacceptable anti-replay nonce'),
            ('connection', 'The server could not connect to the client to '
-                'verify the domain'),
+             'verify the domain'),
            ('dnssec', 'The server could not validate a DNSSEC signed domain'),
            ('invalidEmail',
             'The provided email for a registration was invalid'),
@@ -31,7 +31,7 @@ class Error(jose.JSONObjectWithFields, errors.Error):
            ('rateLimited', 'There were too many requests of a given type'),
            ('serverInternal', 'The server experienced an internal error'),
            ('tls', 'The server experienced a TLS error during domain '
-                'verification'),
+             'verification'),
            ('unauthorized', 'The client lacks sufficient authorization'),
            ('unknownHost', 'The server could not resolve a domain name'),
        )
@@ -130,8 +130,9 @@ class Directory(jose.JSONDeSerializable):
    @classmethod
    def register(cls, resource_body_cls):
        """Register resource."""
-        assert resource_body_cls.resource_type not in cls._REGISTERED_TYPES
-        cls._REGISTERED_TYPES[resource_body_cls.resource_type] = resource_body_cls
+        resource_type = resource_body_cls.resource_type
+        assert resource_type not in cls._REGISTERED_TYPES
+        cls._REGISTERED_TYPES[resource_type] = resource_body_cls
        return resource_body_cls

    def __init__(self, jobj):
--- a/acme/acme/messages_test.py
+++ b/acme/acme/messages_test.py
@@ -8,8 +8,8 @@ from acme import jose
 from acme import test_util


-CERT = test_util.load_cert('cert.der')
-CSR = test_util.load_csr('csr.der')
+CERT = test_util.load_comparable_cert('cert.der')
+CSR = test_util.load_comparable_csr('csr.der')
 KEY = test_util.load_rsa_private_key('rsa512_key.pem')


--- a/acme/acme/standalone_test.py
+++ b/acme/acme/standalone_test.py
@@ -32,11 +32,10 @@ class TLSSNI01ServerTest(unittest.TestCase):
    """Test for acme.standalone.TLSSNI01Server."""

    def setUp(self):
-        self.certs = {
-            b'localhost': (test_util.load_pyopenssl_private_key('rsa512_key.pem'),
-                           # pylint: disable=protected-access
-                           test_util.load_cert('cert.pem')._wrapped),
-        }
+        self.certs = {b'localhost': (
+            test_util.load_pyopenssl_private_key('rsa512_key.pem'),
+            test_util.load_cert('cert.pem'),
+        )}
        from acme.standalone import TLSSNI01Server
        self.server = TLSSNI01Server(("", 0), certs=self.certs)
        # pylint: disable=no-member
@@ -49,7 +48,8 @@ class TLSSNI01ServerTest(unittest.TestCase):

    def test_it(self):
        host, port = self.server.socket.getsockname()[:2]
-        cert = crypto_util.probe_sni(b'localhost', host=host, port=port, timeout=1)
+        cert = crypto_util.probe_sni(
+            b'localhost', host=host, port=port, timeout=1)
        self.assertEqual(jose.ComparableX509(cert),
                         jose.ComparableX509(self.certs[b'localhost'][1]))

@@ -140,13 +140,14 @@ class TestSimpleTLSSNI01Server(unittest.TestCase):
        while max_attempts:
            max_attempts -= 1
            try:
-                cert = crypto_util.probe_sni(b'localhost', b'0.0.0.0', self.port)
+                cert = crypto_util.probe_sni(
+                    b'localhost', b'0.0.0.0', self.port)
            except errors.Error:
                self.assertTrue(max_attempts > 0, "Timeout!")
                time.sleep(1)  # wait until thread starts
            else:
                self.assertEqual(jose.ComparableX509(cert),
-                                 test_util.load_cert('cert.pem'))
+                                 test_util.load_comparable_cert('cert.pem'))
                break


--- a/acme/acme/test_util.py
+++ b/acme/acme/test_util.py
@@ -40,16 +40,24 @@ def load_cert(*names):
    """Load certificate."""
    loader = _guess_loader(
        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
-    return jose.ComparableX509(OpenSSL.crypto.load_certificate(
-        loader, load_vector(*names)))
+    return OpenSSL.crypto.load_certificate(loader, load_vector(*names))
+
+
+def load_comparable_cert(*names):
+    """Load ComparableX509 cert."""
+    return jose.ComparableX509(load_cert(*names))


 def load_csr(*names):
    """Load certificate request."""
    loader = _guess_loader(
        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
-    return jose.ComparableX509(OpenSSL.crypto.load_certificate_request(
-        loader, load_vector(*names)))
+    return OpenSSL.crypto.load_certificate_request(loader, load_vector(*names))
+
+
+def load_comparable_csr(*names):
+    """Load ComparableX509 certificate request."""
+    return jose.ComparableX509(load_csr(*names))


 def load_rsa_private_key(*names):
--- a/acme/acme/testdata/cert-100sans.pem
+++ b/acme/acme/testdata/cert-100sans.pem
@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHxDCCB26gAwIBAgIJAOGrG1Un9lHiMA0GCSqGSIb3DQEBCwUAMGQxCzAJBgNV
+BAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMScwJQYDVQQLDB5FbGVjdHJv
+bmljIEZyb250aWVyIEZvdW5kYXRpb24xFDASBgNVBAMMC2V4YW1wbGUuY29tMB4X
+DTE2MDEwNjE5MDkzN1oXDTE2MDEwNzE5MDkzN1owZDELMAkGA1UECAwCQ0ExFjAU
+BgNVBAcMDVNhbiBGcmFuY2lzY28xJzAlBgNVBAsMHkVsZWN0cm9uaWMgRnJvbnRp
+ZXIgRm91bmRhdGlvbjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wXDANBgkqhkiG9w0B
+AQEFAANLADBIAkEArHVztFHtH92ucFJD/N/HW9AsdRsUuHUBBBDlHwNlRd3fp580
+rv2+6QWE30cWgdmJS86ObRz6lUTor4R0T+3C5QIDAQABo4IGATCCBf0wCQYDVR0T
+BAIwADALBgNVHQ8EBAMCBeAwggXhBgNVHREEggXYMIIF1IIMZXhhbXBsZTEuY29t
+ggxleGFtcGxlMi5jb22CDGV4YW1wbGUzLmNvbYIMZXhhbXBsZTQuY29tggxleGFt
+cGxlNS5jb22CDGV4YW1wbGU2LmNvbYIMZXhhbXBsZTcuY29tggxleGFtcGxlOC5j
+b22CDGV4YW1wbGU5LmNvbYINZXhhbXBsZTEwLmNvbYINZXhhbXBsZTExLmNvbYIN
+ZXhhbXBsZTEyLmNvbYINZXhhbXBsZTEzLmNvbYINZXhhbXBsZTE0LmNvbYINZXhh
+bXBsZTE1LmNvbYINZXhhbXBsZTE2LmNvbYINZXhhbXBsZTE3LmNvbYINZXhhbXBs
+ZTE4LmNvbYINZXhhbXBsZTE5LmNvbYINZXhhbXBsZTIwLmNvbYINZXhhbXBsZTIx
+LmNvbYINZXhhbXBsZTIyLmNvbYINZXhhbXBsZTIzLmNvbYINZXhhbXBsZTI0LmNv
+bYINZXhhbXBsZTI1LmNvbYINZXhhbXBsZTI2LmNvbYINZXhhbXBsZTI3LmNvbYIN
+ZXhhbXBsZTI4LmNvbYINZXhhbXBsZTI5LmNvbYINZXhhbXBsZTMwLmNvbYINZXhh
+bXBsZTMxLmNvbYINZXhhbXBsZTMyLmNvbYINZXhhbXBsZTMzLmNvbYINZXhhbXBs
+ZTM0LmNvbYINZXhhbXBsZTM1LmNvbYINZXhhbXBsZTM2LmNvbYINZXhhbXBsZTM3
+LmNvbYINZXhhbXBsZTM4LmNvbYINZXhhbXBsZTM5LmNvbYINZXhhbXBsZTQwLmNv
+bYINZXhhbXBsZTQxLmNvbYINZXhhbXBsZTQyLmNvbYINZXhhbXBsZTQzLmNvbYIN
+ZXhhbXBsZTQ0LmNvbYINZXhhbXBsZTQ1LmNvbYINZXhhbXBsZTQ2LmNvbYINZXhh
+bXBsZTQ3LmNvbYINZXhhbXBsZTQ4LmNvbYINZXhhbXBsZTQ5LmNvbYINZXhhbXBs
+ZTUwLmNvbYINZXhhbXBsZTUxLmNvbYINZXhhbXBsZTUyLmNvbYINZXhhbXBsZTUz
+LmNvbYINZXhhbXBsZTU0LmNvbYINZXhhbXBsZTU1LmNvbYINZXhhbXBsZTU2LmNv
+bYINZXhhbXBsZTU3LmNvbYINZXhhbXBsZTU4LmNvbYINZXhhbXBsZTU5LmNvbYIN
+ZXhhbXBsZTYwLmNvbYINZXhhbXBsZTYxLmNvbYINZXhhbXBsZTYyLmNvbYINZXhh
+bXBsZTYzLmNvbYINZXhhbXBsZTY0LmNvbYINZXhhbXBsZTY1LmNvbYINZXhhbXBs
+ZTY2LmNvbYINZXhhbXBsZTY3LmNvbYINZXhhbXBsZTY4LmNvbYINZXhhbXBsZTY5
+LmNvbYINZXhhbXBsZTcwLmNvbYINZXhhbXBsZTcxLmNvbYINZXhhbXBsZTcyLmNv
+bYINZXhhbXBsZTczLmNvbYINZXhhbXBsZTc0LmNvbYINZXhhbXBsZTc1LmNvbYIN
+ZXhhbXBsZTc2LmNvbYINZXhhbXBsZTc3LmNvbYINZXhhbXBsZTc4LmNvbYINZXhh
+bXBsZTc5LmNvbYINZXhhbXBsZTgwLmNvbYINZXhhbXBsZTgxLmNvbYINZXhhbXBs
+ZTgyLmNvbYINZXhhbXBsZTgzLmNvbYINZXhhbXBsZTg0LmNvbYINZXhhbXBsZTg1
+LmNvbYINZXhhbXBsZTg2LmNvbYINZXhhbXBsZTg3LmNvbYINZXhhbXBsZTg4LmNv
+bYINZXhhbXBsZTg5LmNvbYINZXhhbXBsZTkwLmNvbYINZXhhbXBsZTkxLmNvbYIN
+ZXhhbXBsZTkyLmNvbYINZXhhbXBsZTkzLmNvbYINZXhhbXBsZTk0LmNvbYINZXhh
+bXBsZTk1LmNvbYINZXhhbXBsZTk2LmNvbYINZXhhbXBsZTk3LmNvbYINZXhhbXBs
+ZTk4LmNvbYINZXhhbXBsZTk5LmNvbYIOZXhhbXBsZTEwMC5jb20wDQYJKoZIhvcN
+AQELBQADQQBEunJbKUXcyNKTSfA0pKRyWNiKmkoBqYgfZS6eHNrNH/hjFzHtzyDQ
+XYHHK6kgEWBvHfRXGmqhFvht+b1tQKkG
+-----END CERTIFICATE-----
--- a/acme/acme/testdata/cert-idnsans.pem
+++ b/acme/acme/testdata/cert-idnsans.pem
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFNjCCBOCgAwIBAgIJAP4rNqqOKifCMA0GCSqGSIb3DQEBCwUAMGQxCzAJBgNV
+BAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMScwJQYDVQQLDB5FbGVjdHJv
+bmljIEZyb250aWVyIEZvdW5kYXRpb24xFDASBgNVBAMMC2V4YW1wbGUuY29tMB4X
+DTE2MDEwNjIwMDg1OFoXDTE2MDEwNzIwMDg1OFowZDELMAkGA1UECAwCQ0ExFjAU
+BgNVBAcMDVNhbiBGcmFuY2lzY28xJzAlBgNVBAsMHkVsZWN0cm9uaWMgRnJvbnRp
+ZXIgRm91bmRhdGlvbjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wXDANBgkqhkiG9w0B
+AQEFAANLADBIAkEArHVztFHtH92ucFJD/N/HW9AsdRsUuHUBBBDlHwNlRd3fp580
+rv2+6QWE30cWgdmJS86ObRz6lUTor4R0T+3C5QIDAQABo4IDczCCA28wCQYDVR0T
+BAIwADALBgNVHQ8EBAMCBeAwggNTBgNVHREEggNKMIIDRoJiz4PPhM+Fz4bPh8+I
+z4nPis+Lz4zPjc+Oz4/PkM+Rz5LPk8+Uz5XPls+Xz5jPmc+az5vPnM+dz57Pn8+g
+z6HPos+jz6TPpc+mz6fPqM+pz6rPq8+sz63Prs+vLmludmFsaWSCYs+wz7HPss+z
+z7TPtc+2z7fPuM+5z7rPu8+8z73Pvs+/2YHZgtmD2YTZhdmG2YfZiNmJ2YrZi9mM
+2Y3ZjtmP2ZDZkdmS2ZPZlNmV2ZbZl9mY2ZnZmtmb2ZzZnS5pbnZhbGlkgmLZntmf
+2aDZodmi2aPZpNml2abZp9mo2anZqtmr2azZrdmu2a/ZsNmx2bLZs9m02bXZttm3
+2bjZudm62bvZvNm92b7Zv9qA2oHagtqD2oTahdqG2ofaiNqJ2oouaW52YWxpZIJi
+2ovajNqN2o7aj9qQ2pHaktqT2pTaldqW2pfamNqZ2pram9qc2p3antqf2qDaodqi
+2qPapNql2qbap9qo2qnaqtqr2qzardqu2q/asNqx2rLas9q02rXattq3LmludmFs
+aWSCYtq42rnautq72rzavdq+2r/bgNuB24Lbg9uE24XbhtuH24jbiduK24vbjNuN
+247bj9uQ25HbktuT25TblduW25fbmNuZ25rbm9uc253bntuf26Dbodui26PbpC5p
+bnZhbGlkgnjbpdum26fbqNup26rbq9us263brtuv27Dbsduy27PbtNu127bbt9u4
+27nbutu74aCg4aCh4aCi4aCj4aCk4aCl4aCm4aCn4aCo4aCp4aCq4aCr4aCs4aCt
+4aCu4aCv4aCw4aCx4aCy4aCz4aC04aC1LmludmFsaWSCgY/hoLbhoLfhoLjhoLnh
+oLrhoLvhoLzhoL3hoL7hoL/hoYDhoYHhoYLhoYPhoYThoYXhoYbhoYfhoYjhoYnh
+oYrhoYvhoYzhoY3hoY7hoY/hoZDhoZHhoZLhoZPhoZThoZXhoZbhoZfhoZjhoZnh
+oZrhoZvhoZzhoZ3hoZ7hoZ/hoaDhoaHhoaIuaW52YWxpZIJE4aGj4aGk4aGl4aGm
+4aGn4aGo4aGp4aGq4aGr4aGs4aGt4aGu4aGv4aGw4aGx4aGy4aGz4aG04aG14aG2
+LmludmFsaWQwDQYJKoZIhvcNAQELBQADQQAzOQL/54yXxln87/YvEQbBm9ik9zoT
+TxEkvnZ4kmTRhDsUPtRjMXhY2FH7LOtXKnJQ7POUB7AsJ2Z6uq2w623G
+-----END CERTIFICATE-----
--- a/acme/acme/testdata/csr-100sans.pem
+++ b/acme/acme/testdata/csr-100sans.pem
@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIHNTCCBt8CAQAwZDELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lz
+Y28xJzAlBgNVBAsMHkVsZWN0cm9uaWMgRnJvbnRpZXIgRm91bmRhdGlvbjEUMBIG
+A1UEAwwLZXhhbXBsZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEArHVztFHt
+H92ucFJD/N/HW9AsdRsUuHUBBBDlHwNlRd3fp580rv2+6QWE30cWgdmJS86ObRz6
+lUTor4R0T+3C5QIDAQABoIIGFDCCBhAGCSqGSIb3DQEJDjGCBgEwggX9MAkGA1Ud
+EwQCMAAwCwYDVR0PBAQDAgXgMIIF4QYDVR0RBIIF2DCCBdSCDGV4YW1wbGUxLmNv
+bYIMZXhhbXBsZTIuY29tggxleGFtcGxlMy5jb22CDGV4YW1wbGU0LmNvbYIMZXhh
+bXBsZTUuY29tggxleGFtcGxlNi5jb22CDGV4YW1wbGU3LmNvbYIMZXhhbXBsZTgu
+Y29tggxleGFtcGxlOS5jb22CDWV4YW1wbGUxMC5jb22CDWV4YW1wbGUxMS5jb22C
+DWV4YW1wbGUxMi5jb22CDWV4YW1wbGUxMy5jb22CDWV4YW1wbGUxNC5jb22CDWV4
+YW1wbGUxNS5jb22CDWV4YW1wbGUxNi5jb22CDWV4YW1wbGUxNy5jb22CDWV4YW1w
+bGUxOC5jb22CDWV4YW1wbGUxOS5jb22CDWV4YW1wbGUyMC5jb22CDWV4YW1wbGUy
+MS5jb22CDWV4YW1wbGUyMi5jb22CDWV4YW1wbGUyMy5jb22CDWV4YW1wbGUyNC5j
+b22CDWV4YW1wbGUyNS5jb22CDWV4YW1wbGUyNi5jb22CDWV4YW1wbGUyNy5jb22C
+DWV4YW1wbGUyOC5jb22CDWV4YW1wbGUyOS5jb22CDWV4YW1wbGUzMC5jb22CDWV4
+YW1wbGUzMS5jb22CDWV4YW1wbGUzMi5jb22CDWV4YW1wbGUzMy5jb22CDWV4YW1w
+bGUzNC5jb22CDWV4YW1wbGUzNS5jb22CDWV4YW1wbGUzNi5jb22CDWV4YW1wbGUz
+Ny5jb22CDWV4YW1wbGUzOC5jb22CDWV4YW1wbGUzOS5jb22CDWV4YW1wbGU0MC5j
+b22CDWV4YW1wbGU0MS5jb22CDWV4YW1wbGU0Mi5jb22CDWV4YW1wbGU0My5jb22C
+DWV4YW1wbGU0NC5jb22CDWV4YW1wbGU0NS5jb22CDWV4YW1wbGU0Ni5jb22CDWV4
+YW1wbGU0Ny5jb22CDWV4YW1wbGU0OC5jb22CDWV4YW1wbGU0OS5jb22CDWV4YW1w
+bGU1MC5jb22CDWV4YW1wbGU1MS5jb22CDWV4YW1wbGU1Mi5jb22CDWV4YW1wbGU1
+My5jb22CDWV4YW1wbGU1NC5jb22CDWV4YW1wbGU1NS5jb22CDWV4YW1wbGU1Ni5j
+b22CDWV4YW1wbGU1Ny5jb22CDWV4YW1wbGU1OC5jb22CDWV4YW1wbGU1OS5jb22C
+DWV4YW1wbGU2MC5jb22CDWV4YW1wbGU2MS5jb22CDWV4YW1wbGU2Mi5jb22CDWV4
+YW1wbGU2My5jb22CDWV4YW1wbGU2NC5jb22CDWV4YW1wbGU2NS5jb22CDWV4YW1w
+bGU2Ni5jb22CDWV4YW1wbGU2Ny5jb22CDWV4YW1wbGU2OC5jb22CDWV4YW1wbGU2
+OS5jb22CDWV4YW1wbGU3MC5jb22CDWV4YW1wbGU3MS5jb22CDWV4YW1wbGU3Mi5j
+b22CDWV4YW1wbGU3My5jb22CDWV4YW1wbGU3NC5jb22CDWV4YW1wbGU3NS5jb22C
+DWV4YW1wbGU3Ni5jb22CDWV4YW1wbGU3Ny5jb22CDWV4YW1wbGU3OC5jb22CDWV4
+YW1wbGU3OS5jb22CDWV4YW1wbGU4MC5jb22CDWV4YW1wbGU4MS5jb22CDWV4YW1w
+bGU4Mi5jb22CDWV4YW1wbGU4My5jb22CDWV4YW1wbGU4NC5jb22CDWV4YW1wbGU4
+NS5jb22CDWV4YW1wbGU4Ni5jb22CDWV4YW1wbGU4Ny5jb22CDWV4YW1wbGU4OC5j
+b22CDWV4YW1wbGU4OS5jb22CDWV4YW1wbGU5MC5jb22CDWV4YW1wbGU5MS5jb22C
+DWV4YW1wbGU5Mi5jb22CDWV4YW1wbGU5My5jb22CDWV4YW1wbGU5NC5jb22CDWV4
+YW1wbGU5NS5jb22CDWV4YW1wbGU5Ni5jb22CDWV4YW1wbGU5Ny5jb22CDWV4YW1w
+bGU5OC5jb22CDWV4YW1wbGU5OS5jb22CDmV4YW1wbGUxMDAuY29tMA0GCSqGSIb3
+DQEBCwUAA0EAW05UMFavHn2rkzMyUfzsOvWzVNlm43eO2yHu5h5TzDb23gkDnNEo
+duUAbQ+CLJHYd+MvRCmPQ+3ZnaPy7l/0Hg==
+-----END CERTIFICATE REQUEST-----
--- a/acme/acme/testdata/csr-idnsans.pem
+++ b/acme/acme/testdata/csr-idnsans.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIEpzCCBFECAQAwZDELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lz
+Y28xJzAlBgNVBAsMHkVsZWN0cm9uaWMgRnJvbnRpZXIgRm91bmRhdGlvbjEUMBIG
+A1UEAwwLZXhhbXBsZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEArHVztFHt
+H92ucFJD/N/HW9AsdRsUuHUBBBDlHwNlRd3fp580rv2+6QWE30cWgdmJS86ObRz6
+lUTor4R0T+3C5QIDAQABoIIDhjCCA4IGCSqGSIb3DQEJDjGCA3MwggNvMAkGA1Ud
+EwQCMAAwCwYDVR0PBAQDAgXgMIIDUwYDVR0RBIIDSjCCA0aCYs+Dz4TPhc+Gz4fP
+iM+Jz4rPi8+Mz43Pjs+Pz5DPkc+Sz5PPlM+Vz5bPl8+Yz5nPms+bz5zPnc+ez5/P
+oM+hz6LPo8+kz6XPps+nz6jPqc+qz6vPrM+tz67Pry5pbnZhbGlkgmLPsM+xz7LP
+s8+0z7XPts+3z7jPuc+6z7vPvM+9z77Pv9mB2YLZg9mE2YXZhtmH2YjZidmK2YvZ
+jNmN2Y7Zj9mQ2ZHZktmT2ZTZldmW2ZfZmNmZ2ZrZm9mc2Z0uaW52YWxpZIJi2Z7Z
+n9mg2aHZotmj2aTZpdmm2afZqNmp2arZq9ms2a3Zrtmv2bDZsdmy2bPZtNm12bbZ
+t9m42bnZutm72bzZvdm+2b/agNqB2oLag9qE2oXahtqH2ojaidqKLmludmFsaWSC
+YtqL2ozajdqO2o/akNqR2pLak9qU2pXaltqX2pjamdqa2pvanNqd2p7an9qg2qHa
+otqj2qTapdqm2qfaqNqp2qraq9qs2q3artqv2rDasdqy2rPatNq12rbaty5pbnZh
+bGlkgmLauNq52rrau9q82r3avtq/24DbgduC24PbhNuF24bbh9uI24nbituL24zb
+jduO24/bkNuR25Lbk9uU25XbltuX25jbmdua25vbnNud257bn9ug26Hbotuj26Qu
+aW52YWxpZIJ426Xbptun26jbqduq26vbrNut267br9uw27Hbstuz27Tbtdu227fb
+uNu527rbu+GgoOGgoeGgouGgo+GgpOGgpeGgpuGgp+GgqOGgqeGgquGgq+GgrOGg
+reGgruGgr+GgsOGgseGgsuGgs+GgtOGgtS5pbnZhbGlkgoGP4aC24aC34aC44aC5
+4aC64aC74aC84aC94aC+4aC/4aGA4aGB4aGC4aGD4aGE4aGF4aGG4aGH4aGI4aGJ
+4aGK4aGL4aGM4aGN4aGO4aGP4aGQ4aGR4aGS4aGT4aGU4aGV4aGW4aGX4aGY4aGZ
+4aGa4aGb4aGc4aGd4aGe4aGf4aGg4aGh4aGiLmludmFsaWSCROGho+GhpOGhpeGh
+puGhp+GhqOGhqeGhquGhq+GhrOGhreGhruGhr+GhsOGhseGhsuGhs+GhtOGhteGh
+ti5pbnZhbGlkMA0GCSqGSIb3DQEBCwUAA0EAeNkY0M0+kMnjRo6dEUoGE4dX9fEr
+dfGrpPUBcwG0P5QBdZJWvZxTfRl14yuPYHbGHULXeGqRdkU6HK5pOlzpng==
+-----END CERTIFICATE REQUEST-----
--- a/acme/setup.py
+++ b/acme/setup.py
@@ -6,12 +6,15 @@ from setuptools import find_packages

 version = '0.2.0.dev0'

+# Please update tox.ini when modifying dependency version requirements
 install_requires = [
    # load_pem_private/public_key (>=0.6)
    # rsa_recover_prime_factors (>=0.8)
-    'cryptography>=0.8,<1.2',
-    # Connection.set_tlsext_host_name (>=0.13), X509Req.get_extensions (>=0.15)
-    'PyOpenSSL>=0.15',
+    'cryptography>=0.8',
+    'ndg-httpsclient',  # urllib3 InsecurePlatformWarning (#304)
+    'pyasn1',  # urllib3 InsecurePlatformWarning (#304)
+    # Connection.set_tlsext_host_name (>=0.13)
+    'PyOpenSSL>=0.13',
    'pyrfc3339',
    'pytz',
    'requests',
@@ -30,11 +33,6 @@ if sys.version_info < (2, 7):
 else:
    install_requires.append('mock')

-if sys.version_info < (2, 7, 9):
-    # For secure SSL connection with Python 2.7 (InsecurePlatformWarning)
-    install_requires.append('ndg-httpsclient')
-    install_requires.append('pyasn1')
-
 docs_extras = [
    'Sphinx>=1.0',  # autodoc_member_order = 'bysource', autodoc_default_flags
    'sphinx_rtd_theme',
@@ -66,6 +64,7 @@ setup(
        'Programming Language :: Python :: 3',
        'Programming Language :: Python :: 3.3',
        'Programming Language :: Python :: 3.4',
+        'Programming Language :: Python :: 3.5',
        'Topic :: Internet :: WWW/HTTP',
        'Topic :: Security',
    ],
--- a/bootstrap/_deb_common.sh
+++ b/bootstrap/_deb_common.sh
@@ -32,28 +32,42 @@ if apt-cache show python-virtualenv > /dev/null 2>&1; then
  virtualenv="$virtualenv python-virtualenv"
 fi

-augeas_pkg=libaugeas0
+augeas_pkg="libaugeas0 augeas-lenses"
 AUGVERSION=`apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2`

+AddBackportRepo() {
+    # ARGS:
+    BACKPORT_NAME="$1"
+    BACKPORT_SOURCELINE="$2"
+    if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q "$BACKPORT_NAME" ; then
+        # This can theoretically error if sources.list.d is empty, but in that case we don't care.
+        if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q "$BACKPORT_NAME"; then
+            /bin/echo -n "Installing augeas from $BACKPORT_NAME in 3 seconds..."
+            sleep 1s
+            /bin/echo -ne "\e[0K\rInstalling augeas from $BACKPORT_NAME in 2 seconds..."
+            sleep 1s
+            /bin/echo -e "\e[0K\rInstalling augeas from $BACKPORT_NAME in 1 second ..."
+            sleep 1s
+            if echo $BACKPORT_NAME | grep -q wheezy ; then
+                /bin/echo '(Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports")'
+            fi
+
+            echo $BACKPORT_SOURCELINE >> /etc/apt/sources.list.d/"$BACKPORT_NAME".list
+            apt-get update
+        fi
+    fi
+    apt-get install -y --no-install-recommends -t "$BACKPORT_NAME" $augeas_pkg
+    augeas_pkg=
+
+}
+
+
 if dpkg --compare-versions 1.0 gt "$AUGVERSION" ; then
    if lsb_release -a | grep -q wheezy ; then
-        if ! grep -v -e ' *#' /etc/apt/sources.list | grep -q wheezy-backports ; then
-            # This can theoretically error if sources.list.d is empty, but in that case we don't care.
-            if ! grep -v -e ' *#' /etc/apt/sources.list.d/* 2>/dev/null | grep -q wheezy-backports ; then
-                /bin/echo -n "Installing augeas from wheezy-backports in 3 seconds..."
-                sleep 1s
-                /bin/echo -ne "\e[0K\rInstalling augeas from wheezy-backports in 2 seconds..."
-                sleep 1s
-                /bin/echo -e "\e[0K\rInstalling augeas from wheezy-backports in 1 second ..."
-                sleep 1s
-                /bin/echo '(Backports are only installed if explicitly requested via "apt-get install -t wheezy-backports")'
-
-                echo deb http://http.debian.net/debian wheezy-backports main >> /etc/apt/sources.list.d/wheezy-backports.list
-                apt-get update
-            fi
-        fi
-        apt-get install -y --no-install-recommends -t wheezy-backports libaugeas0
-        augeas_pkg=
+        AddBackportRepo wheezy-backports "deb http://http.debian.net/debian wheezy-backports main"
+    elif lsb_release -a | grep -q precise ; then
+        # XXX add ARM case
+        AddBackportRepo precise-backports "deb http://archive.ubuntu.com/ubuntu precise-backports main restricted universe multiverse"
    else
        echo "No libaugeas0 version is available that's new enough to run the"
        echo "Let's Encrypt apache plugin..."
--- a/docs/using.rst
+++ b/docs/using.rst
@@ -139,9 +139,20 @@ Would obtain a single certificate for all of those names, using the
 ``/var/www/example`` webroot directory for the first two, and
 ``/var/www/eg`` for the second two.

+The webroot plugin works by creating a temporary file for each of your requested
+domains in ``${webroot-path}/.well-known/acme-challenge``. Then the Let's
+Encrypt validation server makes HTTP requests to validate that the DNS for each
+requested domain resolves to the server running letsencrypt. An example request
+made to your web server would look like:
+
+::
+
+    66.133.109.36 - - [05/Jan/2016:20:11:24 -0500] "GET /.well-known/acme-challenge/HGr8U1IeTW4kY_Z6UIyaakzOkyQgPr_7ArlLgtZE8SX HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
+
 Note that to use the webroot plugin, your server must be configured to serve
 files from hidden directories.

+
 Manual
 ------

@@ -237,7 +248,9 @@ The following files are available:
  server certificate, i.e. root and intermediate certificates only.

  This is what Apache < 2.4.8 needs for `SSLCertificateChainFile
-  <https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatechainfile>`_.
+  <https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatechainfile>`_,
+  and what nginx >= 1.3.7 needs for `ssl_trusted_certificate
+  <http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate>`_.

 ``fullchain.pem``
  All certificates, **including** server certificate. This is
--- a/letsencrypt-apache/letsencrypt_apache/augeas_configurator.py
+++ b/letsencrypt-apache/letsencrypt_apache/augeas_configurator.py
@@ -120,7 +120,8 @@ class AugeasConfigurator(common.Plugin):
                    self.reverter.add_to_temp_checkpoint(
                        save_files, self.save_notes)
                else:
-                    self.reverter.add_to_checkpoint(save_files, self.save_notes)
+                    self.reverter.add_to_checkpoint(save_files,
+                                                    self.save_notes)
            except errors.ReverterError as err:
                raise errors.PluginError(str(err))

--- a/letsencrypt-apache/letsencrypt_apache/configurator.py
+++ b/letsencrypt-apache/letsencrypt_apache/configurator.py
@@ -8,6 +8,7 @@ import shutil
 import socket
 import time

+import zope.component
 import zope.interface

 from acme import challenges
@@ -132,7 +133,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
    @property
    def mod_ssl_conf(self):
        """Full absolute path to SSL configuration file."""
-        return os.path.join(self.config.config_dir, constants.MOD_SSL_CONF_DEST)
+        return os.path.join(self.config.config_dir,
+                            constants.MOD_SSL_CONF_DEST)

    def prepare(self):
        """Prepare the authenticator/installer.
@@ -153,10 +155,16 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        # Set Version
        if self.version is None:
            self.version = self.get_version()
-        if self.version < (2, 2):
+        if self.version < (2, 4):
            raise errors.NotSupportedError(
                "Apache Version %s not supported.", str(self.version))

+        if not self._check_aug_version():
+            raise errors.NotSupportedError(
+                "Apache plugin support requires libaugeas0 and augeas-lenses "
+                "version 1.2.0 or higher, please make sure you have you have "
+                "those installed.")
+
        self.parser = parser.ApacheParser(
            self.aug, self.conf("server-root"), self.conf("vhost-root"),
            self.version)
@@ -168,16 +176,31 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):

        install_ssl_options_conf(self.mod_ssl_conf)

+    def _check_aug_version(self):
+        """ Checks that we have recent enough version of libaugeas.
+        If augeas version is recent enough, it will support case insensitive
+        regexp matching"""
+
+        self.aug.set("/test/path/testing/arg", "aRgUMeNT")
+        try:
+            matches = self.aug.match(
+                "/test//*[self::arg=~regexp('argument', 'i')]")
+        except RuntimeError:
+            self.aug.remove("/test/path")
+            return False
+        self.aug.remove("/test/path")
+        return matches
+
    def deploy_cert(self, domain, cert_path, key_path,
-                    chain_path=None, fullchain_path=None):  # pylint: disable=unused-argument
+                    chain_path=None, fullchain_path=None):
        """Deploys certificate to specified virtual host.

        Currently tries to find the last directives to deploy the cert in
        the VHost associated with the given domain. If it can't find the
-        directives, it searches the "included" confs. The function verifies that
-        it has located the three directives and finally modifies them to point
-        to the correct destination. After the certificate is installed, the
-        VirtualHost is enabled if it isn't already.
+        directives, it searches the "included" confs. The function verifies
+        that it has located the three directives and finally modifies them
+        to point to the correct destination. After the certificate is
+        installed, the VirtualHost is enabled if it isn't already.

        .. todo:: Might be nice to remove chain directive if none exists
                  This shouldn't happen within letsencrypt though
@@ -193,8 +216,10 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        # cert_key... can all be parsed appropriately
        self.prepare_server_https("443")

-        path = {"cert_path": self.parser.find_dir("SSLCertificateFile", None, vhost.path),
-                "cert_key": self.parser.find_dir("SSLCertificateKeyFile", None, vhost.path)}
+        path = {"cert_path": self.parser.find_dir("SSLCertificateFile",
+                                                  None, vhost.path),
+                "cert_key": self.parser.find_dir("SSLCertificateKeyFile",
+                                                 None, vhost.path)}

        # Only include if a certificate chain is specified
        if chain_path is not None:
@@ -224,7 +249,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                self.parser.add_dir(vhost.path,
                                    "SSLCertificateChainFile", chain_path)
            else:
-                raise errors.PluginError("--chain-path is required for your version of Apache")
+                raise errors.PluginError("--chain-path is required for your "
+                                         "version of Apache")
        else:
            if not fullchain_path:
                raise errors.PluginError("Please provide the --fullchain-path\
@@ -298,7 +324,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        elif not vhost.ssl:
            addrs = self._get_proposed_addrs(vhost, "443")
            # TODO: Conflicts is too conservative
-            if not any(vhost.enabled and vhost.conflicts(addrs) for vhost in self.vhosts):
+            if not any(vhost.enabled and vhost.conflicts(addrs) for
+                       vhost in self.vhosts):
                vhost = self.make_vhost_ssl(vhost)
            else:
                logger.error(
@@ -488,15 +515,27 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        :rtype: list

        """
-        # Search vhost-root, httpd.conf for possible virtual hosts
-        paths = self.aug.match(
-            ("/files%s//*[label()=~regexp('%s')]" %
-             (self.conf("vhost-root"), parser.case_i("VirtualHost"))))
-
+        # Search base config, and all included paths for VirtualHosts
        vhs = []
+        vhost_paths = {}
+        for vhost_path in self.parser.parser_paths.keys():
+            paths = self.aug.match(
+                ("/files%s//*[label()=~regexp('%s')]" %
+                    (vhost_path, parser.case_i("VirtualHost"))))
+            for path in paths:
+                new_vhost = self._create_vhost(path)
+                realpath = os.path.realpath(new_vhost.filep)
+                if realpath not in vhost_paths.keys():
+                    vhs.append(new_vhost)
+                    vhost_paths[realpath] = new_vhost.filep
+                elif realpath == new_vhost.filep:
+                    # Prefer "real" vhost paths instead of symlinked ones
+                    # ex: sites-enabled/vh.conf -> sites-available/vh.conf

-        for path in paths:
-            vhs.append(self._create_vhost(path))
+                    # remove old (most likely) symlinked one
+                    vhs = [v for v in vhs if v.filep != vhost_paths[realpath]]
+                    vhs.append(new_vhost)
+                    vhost_paths[realpath] = realpath

        return vhs

@@ -554,15 +593,16 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        self.prepare_https_modules(temp)
        # Check for Listen <port>
        # Note: This could be made to also look for ip:443 combo
-        listens = [self.parser.get_arg(x).split()[0] for x in self.parser.find_dir("Listen")]
+        listens = [self.parser.get_arg(x).split()[0] for
+                   x in self.parser.find_dir("Listen")]
        # In case no Listens are set (which really is a broken apache config)
        if not listens:
            listens = ["80"]
        if port in listens:
            return
        for listen in listens:
-            # For any listen statement, check if the machine also listens on Port 443.
-            # If not, add such a listen statement.
+            # For any listen statement, check if the machine also listens on
+            # Port 443. If not, add such a listen statement.
            if len(listen.split(":")) == 1:
                # Its listening to all interfaces
                if port not in listens:
@@ -590,8 +630,9 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                    self.parser.add_dir_to_ifmodssl(
                        parser.get_aug_path(
                            self.parser.loc["listen"]), "Listen", args)
-                    self.save_notes += "Added Listen %s:%s directive to %s\n" % (
-                                       ip, port, self.parser.loc["listen"])
+                    self.save_notes += ("Added Listen %s:%s directive to "
+                                        "%s\n") % (ip, port,
+                                                   self.parser.loc["listen"])
                    listens.append("%s:%s" % (ip, port))

    def prepare_https_modules(self, temp):
@@ -697,6 +738,39 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        else:
            return non_ssl_vh_fp + self.conf("le_vhost_ext")

+    def _sift_line(self, line):
+        """Decides whether a line should be copied to a SSL vhost.
+
+        A canonical example of when sifting a line is required:
+        When the http vhost contains a RewriteRule that unconditionally
+        redirects any request to the https version of the same site.
+        e.g:
+        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [L,QSA,R=permanent]
+        Copying the above line to the ssl vhost would cause a
+        redirection loop.
+
+        :param str line: a line extracted from the http vhost.
+
+        :returns: True - don't copy line from http vhost to SSL vhost.
+        :rtype: bool
+
+        """
+        if not line.lstrip().startswith("RewriteRule"):
+            return False
+
+        # According to: http://httpd.apache.org/docs/2.4/rewrite/flags.html
+        # The syntax of a RewriteRule is:
+        # RewriteRule pattern target [Flag1,Flag2,Flag3]
+        # i.e. target is required, so it must exist.
+        target = line.split()[2].strip()
+
+        # target may be surrounded with quotes
+        if target[0] in ("'", '"') and target[0] == target[-1]:
+            target = target[1:-1]
+
+        # Sift line if it redirects the request to a HTTPS site
+        return target.startswith("https://")
+
    def _copy_create_ssl_vhost_skeleton(self, avail_fp, ssl_fp):
        """Copies over existing Vhost with IfModule mod_ssl.c> skeleton.

@@ -709,18 +783,38 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        # First register the creation so that it is properly removed if
        # configuration is rolled back
        self.reverter.register_file_creation(False, ssl_fp)
+        sift = False

        try:
            with open(avail_fp, "r") as orig_file:
                with open(ssl_fp, "w") as new_file:
                    new_file.write("<IfModule mod_ssl.c>\n")
                    for line in orig_file:
-                        new_file.write(line)
+                        if self._sift_line(line):
+                            if not sift:
+                                new_file.write(
+                                    "# Some rewrite rules in this file were "
+                                    "were disabled on your HTTPS site,\n"
+                                    "# because they have the potential to "
+                                    "create redirection loops.\n")
+                                sift = True
+                            new_file.write("# " + line)
+                        else:
+                            new_file.write(line)
                    new_file.write("</IfModule>\n")
        except IOError:
            logger.fatal("Error writing/reading to file in make_vhost_ssl")
            raise errors.PluginError("Unable to write/read in make_vhost_ssl")

+        if sift:
+            reporter = zope.component.getUtility(interfaces.IReporter)
+            reporter.add_message(
+                "Some rewrite rules copied from {0} were disabled in the "
+                "vhost for your HTTPS site located at {1} because they have "
+                "the potential to create redirection loops.".format(avail_fp,
+                                                                    ssl_fp),
+                reporter.MEDIUM_PRIORITY)
+
    def _update_ssl_vhosts_addrs(self, vh_path):
        ssl_addrs = set()
        ssl_addr_p = self.aug.match(vh_path + "/arg")
@@ -737,20 +831,25 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
    def _clean_vhost(self, vhost):
        # remove duplicated or conflicting ssl directives
        self._deduplicate_directives(vhost.path,
-            ["SSLCertificateFile", "SSLCertificateKeyFile"])
+                                     ["SSLCertificateFile",
+                                      "SSLCertificateKeyFile"])
        # remove all problematic directives
        self._remove_directives(vhost.path, ["SSLCertificateChainFile"])

    def _deduplicate_directives(self, vh_path, directives):
        for directive in directives:
-            while len(self.parser.find_dir(directive, None, vh_path, False)) > 1:
-                directive_path = self.parser.find_dir(directive, None, vh_path, False)
+            while len(self.parser.find_dir(directive, None,
+                                           vh_path, False)) > 1:
+                directive_path = self.parser.find_dir(directive, None,
+                                                      vh_path, False)
                self.aug.remove(re.sub(r"/\w*$", "", directive_path[0]))

    def _remove_directives(self, vh_path, directives):
        for directive in directives:
-            while len(self.parser.find_dir(directive, None, vh_path, False)) > 0:
-                directive_path = self.parser.find_dir(directive, None, vh_path, False)
+            while len(self.parser.find_dir(directive, None,
+                                           vh_path, False)) > 0:
+                directive_path = self.parser.find_dir(directive, None,
+                                                      vh_path, False)
                self.aug.remove(re.sub(r"/\w*$", "", directive_path[0]))

    def _add_dummy_ssl_directives(self, vh_path):
@@ -777,7 +876,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        for addr in vhost.addrs:
            for test_vh in self.vhosts:
                if (vhost.filep != test_vh.filep and
-                        any(test_addr == addr for test_addr in test_vh.addrs) and
+                        any(test_addr == addr for
+                            test_addr in test_vh.addrs) and
                        not self.is_name_vhost(addr)):
                    self.add_name_vhost(addr)
                    logger.info("Enabling NameVirtualHosts on %s", addr)
@@ -786,9 +886,9 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        if need_to_save:
            self.save()

-    ############################################################################
+    ######################################################################
    # Enhancements
-    ############################################################################
+    ######################################################################
    def supported_enhancements(self):  # pylint: disable=no-self-use
        """Returns currently supported enhancements."""
        return ["redirect", "ensure-http-header"]
@@ -849,14 +949,14 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):

        # Add directives to server
        self.parser.add_dir(ssl_vhost.path, "Header",
-                constants.HEADER_ARGS[header_substring])
+                            constants.HEADER_ARGS[header_substring])

        self.save_notes += ("Adding %s header to ssl vhost in %s\n" %
-                (header_substring, ssl_vhost.filep))
+                            (header_substring, ssl_vhost.filep))

        self.save()
        logger.info("Adding %s header to ssl vhost in %s", header_substring,
-                ssl_vhost.filep)
+                    ssl_vhost.filep)

    def _verify_no_matching_http_header(self, ssl_vhost, header_substring):
        """Checks to see if an there is an existing Header directive that
@@ -876,14 +976,15 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                header_substring exists

        """
-        header_path = self.parser.find_dir("Header", None, start=ssl_vhost.path)
+        header_path = self.parser.find_dir("Header", None,
+                                           start=ssl_vhost.path)
        if header_path:
            # "Existing Header directive for virtualhost"
            pat = '(?:[ "]|^)(%s)(?:[ "]|$)' % (header_substring.lower())
            for match in header_path:
                if re.search(pat, self.aug.get(match).lower()):
                    raise errors.PluginEnhancementAlreadyPresent(
-                            "Existing %s header" % (header_substring))
+                        "Existing %s header" % (header_substring))

    def _enable_redirect(self, ssl_vhost, unused_options):
        """Redirect all equivalent HTTP traffic to ssl_vhost.
@@ -932,7 +1033,6 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
            # Check if LetsEncrypt redirection already exists
            self._verify_no_letsencrypt_redirect(general_vh)

-
            # Note: if code flow gets here it means we didn't find the exact
            # letsencrypt RewriteRule config for redirection. Finding
            # another RewriteRule is likely to be fine in most or all cases,
@@ -951,10 +1051,10 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):

            if self.get_version() >= (2, 3, 9):
                self.parser.add_dir(general_vh.path, "RewriteRule",
-                                constants.REWRITE_HTTPS_ARGS_WITH_END)
+                                    constants.REWRITE_HTTPS_ARGS_WITH_END)
            else:
                self.parser.add_dir(general_vh.path, "RewriteRule",
-                                constants.REWRITE_HTTPS_ARGS)
+                                    constants.REWRITE_HTTPS_ARGS)

            self.save_notes += ("Redirecting host in %s to ssl vhost in %s\n" %
                                (general_vh.filep, ssl_vhost.filep))
@@ -976,7 +1076,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                letsencrypt redirection WriteRule exists in virtual host.
        """
        rewrite_path = self.parser.find_dir(
-                "RewriteRule", None, start=vhost.path)
+            "RewriteRule", None, start=vhost.path)

        # There can be other RewriteRule directive lines in vhost config.
        # rewrite_args_dict keys are directive ids and the corresponding value
@@ -991,12 +1091,12 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):

        if rewrite_args_dict:
            redirect_args = [constants.REWRITE_HTTPS_ARGS,
-                constants.REWRITE_HTTPS_ARGS_WITH_END]
+                             constants.REWRITE_HTTPS_ARGS_WITH_END]

            for matches in rewrite_args_dict.values():
                if [self.aug.get(x) for x in matches] in redirect_args:
                    raise errors.PluginEnhancementAlreadyPresent(
-                    "Let's Encrypt has already enabled redirection")
+                        "Let's Encrypt has already enabled redirection")

    def _is_rewrite_exists(self, vhost):
        """Checks if there exists a RewriteRule directive in vhost
@@ -1009,7 +1109,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):

        """
        rewrite_path = self.parser.find_dir(
-                "RewriteRule", None, start=vhost.path)
+            "RewriteRule", None, start=vhost.path)
        return bool(rewrite_path)

    def _is_rewrite_engine_on(self, vhost):
@@ -1020,7 +1120,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):

        """
        rewrite_engine_path = self.parser.find_dir("RewriteEngine", "on",
-                start=vhost.path)
+                                                   start=vhost.path)
        if rewrite_engine_path:
            return self.parser.get_arg(rewrite_engine_path[0])
        return False
@@ -1066,7 +1166,6 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        else:
            rewrite_rule_args = constants.REWRITE_HTTPS_ARGS

-
        return ("<VirtualHost %s>\n"
                "%s \n"
                "%s \n"
@@ -1078,7 +1177,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                "ErrorLog /var/log/apache2/redirect.error.log\n"
                "LogLevel warn\n"
                "</VirtualHost>\n"
-                % (" ".join(str(addr) for addr in self._get_proposed_addrs(ssl_vhost)),
+                % (" ".join(str(addr) for
+                            addr in self._get_proposed_addrs(ssl_vhost)),
                   servername, serveralias,
                   " ".join(rewrite_rule_args)))

@@ -1092,7 +1192,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
            if len(ssl_vhost.name) < (255 - (len(redirect_filename) + 1)):
                redirect_filename = "le-redirect-%s.conf" % ssl_vhost.name

-        redirect_filepath = os.path.join(self.conf("vhost-root"), redirect_filename)
+        redirect_filepath = os.path.join(self.conf("vhost-root"),
+                                         redirect_filename)

        # Register the new file that will be created
        # Note: always register the creation before writing to ensure file will
@@ -1120,7 +1221,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):

        return None

-    def _get_proposed_addrs(self, vhost, port="80"):  # pylint: disable=no-self-use
+    def _get_proposed_addrs(self, vhost, port="80"):
        """Return all addrs of vhost with the port replaced with the specified.

        :param obj.VirtualHost ssl_vhost: Original Vhost
@@ -1200,7 +1301,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
        .. note:: Does not make sure that the site correctly works or that all
                  modules are enabled appropriately.

-        .. todo:: This function should number subdomains before the domain vhost
+        .. todo:: This function should number subdomains before the domain
+                  vhost

        .. todo:: Make sure link is not broken...

--- a/letsencrypt-apache/letsencrypt_apache/constants.py
+++ b/letsencrypt-apache/letsencrypt_apache/constants.py
@@ -73,7 +73,8 @@ AUGEAS_LENS_DIR = pkg_resources.resource_filename(

 REWRITE_HTTPS_ARGS = [
    "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,QSA,R=permanent]"]
-"""Apache version<2.3.9 rewrite rule arguments used for redirections to https vhost"""
+"""Apache version<2.3.9 rewrite rule arguments used for redirections to
+https vhost"""

 REWRITE_HTTPS_ARGS_WITH_END = [
    "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,QSA,R=permanent]"]
@@ -81,14 +82,14 @@ REWRITE_HTTPS_ARGS_WITH_END = [
    https vhost"""

 HSTS_ARGS = ["always", "set", "Strict-Transport-Security",
-    "\"max-age=31536000\""]
+             "\"max-age=31536000\""]
 """Apache header arguments for HSTS"""

 UIR_ARGS = ["always", "set", "Content-Security-Policy",
-    "upgrade-insecure-requests"]
+            "upgrade-insecure-requests"]

 HEADER_ARGS = {"Strict-Transport-Security": HSTS_ARGS,
-        "Upgrade-Insecure-Requests": UIR_ARGS}
+               "Upgrade-Insecure-Requests": UIR_ARGS}


 def os_constant(key):
--- a/letsencrypt-apache/letsencrypt_apache/display_ops.py
+++ b/letsencrypt-apache/letsencrypt_apache/display_ops.py
@@ -81,14 +81,15 @@ def _vhost_menu(domain, vhosts):

    try:
        code, tag = zope.component.getUtility(interfaces.IDisplay).menu(
-            "We were unable to find a vhost with a ServerName or Address of {0}.{1}"
-            "Which virtual host would you like to choose?".format(domain, os.linesep),
+            "We were unable to find a vhost with a ServerName "
+            "or Address of {0}.{1}Which virtual host would you "
+            "like to choose?".format(domain, os.linesep),
            choices, help_label="More Info", ok_label="Select")
    except errors.MissingCommandlineFlag, e:
        msg = ("Failed to run Apache plugin non-interactively{1}{0}{1}"
-               "(The best solution is to add ServerName or ServerAlias entries to "
-               "the VirtualHost directives of your apache configuration files.)".format(e,
-               os.linesep))
+               "(The best solution is to add ServerName or ServerAlias "
+               "entries to the VirtualHost directives of your apache "
+               "configuration files.)".format(e, os.linesep))
        raise errors.MissingCommandlineFlag, msg

    return code, tag
--- a/letsencrypt-apache/letsencrypt_apache/parser.py
+++ b/letsencrypt-apache/letsencrypt_apache/parser.py
@@ -35,6 +35,7 @@ class ApacheParser(object):
        # https://httpd.apache.org/docs/2.4/mod/core.html#define
        # https://httpd.apache.org/docs/2.4/mod/core.html#ifdefine
        # This only handles invocation parameters and Define directives!
+        self.parser_paths = {}
        self.variables = {}
        if version >= (2, 4):
            self.update_runtime_variables()
@@ -95,11 +96,12 @@ class ApacheParser(object):
    def update_runtime_variables(self):
        """"

-        .. note:: Compile time variables (apache2ctl -V) are not used within the
-            dynamic configuration files.  These should not be parsed or
+        .. note:: Compile time variables (apache2ctl -V) are not used within
+            the dynamic configuration files.  These should not be parsed or
            interpreted.

-        .. todo:: Create separate compile time variables... simply for arg_get()
+        .. todo:: Create separate compile time variables...
+            simply for arg_get()

        """
        stdout = self._get_runtime_cfg()
@@ -176,7 +178,8 @@ class ApacheParser(object):
                    # Make sure we don't cause an IndexError (end of list)
                    # Check to make sure arg + 1 doesn't exist
                    if (i == (len(matches) - 1) or
-                            not matches[i + 1].endswith("/arg[%d]" % (args + 1))):
+                            not matches[i + 1].endswith("/arg[%d]" %
+                                                        (args + 1))):
                        filtered.append(matches[i][:-len("/arg[%d]" % args)])

        return filtered
@@ -310,8 +313,6 @@ class ApacheParser(object):
        for match in matches:
            dir_ = self.aug.get(match).lower()
            if dir_ == "include" or dir_ == "includeoptional":
-                # start[6:] to strip off /files
-                #print self._get_include_path(self.get_arg(match +"/arg")), directive, arg
                ordered_matches.extend(self.find_dir(
                    directive, arg,
                    self._get_include_path(self.get_arg(match + "/arg")),
@@ -330,8 +331,8 @@ class ApacheParser(object):
        """
        value = self.aug.get(match)

-        # No need to strip quotes for variables, as apache2ctl already does this
-        # but we do need to strip quotes for all normal arguments.
+        # No need to strip quotes for variables, as apache2ctl already does
+        # this, but we do need to strip quotes for all normal arguments.

        # Note: normal argument may be a quoted variable
        # e.g. strip now, not later
@@ -453,7 +454,7 @@ class ApacheParser(object):
        https://apr.apache.org/docs/apr/2.0/apr__fnmatch_8h_source.html
        http://apache2.sourcearchive.com/documentation/2.2.16-6/apr__fnmatch_8h_source.html

-        :param str clean_fn_match: Apache style filename match, similar to globs
+        :param str clean_fn_match: Apache style filename match, like globs

        :returns: regex suitable for augeas
        :rtype: str
@@ -471,16 +472,63 @@ class ApacheParser(object):
        :param str filepath: Apache config file path

        """
+        use_new, remove_old = self._check_path_actions(filepath)
        # Test if augeas included file for Httpd.lens
        # Note: This works for augeas globs, ie. *.conf
-        inc_test = self.aug.match(
-            "/augeas/load/Httpd/incl [. ='%s']" % filepath)
-        if not inc_test:
-            # Load up files
-            # This doesn't seem to work on TravisCI
-            # self.aug.add_transform("Httpd.lns", [filepath])
-            self._add_httpd_transform(filepath)
-            self.aug.load()
+        if use_new:
+            inc_test = self.aug.match(
+                "/augeas/load/Httpd/incl [. ='%s']" % filepath)
+            if not inc_test:
+                # Load up files
+                # This doesn't seem to work on TravisCI
+                # self.aug.add_transform("Httpd.lns", [filepath])
+                if remove_old:
+                    self._remove_httpd_transform(filepath)
+                self._add_httpd_transform(filepath)
+                self.aug.load()
+
+    def _check_path_actions(self, filepath):
+        """Determine actions to take with a new augeas path
+
+        This helper function will return a tuple that defines
+        if we should try to append the new filepath to augeas
+        parser paths, and / or remove the old one with more
+        narrow matching.
+
+        :param str filepath: filepath to check the actions for
+
+        """
+
+        try:
+            new_file_match = os.path.basename(filepath)
+            existing_matches = self.parser_paths[os.path.dirname(filepath)]
+            if "*" in existing_matches:
+                use_new = False
+            else:
+                use_new = True
+            if new_file_match == "*":
+                remove_old = True
+            else:
+                remove_old = False
+        except KeyError:
+            use_new = True
+            remove_old = False
+        return use_new, remove_old
+
+    def _remove_httpd_transform(self, filepath):
+        """Remove path from Augeas transform
+
+        :param str filepath: filepath to remove
+        """
+
+        remove_basenames = self.parser_paths[os.path.dirname(filepath)]
+        remove_dirname = os.path.dirname(filepath)
+        for name in remove_basenames:
+            remove_path = remove_dirname + "/" + name
+            remove_inc = self.aug.match(
+                "/augeas/load/Httpd/incl [. ='%s']" % remove_path)
+            self.aug.remove(remove_inc[0])
+        self.parser_paths.pop(remove_dirname)

    def _add_httpd_transform(self, incl):
        """Add a transform to Augeas.
@@ -502,6 +550,13 @@ class ApacheParser(object):
            # Augeas uses base 1 indexing... insert at beginning...
            self.aug.set("/augeas/load/Httpd/lens", "Httpd.lns")
            self.aug.set("/augeas/load/Httpd/incl", incl)
+        # Add included path to paths dictionary
+        try:
+            self.parser_paths[os.path.dirname(incl)].append(
+                os.path.basename(incl))
+        except KeyError:
+            self.parser_paths[os.path.dirname(incl)] = [
+                os.path.basename(incl)]

    def standardize_excl(self):
        """Standardize the excl arguments for the Httpd lens in Augeas.
--- a/letsencrypt-apache/letsencrypt_apache/tests/apache-conf-files/apache-conf-test
+++ b/letsencrypt-apache/letsencrypt_apache/tests/apache-conf-files/apache-conf-test
@@ -49,7 +49,8 @@ if [ "$1" = --debian-modules ] ; then
    sudo apt-get install -y libapache2-mod-wsgi
    sudo apt-get install -y libapache2-mod-macro

-    for mod in  ssl rewrite macro wsgi deflate userdir version mime ; do
+    for mod in  ssl rewrite macro wsgi deflate userdir version mime setenvif ; do
+        echo -n enabling $mod
        sudo a2enmod $mod
    done
 fi
--- a/letsencrypt-apache/letsencrypt_apache/tests/complex_parsing_test.py
+++ b/letsencrypt-apache/letsencrypt_apache/tests/complex_parsing_test.py
@@ -96,7 +96,8 @@ class ComplexParserTest(util.ParserTest):
        else:
            self.assertFalse(self.parser.find_dir("FNMATCH_DIRECTIVE"))

-    # NOTE: Only run one test per function otherwise you will have inf recursion
+    # NOTE: Only run one test per function otherwise you will have
+    # inf recursion
    def test_include(self):
        self.verify_fnmatch("test_fnmatch.?onf")

@@ -104,7 +105,8 @@ class ComplexParserTest(util.ParserTest):
        self.verify_fnmatch("../complex_parsing/[te][te]st_*.?onf")

    def test_include_fullpath(self):
-        self.verify_fnmatch(os.path.join(self.config_path, "test_fnmatch.conf"))
+        self.verify_fnmatch(os.path.join(self.config_path,
+                                         "test_fnmatch.conf"))

    def test_include_fullpath_trailing_slash(self):
        self.verify_fnmatch(self.config_path + "//")
--- a/letsencrypt-apache/letsencrypt_apache/tests/configurator_test.py
+++ b/letsencrypt-apache/letsencrypt_apache/tests/configurator_test.py
@@ -35,10 +35,10 @@ class TwoVhost80Test(util.ApacheTest):
    def mock_deploy_cert(self, config):
        """A test for a mock deploy cert"""
        self.config.real_deploy_cert = self.config.deploy_cert
+
        def mocked_deploy_cert(*args, **kwargs):
            """a helper to mock a deployed cert"""
-            with mock.patch(
-                 "letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
+            with mock.patch("letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
                config.real_deploy_cert(*args, **kwargs)
        self.config.deploy_cert = mocked_deploy_cert
        return self.config
@@ -65,6 +65,16 @@ class TwoVhost80Test(util.ApacheTest):
        self.assertRaises(
            errors.NotSupportedError, self.config.prepare)

+    @mock.patch("letsencrypt_apache.parser.ApacheParser")
+    @mock.patch("letsencrypt_apache.configurator.le_util.exe_exists")
+    def test_prepare_old_aug(self, mock_exe_exists, _):
+        mock_exe_exists.return_value = True
+        self.config.config_test = mock.Mock()
+        # pylint: disable=protected-access
+        self.config._check_aug_version = mock.Mock(return_value=False)
+        self.assertRaises(
+            errors.NotSupportedError, self.config.prepare)
+
    def test_add_parser_arguments(self):  # pylint: disable=no-self-use
        from letsencrypt_apache.configurator import ApacheConfigurator
        # Weak test..
@@ -101,8 +111,8 @@ class TwoVhost80Test(util.ApacheTest):
    def test_add_servernames_alias(self):
        self.config.parser.add_dir(
            self.vh_truth[2].path, "ServerAlias", ["*.le.co"])
-        self.config._add_servernames(self.vh_truth[2])  # pylint: disable=protected-access
-
+        # pylint: disable=protected-access
+        self.config._add_servernames(self.vh_truth[2])
        self.assertEqual(
            self.vh_truth[2].get_names(), set(["*.le.co", "ip-172-30-0-17"]))

@@ -128,20 +138,10 @@ class TwoVhost80Test(util.ApacheTest):
        self.assertEqual(found, 6)

        # Handle case of non-debian layout get_virtual_hosts
-        orig_conf = self.config.conf
        with mock.patch(
                "letsencrypt_apache.configurator.ApacheConfigurator.conf"
-        )  as mock_conf:
-            def conf_sideeffect(key):
-                """Handle calls to configurator.conf()
-                :param key: configuration key
-                :return: configuration value
-                """
-                if key == "handle-sites":
-                    return False
-                else:
-                    return orig_conf(key)
-            mock_conf.side_effect = conf_sideeffect
+        ) as mock_conf:
+            mock_conf.return_value = False
            vhs = self.config.get_virtual_hosts()
            self.assertEqual(len(vhs), 6)

@@ -178,7 +178,8 @@ class TwoVhost80Test(util.ApacheTest):
    def test_choose_vhost_select_vhost_conflicting_non_ssl(self, mock_select):
        mock_select.return_value = self.vh_truth[3]
        conflicting_vhost = obj.VirtualHost(
-            "path", "aug_path", set([obj.Addr.fromstring("*:443")]), True, True)
+            "path", "aug_path", set([obj.Addr.fromstring("*:443")]),
+            True, True)
        self.config.vhosts.append(conflicting_vhost)

        self.assertRaises(
@@ -197,7 +198,8 @@ class TwoVhost80Test(util.ApacheTest):
    def test_find_best_vhost_variety(self):
        # pylint: disable=protected-access
        ssl_vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr(("*", "443")), obj.Addr(("zombo.com",))]),
+            "fp", "ap", set([obj.Addr(("*", "443")),
+                             obj.Addr(("zombo.com",))]),
            True, False)
        self.config.vhosts.append(ssl_vh)
        self.assertEqual(self.config._find_best_vhost("zombo.com"), ssl_vh)
@@ -278,7 +280,8 @@ class TwoVhost80Test(util.ApacheTest):

    def test_deploy_cert_newssl(self):
        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir, version=(2, 4, 16))
+            self.config_path, self.vhost_path, self.config_dir,
+            self.work_dir, version=(2, 4, 16))

        self.config.parser.modules.add("ssl_module")
        self.config.parser.modules.add("mod_ssl.c")
@@ -296,7 +299,8 @@ class TwoVhost80Test(util.ApacheTest):
        self.assertTrue("ssl_module" in self.config.parser.modules)

        loc_cert = self.config.parser.find_dir(
-            "sslcertificatefile", "example/fullchain.pem", self.vh_truth[1].path)
+            "sslcertificatefile", "example/fullchain.pem",
+            self.vh_truth[1].path)
        loc_key = self.config.parser.find_dir(
            "sslcertificateKeyfile", "example/key.pem", self.vh_truth[1].path)

@@ -311,7 +315,8 @@ class TwoVhost80Test(util.ApacheTest):

    def test_deploy_cert_newssl_no_fullchain(self):
        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir, version=(2, 4, 16))
+            self.config_path, self.vhost_path, self.config_dir,
+            self.work_dir, version=(2, 4, 16))
        self.config = self.mock_deploy_cert(self.config)

        self.config.parser.modules.add("ssl_module")
@@ -321,11 +326,13 @@ class TwoVhost80Test(util.ApacheTest):
        self.config.assoc["random.demo"] = self.vh_truth[1]
        self.assertRaises(errors.PluginError,
                          lambda: self.config.deploy_cert(
-                              "random.demo", "example/cert.pem", "example/key.pem"))
+                              "random.demo", "example/cert.pem",
+                              "example/key.pem"))

    def test_deploy_cert_old_apache_no_chain(self):
        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir, version=(2, 4, 7))
+            self.config_path, self.vhost_path, self.config_dir,
+            self.work_dir, version=(2, 4, 7))
        self.config = self.mock_deploy_cert(self.config)

        self.config.parser.modules.add("ssl_module")
@@ -335,7 +342,8 @@ class TwoVhost80Test(util.ApacheTest):
        self.config.assoc["random.demo"] = self.vh_truth[1]
        self.assertRaises(errors.PluginError,
                          lambda: self.config.deploy_cert(
-                              "random.demo", "example/cert.pem", "example/key.pem"))
+                              "random.demo", "example/cert.pem",
+                              "example/key.pem"))

    def test_deploy_cert(self):
        self.config.parser.modules.add("ssl_module")
@@ -443,7 +451,8 @@ class TwoVhost80Test(util.ApacheTest):

        # Test Listen statements with specific ip listeed
        self.config.prepare_server_https("443")
-        # Should only be 2 here, as the third interface already listens to the correct port
+        # Should only be 2 here, as the third interface
+        # already listens to the correct port
        self.assertEqual(mock_add_dir.call_count, 2)

        # Check argument to new Listen statements
@@ -457,9 +466,12 @@ class TwoVhost80Test(util.ApacheTest):
        # Test
        self.config.prepare_server_https("8080", temp=True)
        self.assertEqual(mock_add_dir.call_count, 3)
-        self.assertEqual(mock_add_dir.call_args_list[0][0][2], ["1.2.3.4:8080", "https"])
-        self.assertEqual(mock_add_dir.call_args_list[1][0][2], ["[::1]:8080", "https"])
-        self.assertEqual(mock_add_dir.call_args_list[2][0][2], ["1.1.1.1:8080", "https"])
+        self.assertEqual(mock_add_dir.call_args_list[0][0][2],
+                         ["1.2.3.4:8080", "https"])
+        self.assertEqual(mock_add_dir.call_args_list[1][0][2],
+                         ["[::1]:8080", "https"])
+        self.assertEqual(mock_add_dir.call_args_list[2][0][2],
+                         ["1.1.1.1:8080", "https"])

    def test_prepare_server_https_mixed_listen(self):

@@ -477,7 +489,8 @@ class TwoVhost80Test(util.ApacheTest):

        # Test Listen statements with specific ip listeed
        self.config.prepare_server_https("443")
-        # Should only be 2 here, as the third interface already listens to the correct port
+        # Should only be 2 here, as the third interface
+        # already listens to the correct port
        self.assertEqual(mock_add_dir.call_count, 0)

    def test_make_vhost_ssl(self):
@@ -511,7 +524,8 @@ class TwoVhost80Test(util.ApacheTest):
        for directive in ["SSLCertificateFile", "SSLCertificateKeyFile",
                          "SSLCertificateChainFile", "SSLCACertificatePath"]:
            for _ in range(10):
-                self.config.parser.add_dir(self.vh_truth[1].path, directive, ["bogus"])
+                self.config.parser.add_dir(self.vh_truth[1].path,
+                                           directive, ["bogus"])
        self.config.save()

        self.config._clean_vhost(self.vh_truth[1])
@@ -537,23 +551,24 @@ class TwoVhost80Test(util.ApacheTest):
        # pylint: disable=protected-access
        DIRECTIVE = "Foo"
        for _ in range(10):
-            self.config.parser.add_dir(self.vh_truth[1].path, DIRECTIVE, ["bar"])
+            self.config.parser.add_dir(self.vh_truth[1].path,
+                                       DIRECTIVE, ["bar"])
        self.config.save()

        self.config._deduplicate_directives(self.vh_truth[1].path, [DIRECTIVE])
        self.config.save()

        self.assertEqual(
-                         len(self.config.parser.find_dir(
-                             DIRECTIVE, None, self.vh_truth[1].path, False)),
-                         1)
+            len(self.config.parser.find_dir(
+                DIRECTIVE, None, self.vh_truth[1].path, False)), 1)

    def test_remove_directives(self):
        # pylint: disable=protected-access
        DIRECTIVES = ["Foo", "Bar"]
        for directive in DIRECTIVES:
            for _ in range(10):
-                self.config.parser.add_dir(self.vh_truth[1].path, directive, ["baz"])
+                self.config.parser.add_dir(self.vh_truth[1].path,
+                                           directive, ["baz"])
        self.config.save()

        self.config._remove_directives(self.vh_truth[1].path, DIRECTIVES)
@@ -561,9 +576,8 @@ class TwoVhost80Test(util.ApacheTest):

        for directive in DIRECTIVES:
            self.assertEqual(
-                             len(self.config.parser.find_dir(
-                                 directive, None, self.vh_truth[1].path, False)),
-                             0)
+                len(self.config.parser.find_dir(
+                    directive, None, self.vh_truth[1].path, False)), 0)

    def test_make_vhost_ssl_extra_vhs(self):
        self.config.aug.match = mock.Mock(return_value=["p1", "p2"])
@@ -652,7 +666,8 @@ class TwoVhost80Test(util.ApacheTest):
        self.assertRaises(errors.PluginError, self.config.get_version)

        mock_script.return_value = (
-            "Server Version: Apache/2.3{0} Apache/2.4.7".format(os.linesep), "")
+            "Server Version: Apache/2.3{0} Apache/2.4.7".format(
+                os.linesep), "")
        self.assertRaises(errors.PluginError, self.config.get_version)

        mock_script.side_effect = errors.SubprocessError("Can't find program")
@@ -676,7 +691,8 @@ class TwoVhost80Test(util.ApacheTest):
    def test_config_test_bad_process(self, mock_run_script):
        mock_run_script.side_effect = errors.SubprocessError

-        self.assertRaises(errors.MisconfigurationError, self.config.config_test)
+        self.assertRaises(errors.MisconfigurationError,
+                          self.config.config_test)

    def test_get_all_certs_keys(self):
        c_k = self.config.get_all_certs_keys()
@@ -688,7 +704,8 @@ class TwoVhost80Test(util.ApacheTest):
        self.assertTrue("default-ssl" in path)

    def test_get_all_certs_keys_malformed_conf(self):
-        self.config.parser.find_dir = mock.Mock(side_effect=[["path"], [], ["path"], []])
+        self.config.parser.find_dir = mock.Mock(
+            side_effect=[["path"], [], ["path"], []])
        c_k = self.config.get_all_certs_keys()

        self.assertFalse(c_k)
@@ -709,13 +726,13 @@ class TwoVhost80Test(util.ApacheTest):
    def test_supported_enhancements(self):
        self.assertTrue(isinstance(self.config.supported_enhancements(), list))

-
    @mock.patch("letsencrypt.le_util.exe_exists")
    def test_enhance_unknown_vhost(self, mock_exe):
        self.config.parser.modules.add("rewrite_module")
        mock_exe.return_value = True
        ssl_vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr(("*", "443")), obj.Addr(("satoshi.com",))]),
+            "fp", "ap", set([obj.Addr(("*", "443")),
+                             obj.Addr(("satoshi.com",))]),
            True, False)
        self.config.vhosts.append(ssl_vh)
        self.assertRaises(
@@ -736,7 +753,7 @@ class TwoVhost80Test(util.ApacheTest):

        # This will create an ssl vhost for letsencrypt.demo
        self.config.enhance("letsencrypt.demo", "ensure-http-header",
-                "Strict-Transport-Security")
+                            "Strict-Transport-Security")

        self.assertTrue("headers_module" in self.config.parser.modules)

@@ -746,7 +763,7 @@ class TwoVhost80Test(util.ApacheTest):
        # These are not immediately available in find_dir even with save() and
        # load(). They must be found in sites-available
        hsts_header = self.config.parser.find_dir(
-                "Header", None, ssl_vhost.path)
+            "Header", None, ssl_vhost.path)

        # four args to HSTS header
        self.assertEqual(len(hsts_header), 4)
@@ -758,12 +775,12 @@ class TwoVhost80Test(util.ApacheTest):

        # This will create an ssl vhost for letsencrypt.demo
        self.config.enhance("encryption-example.demo", "ensure-http-header",
-                "Strict-Transport-Security")
+                            "Strict-Transport-Security")

        self.assertRaises(
            errors.PluginEnhancementAlreadyPresent,
-            self.config.enhance, "encryption-example.demo", "ensure-http-header",
-            "Strict-Transport-Security")
+            self.config.enhance, "encryption-example.demo",
+            "ensure-http-header", "Strict-Transport-Security")

    @mock.patch("letsencrypt.le_util.run_script")
    @mock.patch("letsencrypt.le_util.exe_exists")
@@ -774,7 +791,7 @@ class TwoVhost80Test(util.ApacheTest):

        # This will create an ssl vhost for letsencrypt.demo
        self.config.enhance("letsencrypt.demo", "ensure-http-header",
-                "Upgrade-Insecure-Requests")
+                            "Upgrade-Insecure-Requests")

        self.assertTrue("headers_module" in self.config.parser.modules)

@@ -784,7 +801,7 @@ class TwoVhost80Test(util.ApacheTest):
        # These are not immediately available in find_dir even with save() and
        # load(). They must be found in sites-available
        uir_header = self.config.parser.find_dir(
-                "Header", None, ssl_vhost.path)
+            "Header", None, ssl_vhost.path)

        # four args to HSTS header
        self.assertEqual(len(uir_header), 4)
@@ -796,14 +813,12 @@ class TwoVhost80Test(util.ApacheTest):

        # This will create an ssl vhost for letsencrypt.demo
        self.config.enhance("encryption-example.demo", "ensure-http-header",
-                "Upgrade-Insecure-Requests")
+                            "Upgrade-Insecure-Requests")

        self.assertRaises(
            errors.PluginEnhancementAlreadyPresent,
-            self.config.enhance, "encryption-example.demo", "ensure-http-header",
-            "Upgrade-Insecure-Requests")
-
-
+            self.config.enhance, "encryption-example.demo",
+            "ensure-http-header", "Upgrade-Insecure-Requests")

    @mock.patch("letsencrypt.le_util.run_script")
    @mock.patch("letsencrypt.le_util.exe_exists")
@@ -837,7 +852,8 @@ class TwoVhost80Test(util.ApacheTest):
        self.config.get_version = mock.Mock(return_value=(2, 3, 9))
        self.config.parser.add_dir(
            self.vh_truth[3].path, "RewriteRule", ["Unknown"])
-        self.assertTrue(self.config._is_rewrite_exists(self.vh_truth[3])) # pylint: disable=protected-access
+        # pylint: disable=protected-access
+        self.assertTrue(self.config._is_rewrite_exists(self.vh_truth[3]))

    def test_rewrite_engine_exists(self):
        # Skip the enable mod
@@ -845,8 +861,8 @@ class TwoVhost80Test(util.ApacheTest):
        self.config.get_version = mock.Mock(return_value=(2, 3, 9))
        self.config.parser.add_dir(
            self.vh_truth[3].path, "RewriteEngine", "on")
-        self.assertTrue(self.config._is_rewrite_engine_on(self.vh_truth[3])) # pylint: disable=protected-access
-
+        # pylint: disable=protected-access
+        self.assertTrue(self.config._is_rewrite_engine_on(self.vh_truth[3]))

    @mock.patch("letsencrypt.le_util.run_script")
    @mock.patch("letsencrypt.le_util.exe_exists")
@@ -857,7 +873,8 @@ class TwoVhost80Test(util.ApacheTest):

        # Create a preexisting rewrite rule
        self.config.parser.add_dir(
-            self.vh_truth[3].path, "RewriteRule", ["Unknown"])
+            self.vh_truth[3].path, "RewriteRule", ["UnknownPattern",
+                                                   "UnknownTarget"])
        self.config.save()

        # This will create an ssl vhost for letsencrypt.demo
@@ -872,18 +889,18 @@ class TwoVhost80Test(util.ApacheTest):

        self.assertEqual(len(rw_engine), 1)
        # three args to rw_rule + 1 arg for the pre existing rewrite
-        self.assertEqual(len(rw_rule), 4)
+        self.assertEqual(len(rw_rule), 5)

        self.assertTrue(rw_engine[0].startswith(self.vh_truth[3].path))
        self.assertTrue(rw_rule[0].startswith(self.vh_truth[3].path))

        self.assertTrue("rewrite_module" in self.config.parser.modules)

-
    def test_redirect_with_conflict(self):
        self.config.parser.modules.add("rewrite_module")
        ssl_vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr(("*", "443")), obj.Addr(("zombo.com",))]),
+            "fp", "ap", set([obj.Addr(("*", "443")),
+                             obj.Addr(("zombo.com",))]),
            True, False)
        # No names ^ this guy should conflict.

@@ -908,7 +925,8 @@ class TwoVhost80Test(util.ApacheTest):
        self.vh_truth[1].name = "default.com"
        self.vh_truth[1].aliases = set(["yes.default.com"])

-        self.config._enable_redirect(self.vh_truth[1], "")  # pylint: disable=protected-access
+        # pylint: disable=protected-access
+        self.config._enable_redirect(self.vh_truth[1], "")
        self.assertEqual(len(self.config.vhosts), 7)

    def test_create_own_redirect_for_old_apache_version(self):
@@ -918,9 +936,49 @@ class TwoVhost80Test(util.ApacheTest):
        self.vh_truth[1].name = "default.com"
        self.vh_truth[1].aliases = set(["yes.default.com"])

-        self.config._enable_redirect(self.vh_truth[1], "")  # pylint: disable=protected-access
+        # pylint: disable=protected-access
+        self.config._enable_redirect(self.vh_truth[1], "")
        self.assertEqual(len(self.config.vhosts), 7)

+    def test_sift_line(self):
+        # pylint: disable=protected-access
+        small_quoted_target = "RewriteRule ^ \"http://\""
+        self.assertFalse(self.config._sift_line(small_quoted_target))
+
+        https_target = "RewriteRule ^ https://satoshi"
+        self.assertTrue(self.config._sift_line(https_target))
+
+        normal_target = "RewriteRule ^/(.*) http://www.a.com:1234/$1 [L,R]"
+        self.assertFalse(self.config._sift_line(normal_target))
+
+    @mock.patch("letsencrypt_apache.configurator.zope.component.getUtility")
+    def test_make_vhost_ssl_with_existing_rewrite_rule(self, mock_get_utility):
+        self.config.parser.modules.add("rewrite_module")
+
+        http_vhost = self.vh_truth[0]
+
+        self.config.parser.add_dir(
+            http_vhost.path, "RewriteEngine", "on")
+
+        self.config.parser.add_dir(
+            http_vhost.path, "RewriteRule",
+            ["^",
+             "https://%{SERVER_NAME}%{REQUEST_URI}",
+             "[L,QSA,R=permanent]"])
+        self.config.save()
+
+        ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[0])
+
+        self.assertTrue(self.config.parser.find_dir(
+            "RewriteEngine", "on", ssl_vhost.path, False))
+
+        conf_text = open(ssl_vhost.filep).read()
+        commented_rewrite_rule = ("# RewriteRule ^ "
+                                  "https://%{SERVER_NAME}%{REQUEST_URI} "
+                                  "[L,QSA,R=permanent]")
+        self.assertTrue(commented_rewrite_rule in conf_text)
+        mock_get_utility().add_message.assert_called_once_with(mock.ANY,
+                                                               mock.ANY)

    def get_achalls(self):
        """Return testing achallenges."""
@@ -949,6 +1007,15 @@ class TwoVhost80Test(util.ApacheTest):
        self.assertTrue(self.config.parser.find_dir(
            "NameVirtualHost", "*:443", exclude=False))

+    def test_aug_version(self):
+        mock_match = mock.Mock(return_value=["something"])
+        self.config.aug.match = mock_match
+        # pylint: disable=protected-access
+        self.assertEquals(self.config._check_aug_version(),
+                          ["something"])
+        self.config.aug.match.side_effect = RuntimeError
+        self.assertFalse(self.config._check_aug_version())
+

 if __name__ == "__main__":
    unittest.main()  # pragma: no cover
--- a/letsencrypt-apache/letsencrypt_apache/tests/obj_test.py
+++ b/letsencrypt-apache/letsencrypt_apache/tests/obj_test.py
@@ -47,7 +47,8 @@ class VirtualHostTest(unittest.TestCase):
        self.assertTrue(self.vhost1.conflicts([self.addr2]))
        self.assertFalse(self.vhost1.conflicts([self.addr_default]))

-        self.assertFalse(self.vhost2.conflicts([self.addr1, self.addr_default]))
+        self.assertFalse(self.vhost2.conflicts([self.addr1,
+                                                self.addr_default]))

    def test_same_server(self):
        from letsencrypt_apache.obj import VirtualHost
--- a/letsencrypt-apache/letsencrypt_apache/tests/parser_test.py
+++ b/letsencrypt-apache/letsencrypt_apache/tests/parser_test.py
@@ -36,7 +36,7 @@ class BasicParserTest(util.ParserTest):

        """
        file_path = os.path.join(
-            self.config_path, "sites-available", "letsencrypt.conf")
+            self.config_path, "not-parsed-by-default", "letsencrypt.conf")

        self.parser._parse_file(file_path)  # pylint: disable=protected-access

@@ -118,7 +118,8 @@ class BasicParserTest(util.ParserTest):
        # pylint: disable=protected-access
        path = os.path.join(self.parser.root, "httpd.conf")
        open(path, 'w').close()
-        self.parser.add_dir(self.parser.loc["default"], "Include", "httpd.conf")
+        self.parser.add_dir(self.parser.loc["default"], "Include",
+                            "httpd.conf")

        self.assertEqual(
            path, self.parser._set_user_config_file())
--- a/letsencrypt-apache/letsencrypt_apache/tests/tls_sni_01_test.py
+++ b/letsencrypt-apache/letsencrypt_apache/tests/tls_sni_01_test.py
@@ -9,6 +9,8 @@ from letsencrypt.plugins import common_test
 from letsencrypt_apache import obj
 from letsencrypt_apache.tests import util

+from six.moves import xrange  # pylint: disable=redefined-builtin, import-error
+

 class TlsSniPerformTest(util.ApacheTest):
    """Test the ApacheTlsSni01 challenge."""
@@ -58,7 +60,7 @@ class TlsSniPerformTest(util.ApacheTest):

        mock_setup_cert.assert_called_once_with(achall)

-        # Check to make sure challenge config path is included in apache config.
+        # Check to make sure challenge config path is included in apache config
        self.assertEqual(
            len(self.sni.configurator.parser.find_dir(
                "Include", self.sni.challenge_conf)), 1)
@@ -78,8 +80,7 @@ class TlsSniPerformTest(util.ApacheTest):
        # pylint: disable=protected-access
        self.sni._setup_challenge_cert = mock_setup_cert

-        with mock.patch(
-             "letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
+        with mock.patch("letsencrypt_apache.configurator.ApacheConfigurator.enable_mod"):
            sni_responses = self.sni.perform()

        self.assertEqual(mock_setup_cert.call_count, 2)
@@ -126,13 +127,15 @@ class TlsSniPerformTest(util.ApacheTest):
    def test_get_addrs_default(self):
        self.sni.configurator.choose_vhost = mock.Mock(
            return_value=obj.VirtualHost(
-                "path", "aug_path", set([obj.Addr.fromstring("_default_:443")]),
+                "path", "aug_path",
+                set([obj.Addr.fromstring("_default_:443")]),
                False, False)
        )

+        # pylint: disable=protected-access
        self.assertEqual(
            set([obj.Addr.fromstring("*:443")]),
-            self.sni._get_addrs(self.achalls[0]))  # pylint: disable=protected-access
+            self.sni._get_addrs(self.achalls[0]))


 if __name__ == "__main__":
--- a/letsencrypt-apache/letsencrypt_apache/tests/util.py
+++ b/letsencrypt-apache/letsencrypt_apache/tests/util.py
@@ -42,6 +42,20 @@ class ApacheTest(unittest.TestCase):  # pylint: disable=too-few-public-methods
        self.rsa512jwk = jose.JWKRSA.load(test_util.load_vector(
            "rsa512_key.pem"))

+        # Make sure all vhosts in sites-enabled are symlinks (Python packaging
+        # does not preserve symlinks)
+        sites_enabled = os.path.join(self.config_path, "sites-enabled")
+        if not os.path.exists(sites_enabled):
+            return
+
+        for vhost_basename in os.listdir(sites_enabled):
+            vhost = os.path.join(sites_enabled, vhost_basename)
+            if not os.path.islink(vhost):  # pragma: no cover
+                os.remove(vhost)
+                target = os.path.join(
+                    os.path.pardir, "sites-available", vhost_basename)
+                os.symlink(target, vhost)
+

 class ParserTest(ApacheTest):  # pytlint: disable=too-few-public-methods

@@ -62,7 +76,8 @@ class ParserTest(ApacheTest):  # pytlint: disable=too-few-public-methods


 def get_apache_configurator(
-        config_path, vhost_path, config_dir, work_dir, version=(2, 4, 7), conf=None):
+        config_path, vhost_path,
+        config_dir, work_dir, version=(2, 4, 7), conf=None):
    """Create an Apache Configurator with the specified options.

    :param conf: Function that returns binary paths. self.conf in Configurator
@@ -129,10 +144,12 @@ def get_vh_truth(temp_dir, config_name):
                os.path.join(prefix, "mod_macro-example.conf"),
                os.path.join(aug_pre,
                             "mod_macro-example.conf/Macro/VirtualHost"),
-                set([obj.Addr.fromstring("*:80")]), False, True, modmacro=True),
+                set([obj.Addr.fromstring("*:80")]), False, True,
+                modmacro=True),
            obj.VirtualHost(
                os.path.join(prefix, "default-ssl-port-only.conf"),
-                os.path.join(aug_pre, "default-ssl-port-only.conf/IfModule/VirtualHost"),
+                os.path.join(aug_pre, ("default-ssl-port-only.conf/"
+                                       "IfModule/VirtualHost")),
                set([obj.Addr.fromstring("_default_:443")]), True, False),
        ]
        return vh_truth
--- a/letsencrypt-apache/letsencrypt_apache/tls_sni_01.py
+++ b/letsencrypt-apache/letsencrypt_apache/tls_sni_01.py
@@ -10,6 +10,7 @@ from letsencrypt_apache import parser

 logger = logging.getLogger(__name__)

+
 class ApacheTlsSni01(common.TLSSNI01):
    """Class that performs TLS-SNI-01 challenges within the Apache configurator

@@ -125,7 +126,8 @@ class ApacheTlsSni01(common.TLSSNI01):
                addrs.add(default_addr)
            else:
                addrs.add(
-                    addr.get_sni_addr(self.configurator.config.tls_sni_01_port))
+                    addr.get_sni_addr(
+                        self.configurator.config.tls_sni_01_port))

        return addrs

--- a/letsencrypt-apache/setup.py
+++ b/letsencrypt-apache/setup.py
@@ -6,6 +6,7 @@ from setuptools import find_packages

 version = '0.2.0.dev0'

+# Please update tox.ini when modifying dependency version requirements
 install_requires = [
    'acme=={0}'.format(version),
    'letsencrypt=={0}'.format(version),
--- a/letsencrypt-nginx/letsencrypt_nginx/configurator.py
+++ b/letsencrypt-nginx/letsencrypt_nginx/configurator.py
@@ -122,7 +122,7 @@ class NginxConfigurator(common.Plugin):

    # Entry point in main.py for installing cert
    def deploy_cert(self, domain, cert_path, key_path,
-                    chain_path, fullchain_path):
+                    chain_path=None, fullchain_path=None):
        # pylint: disable=unused-argument
        """Deploys certificate to specified virtual host.

@@ -136,7 +136,15 @@ class NginxConfigurator(common.Plugin):

        .. note:: This doesn't save the config files!

+        :raises errors.PluginError: When unable to deploy certificate due to
+            a lack of directives or configuration
+
        """
+        if not fullchain_path:
+            raise errors.PluginError(
+                "The nginx plugin currently requires --fullchain-path to "
+                "install a cert.")
+
        vhost = self.choose_vhost(domain)
        cert_directives = [['ssl_certificate', fullchain_path],
                           ['ssl_certificate_key', key_path]]
@@ -150,6 +158,12 @@ class NginxConfigurator(common.Plugin):
                ['ssl_stapling', 'on'],
                ['ssl_stapling_verify', 'on']]

+        if len(stapling_directives) != 0 and not chain_path:
+            raise errors.PluginError(
+                "--chain-path is required to enable "
+                "Online Certificate Status Protocol (OCSP) stapling "
+                "on nginx >= 1.3.7.")
+
        try:
            self.parser.add_server_directives(vhost.filep, vhost.names,
                                              cert_directives, replace=True)
@@ -168,7 +182,7 @@ class NginxConfigurator(common.Plugin):
        self.save_notes += ("Changed vhost at %s with addresses of %s\n" %
                            (vhost.filep,
                             ", ".join(str(addr) for addr in vhost.addrs)))
-        self.save_notes += "\tssl_certificate %s\n" % cert_path
+        self.save_notes += "\tssl_certificate %s\n" % fullchain_path
        self.save_notes += "\tssl_certificate_key %s\n" % key_path

    #######################
--- a/letsencrypt-nginx/letsencrypt_nginx/parser.py
+++ b/letsencrypt-nginx/letsencrypt_nginx/parser.py
@@ -113,7 +113,7 @@ class NginxParser(object):
        for filename in servers:
            for server in servers[filename]:
                # Parse the server block into a VirtualHost object
-                parsed_server = _parse_server(server)
+                parsed_server = parse_server(server)
                vhost = obj.VirtualHost(filename,
                                        parsed_server['addrs'],
                                        parsed_server['ssl'],
@@ -451,7 +451,7 @@ def _get_servernames(names):
    return names.split(' ')


-def _parse_server(server):
+def parse_server(server):
    """Parses a list of server directives.

    :param list server: list of directives in a server block
@@ -471,6 +471,8 @@ def _parse_server(server):
        elif directive[0] == 'server_name':
            parsed_server['names'].update(
                _get_servernames(directive[1]))
+        elif directive[0] == 'ssl' and directive[1] == 'on':
+            parsed_server['ssl'] = True

    return parsed_server

--- a/letsencrypt-nginx/letsencrypt_nginx/tests/configurator_test.py
+++ b/letsencrypt-nginx/letsencrypt_nginx/tests/configurator_test.py
@@ -159,6 +159,24 @@ class NginxConfiguratorTest(util.NginxTest):
        self.assertTrue(util.contains_at_depth(generated_conf,
                                               ['ssl_trusted_certificate', 'example/chain.pem'], 2))

+    def test_deploy_cert_stapling_requires_chain_path(self):
+        self.config.version = (1, 3, 7)
+        self.assertRaises(errors.PluginError, self.config.deploy_cert,
+            "www.example.com",
+            "example/cert.pem",
+            "example/key.pem",
+            None,
+            "example/fullchain.pem")
+
+    def test_deploy_cert_requires_fullchain_path(self):
+        self.config.version = (1, 3, 1)
+        self.assertRaises(errors.PluginError, self.config.deploy_cert,
+            "www.example.com",
+            "example/cert.pem",
+            "example/key.pem",
+            "example/chain.pem",
+            None)
+
    def test_deploy_cert(self):
        server_conf = self.config.parser.abs_path('server.conf')
        nginx_conf = self.config.parser.abs_path('nginx.conf')
--- a/letsencrypt-nginx/letsencrypt_nginx/tests/parser_test.py
+++ b/letsencrypt-nginx/letsencrypt_nginx/tests/parser_test.py
@@ -228,6 +228,26 @@ class NginxParserTest(util.NginxTest):
        c_k = nparser.get_all_certs_keys()
        self.assertEqual(set([('foo.pem', 'bar.key', filep)]), c_k)

+    def test_parse_server_ssl(self):
+        server = parser.parse_server([
+	    ['listen', '443']
+	])
+        self.assertFalse(server['ssl'])
+
+        server = parser.parse_server([
+	    ['listen', '443 ssl']
+	])
+        self.assertTrue(server['ssl'])
+
+        server = parser.parse_server([
+	    ['listen', '443'], ['ssl', 'off']
+	])
+        self.assertFalse(server['ssl'])
+
+        server = parser.parse_server([
+	    ['listen', '443'], ['ssl', 'on']
+	])
+        self.assertTrue(server['ssl'])

 if __name__ == "__main__":
    unittest.main()  # pragma: no cover
--- a/letsencrypt-nginx/setup.py
+++ b/letsencrypt-nginx/setup.py
@@ -6,6 +6,7 @@ from setuptools import find_packages

 version = '0.2.0.dev0'

+# Please update tox.ini when modifying dependency version requirements
 install_requires = [
    'acme=={0}'.format(version),
    'letsencrypt=={0}'.format(version),
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -400,7 +400,7 @@ def _auth_from_domains(le_client, config, domains):
        # TODO: Check whether it worked! <- or make sure errors are thrown (jdk)
        lineage.save_successor(
            lineage.latest_common_version(), OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_PEM, new_certr.body),
+                OpenSSL.crypto.FILETYPE_PEM, new_certr.body.wrapped),
            new_key.pem, crypto_util.dump_pyopenssl_chain(new_chain))

        lineage.update_all_links_to(lineage.latest_common_version())
--- a/letsencrypt/client.py
+++ b/letsencrypt/client.py
@@ -300,7 +300,7 @@ class Client(object):

        lineage = storage.RenewableCert.new_lineage(
            domains[0], OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_PEM, certr.body),
+                OpenSSL.crypto.FILETYPE_PEM, certr.body.wrapped),
            key.pem, crypto_util.dump_pyopenssl_chain(chain),
            params, config, cli_config)
        return lineage
@@ -330,7 +330,7 @@ class Client(object):
                self.config.strict_permissions)

        cert_pem = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, certr.body)
+            OpenSSL.crypto.FILETYPE_PEM, certr.body.wrapped)
        cert_file, act_cert_path = le_util.unique_file(cert_path, 0o644)
        try:
            cert_file.write(cert_pem)
--- a/letsencrypt/crypto_util.py
+++ b/letsencrypt/crypto_util.py
@@ -271,7 +271,7 @@ def dump_pyopenssl_chain(chain, filetype=OpenSSL.crypto.FILETYPE_PEM):
    def _dump_cert(cert):
        if isinstance(cert, jose.ComparableX509):
            # pylint: disable=protected-access
-            cert = cert._wrapped
+            cert = cert.wrapped
        return OpenSSL.crypto.dump_certificate(filetype, cert)

    # assumes that OpenSSL.crypto.dump_certificate includes ending
--- a/letsencrypt/plugins/standalone.py
+++ b/letsencrypt/plugins/standalone.py
@@ -150,7 +150,7 @@ class Authenticator(common.Plugin):

        # one self-signed key for all tls-sni-01 certificates
        self.key = OpenSSL.crypto.PKey()
-        self.key.generate_key(OpenSSL.crypto.TYPE_RSA, bits=2048)
+        self.key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)

        self.served = collections.defaultdict(set)

--- a/letsencrypt/plugins/webroot.py
+++ b/letsencrypt/plugins/webroot.py
@@ -98,8 +98,8 @@ to serve all files under specified web root ({0})."""
    def _path_for_achall(self, achall):
        try:
            path = self.full_roots[achall.domain]
-        except IndexError:
-            raise errors.PluginError("Missing --webroot-path for domain: {1}"
+        except KeyError:
+            raise errors.PluginError("Missing --webroot-path for domain: {0}"
                                     .format(achall.domain))
        if not os.path.exists(path):
            raise errors.PluginError("Mysteriously missing path {0} for domain: {1}"
--- a/letsencrypt/plugins/webroot_test.py
+++ b/letsencrypt/plugins/webroot_test.py
@@ -111,6 +111,18 @@ class AuthenticatorTest(unittest.TestCase):
        self.assertEqual(os.stat(self.validation_path).st_gid, parent_gid)
        self.assertEqual(os.stat(self.validation_path).st_uid, parent_uid)

+    def test_perform_missing_path(self):
+        self.auth.prepare()
+
+        missing_achall = achallenges.KeyAuthorizationAnnotatedChallenge(
+            challb=acme_util.HTTP01_P, domain="thing2.com", account_key=KEY)
+        self.assertRaises(
+            errors.PluginError, self.auth.perform, [missing_achall])
+
+        self.auth.full_roots[self.achall.domain] = 'null'
+        self.assertRaises(
+            errors.PluginError, self.auth.perform, [self.achall])
+
    def test_perform_cleanup(self):
        self.auth.prepare()
        responses = self.auth.perform([self.achall])
--- a/letsencrypt/renewer.py
+++ b/letsencrypt/renewer.py
@@ -103,7 +103,7 @@ def renew(cert, old_version):
        #      already understands this distinction!)
        return cert.save_successor(
            old_version, OpenSSL.crypto.dump_certificate(
-                OpenSSL.crypto.FILETYPE_PEM, new_certr.body),
+                OpenSSL.crypto.FILETYPE_PEM, new_certr.body.wrapped),
            new_key.pem, crypto_util.dump_pyopenssl_chain(new_chain))
        # TODO: Notify results
    else:
--- a/letsencrypt/storage.py
+++ b/letsencrypt/storage.py
@@ -564,8 +564,9 @@ class RenewableCert(object):  # pylint: disable=too-many-instance-attributes
                logger.debug("Should renew, certificate is revoked.")
                return True

-            # Renewals on the basis of expiry time
-            interval = self.configuration.get("renew_before_expiry", "10 days")
+            # Renews some period before expiry time
+            default_interval = constants.RENEWER_DEFAULTS["renew_before_expiry"]
+            interval = self.configuration.get("renew_before_expiry", default_interval)
            expiry = crypto_util.notAfter(self.version(
                "cert", self.latest_common_version()))
            now = pytz.UTC.fromutc(datetime.datetime.utcnow())
--- a/letsencrypt/tests/cli_test.py
+++ b/letsencrypt/tests/cli_test.py
@@ -442,11 +442,11 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
        chain_path = '/etc/letsencrypt/live/foo.bar/fullchain.pem'

        mock_lineage = mock.MagicMock(cert=cert_path, fullchain=chain_path)
-        mock_cert = mock.MagicMock(body='body')
+        mock_certr = mock.MagicMock()
        mock_key = mock.MagicMock(pem='pem_key')
        mock_renewal.return_value = ("renew", mock_lineage)
        mock_client = mock.MagicMock()
-        mock_client.obtain_certificate.return_value = (mock_cert, 'chain',
+        mock_client.obtain_certificate.return_value = (mock_certr, 'chain',
                                                       mock_key, 'csr')
        mock_init.return_value = mock_client
        with mock.patch('letsencrypt.cli.OpenSSL'):
--- a/letsencrypt/tests/client_test.py
+++ b/letsencrypt/tests/client_test.py
@@ -141,9 +141,9 @@ class ClientTest(unittest.TestCase):
        tmp_path = tempfile.mkdtemp()
        os.chmod(tmp_path, 0o755)  # TODO: really??

-        certr = mock.MagicMock(body=test_util.load_cert(certs[0]))
-        chain_cert = [test_util.load_cert(certs[1]),
-                      test_util.load_cert(certs[2])]
+        certr = mock.MagicMock(body=test_util.load_comparable_cert(certs[0]))
+        chain_cert = [test_util.load_comparable_cert(certs[1]),
+                      test_util.load_comparable_cert(certs[2])]
        candidate_cert_path = os.path.join(tmp_path, "certs", "cert.pem")
        candidate_chain_path = os.path.join(tmp_path, "chains", "chain.pem")
        candidate_fullchain_path = os.path.join(tmp_path, "chains", "fullchain.pem")
--- a/letsencrypt/tests/display/ops_test.py
+++ b/letsencrypt/tests/display/ops_test.py
@@ -407,10 +407,11 @@ class ChooseNamesTest(unittest.TestCase):
                                          "uniçodé.com")
        self.assertEqual(_choose_names_manually(), [])
        # IDN exception with previous mocks
-        with mock.patch("letsencrypt.display.util") as mock_sl:
-            uerror = UnicodeEncodeError('mock', u'',
-                                        0, 1, 'mock')
-            mock_sl.separate_list_input.side_effect = uerror
+        with mock.patch(
+                "letsencrypt.display.ops.display_util.separate_list_input"
+        ) as mock_sli:
+            unicode_error = UnicodeEncodeError('mock', u'', 0, 1, 'mock')
+            mock_sli.side_effect = unicode_error
            self.assertEqual(_choose_names_manually(), [])
        # Punycode and no retry
        mock_util().input.return_value = (display_util.OK,
--- a/letsencrypt/tests/renewer_test.py
+++ b/letsencrypt/tests/renewer_test.py
@@ -9,6 +9,8 @@ import unittest
 import configobj
 import mock

+from acme import jose
+
 from letsencrypt import configuration
 from letsencrypt import errors
 from letsencrypt.storage import ALL_FOUR
@@ -379,6 +381,10 @@ class RenewableCertTests(BaseRenewableCertTest):
        self.assertEqual(self.test_rc.names(12),
                         ["example.com", "www.example.com"])

+        # Trying missing cert
+        os.unlink(self.test_rc.cert)
+        self.assertRaises(errors.CertStorageError, self.test_rc.names)
+
    @mock.patch("letsencrypt.storage.datetime")
    def test_time_interval_judgments(self, mock_datetime):
        """Test should_autodeploy() and should_autorenew() on the basis
@@ -702,9 +708,10 @@ class RenewableCertTests(BaseRenewableCertTest):
        self.test_rc.configfile["renewalparams"]["authenticator"] = "apache"
        mock_client = mock.MagicMock()
        # pylint: disable=star-args
+        comparable_cert = jose.ComparableX509(CERT)
        mock_client.obtain_certificate.return_value = (
-            mock.MagicMock(body=CERT), [CERT], mock.Mock(pem="key"),
-            mock.sentinel.csr)
+            mock.MagicMock(body=comparable_cert), [comparable_cert],
+            mock.Mock(pem="key"), mock.sentinel.csr)
        mock_c.return_value = mock_client
        self.assertEqual(2, renewer.renew(self.test_rc, 1))
        # TODO: We could also make several assertions about calls that should
--- a/letsencrypt/tests/reverter_test.py
+++ b/letsencrypt/tests/reverter_test.py
@@ -385,6 +385,15 @@ class TestFullCheckpointsReverter(unittest.TestCase):
        self.assertRaises(
            errors.ReverterError, self.reverter.view_config_changes)

+    def test_view_config_changes_for_logging(self):
+        self._setup_three_checkpoints()
+
+        config_changes = self.reverter.view_config_changes(for_logging=True)
+
+        self.assertTrue("First Checkpoint" in config_changes)
+        self.assertTrue("Second Checkpoint" in config_changes)
+        self.assertTrue("Third Checkpoint" in config_changes)
+
    def _setup_three_checkpoints(self):
        """Generate some finalized checkpoints."""
        # Checkpoint1 - config1
--- a/letsencrypt/tests/test_util.py
+++ b/letsencrypt/tests/test_util.py
@@ -40,16 +40,24 @@ def load_cert(*names):
    """Load certificate."""
    loader = _guess_loader(
        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
-    return jose.ComparableX509(OpenSSL.crypto.load_certificate(
-        loader, load_vector(*names)))
+    return OpenSSL.crypto.load_certificate(loader, load_vector(*names))
+
+
+def load_comparable_cert(*names):
+    """Load ComparableX509 cert."""
+    return jose.ComparableX509(load_cert(*names))


 def load_csr(*names):
    """Load certificate request."""
    loader = _guess_loader(
        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
-    return jose.ComparableX509(OpenSSL.crypto.load_certificate_request(
-        loader, load_vector(*names)))
+    return OpenSSL.crypto.load_certificate_request(loader, load_vector(*names))
+
+
+def load_comparable_csr(*names):
+    """Load ComparableX509 certificate request."""
+    return jose.ComparableX509(load_csr(*names))


 def load_rsa_private_key(*names):
--- a/setup.py
+++ b/setup.py
@@ -30,10 +30,12 @@ readme = read_file(os.path.join(here, 'README.rst'))
 changes = read_file(os.path.join(here, 'CHANGES.rst'))
 version = meta['version']

+# Please update tox.ini when modifying dependency version requirements
 install_requires = [
    'acme=={0}'.format(version),
+    'ConfigArgParse>=0.10.0',  # python2.6 support, upstream #17
    'configobj',
-    'cryptography>=0.7,<1.2',  # load_pem_x509_certificate
+    'cryptography>=0.7',  # load_pem_x509_certificate
    'parsedatetime',
    'psutil>=2.1.0',  # net_connections introduced in 2.1.0
    'PyOpenSSL',
@@ -51,12 +53,10 @@ if sys.version_info < (2, 7):
    install_requires.extend([
        # only some distros recognize stdlib argparse as already satisfying
        'argparse',
-        'ConfigArgParse>=0.10.0',  # python2.6 support, upstream #17
        'mock<1.1.0',
    ])
 else:
    install_requires.extend([
-        'ConfigArgParse',
        'mock',
    ])

--- a/tools/release.sh
+++ b/tools/release.sh
@@ -80,14 +80,17 @@ git checkout "$RELEASE_BRANCH"

 SetVersion() {
    ver="$1"
-    for pkg_dir in $SUBPKGS
+    for pkg_dir in $SUBPKGS letsencrypt-compatibility-test
    do
      sed -i "s/^version.*/version = '$ver'/" $pkg_dir/setup.py
    done
    sed -i "s/^__version.*/__version__ = '$ver'/" letsencrypt/__init__.py
+    
+    # interactive user input
+    git add -p letsencrypt $SUBPKGS letsencrypt-compatibility-test 

-    git add -p letsencrypt $SUBPKGS # interactive user input
 }
+
 SetVersion "$version"
 git commit --gpg-sign="$RELEASE_GPG_KEY" -m "Release $version"
 git tag --local-user "$RELEASE_GPG_KEY" \
--- a/tox.ini
+++ b/tox.ini
@@ -6,7 +6,7 @@
 # acme and letsencrypt are not yet on pypi, so when Tox invokes
 # "install *.zip", it will not find deps
 skipsdist = true
-envlist = py26,py27,py33,py34,py35,cover,lint
+envlist = py{26,27,33,34,35},py{26,27}-oldest,cover,lint

 # nosetest -v => more verbose output, allows to detect busy waiting
 # loops, especially on Travis
@@ -31,6 +31,13 @@ setenv =
    PYTHONHASHSEED = 0
 # https://testrun.org/tox/latest/example/basic.html#special-handling-of-pythonhas

+deps =
+    py{26,27}-oldest: cryptography==0.8
+    py{26,27}-oldest: configargparse==0.10.0
+    py{26,27}-oldest: psutil==2.1.0
+    py{26,27}-oldest: PyOpenSSL==0.13
+    py{26,27}-oldest: python2-pythondialog==3.2.2rc1
+
 [testenv:py33]
 commands =
    pip install -e acme[testing]
@@ -62,7 +69,7 @@ commands =
    pip install -e acme -e .[dev] -e letsencrypt-apache -e letsencrypt-nginx -e letsencrypt-compatibility-test -e letshelp-letsencrypt
    ./pep8.travis.sh
    pylint --rcfile=.pylintrc letsencrypt
-    pylint --rcfile=.pylintrc acme/acme
+    pylint --rcfile=acme/.pylintrc acme/acme
    pylint --rcfile=.pylintrc letsencrypt-apache/letsencrypt_apache
    pylint --rcfile=.pylintrc letsencrypt-nginx/letsencrypt_nginx
    pylint --rcfile=.pylintrc letsencrypt-compatibility-test/letsencrypt_compatibility_test