{"action":"created","issue":{"url":"https://api.github.com/repos/certbot/certbot/issues/6376","repository_url":"https://api.github.com/repos/certbot/certbot","labels_url":"https://api.github.com/repos/certbot/certbot/issues/6376/labels{/name}","comments_url":"https://api.github.com/repos/certbot/certbot/issues/6376/comments","events_url":"https://api.github.com/repos/certbot/certbot/issues/6376/events","html_url":"https://github.com/certbot/certbot/issues/6376","id":360466019,"node_id":"MDU6SXNzdWUzNjA0NjYwMTk=","number":6376,"title":"nginx parser confused by some unquoted substitutions in proxy_set_header directives","user":{"login":"duglin","id":1944671,"node_id":"MDQ6VXNlcjE5NDQ2NzE=","avatar_url":"https://avatars1.githubusercontent.com/u/1944671?v=4","gravatar_id":"","url":"https://api.github.com/users/duglin","html_url":"https://github.com/duglin","followers_url":"https://api.github.com/users/duglin/followers","following_url":"https://api.github.com/users/duglin/following{/other_user}","gists_url":"https://api.github.com/users/duglin/gists{/gist_id}","starred_url":"https://api.github.com/users/duglin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/duglin/subscriptions","organizations_url":"https://api.github.com/users/duglin/orgs","repos_url":"https://api.github.com/users/duglin/repos","events_url":"https://api.github.com/users/duglin/events{/privacy}","received_events_url":"https://api.github.com/users/duglin/received_events","type":"User","site_admin":false},"labels":[{"id":258836706,"node_id":"MDU6TGFiZWwyNTg4MzY3MDY=","url":"https://api.github.com/repos/certbot/certbot/labels/area:%20nginx","name":"area: nginx","color":"c5def5","default":false},{"id":146954787,"node_id":"MDU6TGFiZWwxNDY5NTQ3ODc=","url":"https://api.github.com/repos/certbot/certbot/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-09-14T21:52:16Z","updated_at":"2018-09-18T00:52:24Z","closed_at":null,"author_association":"NONE","body":"## My operating system is (include version):\r\nDebian GNU/Linux 9 (stretch)\r\n\r\n\r\n## I installed Certbot with (certbot-auto, OS package manager, pip, etc):\r\nwget https://dl.eff.org/certbot-auto\r\n\r\n\r\n## I ran this command and it produced this output:\r\nWhile trying to run `/certbot-auto renew --post-hook \"nginx -s reload\"`\r\nI get this error:\r\n```\r\nSaving debug log to /var/log/letsencrypt/letsencrypt.log\r\n\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nProcessing /etc/letsencrypt/renewal/XXX.org.conf\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nCert is due for renewal, auto-renewing...\r\nPlugins selected: Authenticator nginx, Installer nginx\r\nRenewing an existing certificate\r\nPerforming the following challenges:\r\ntls-sni-01 challenge for XXX.org\r\ntls-sni-01 challenge for www.XXX.org\r\nCleaning up challenges\r\n2018/09/14 21:45:38 [notice] 8286#8286: signal process started\r\nAttempting to renew cert (XXX.org) from /etc/letsencrypt/renewal/XXX.org.conf produced an unexpected error: Could not automatically find a matching server block for XXX.org. Set the `server_name` directive to use the Nginx installer.. Skipping.\r\nAll renewal attempts failed. The following certs could not be renewed:\r\n  /etc/letsencrypt/live/XXX/fullchain.pem (failure)\r\n\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\nAll renewal attempts failed. The following certs could not be renewed:\r\n  /etc/letsencrypt/live/XXX/fullchain.pem (failure)\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nRunning post-hook command: nginx -s reload\r\nError output from nginx:\r\n2018/09/14 21:45:39 [notice] 8289#8289: signal process started\r\n\r\n1 renew failure(s), 0 parse failure(s)\r\n```\r\nI think the real error is shown in the debug log:\r\n```\r\n2018-09-14 21:45:37,250:DEBUG:certbot_nginx.parser:Could not parse file: /etc/ng\r\ninx/conf.d/default.conf due to Expected {Group:({[<SPC><TAB><CR><LF>] \"#\" rest o\r\nf line}) | Group:(Forward: ...) | Group:({[<SPC><TAB><CR><LF>] {Combine:({{quote\r\nd string, starting with \" ending with \" | quoted string, starting with ' ending \r\nwith '} \")\" [Re:('(\\\\$\\\\{)|[^{;\\\\s]')]...}) | Combine:({Re:('[^{};\\\\s\\'\\\\\"]') [R\r\ne:('(\\\\$\\\\{)|[^{;\\\\s]')]...}) | quoted string, starting with \" ending with \" | q\r\nuoted string, starting with ' ending with '} [{<SPC><TAB><CR><LF> {Combine:({{qu\r\noted string, starting with \" ending with \" | quoted string, starting with ' endi\r\nng with '} \")\" [Re:('(\\\\$\\\\{)|[^{;\\\\s]')]...}) | Combine:({Re:('[^{};\\\\s\\'\\\\\"]')\r\n [Re:('(\\\\$\\\\{)|[^{;\\\\s]')]...}) | quoted string, starting with \" ending with \" \r\n| quoted string, starting with ' ending with '}}]... [<SPC><TAB><CR><LF>] Suppre\r\nss:(\";\")})} (at char 2372), (line:77, col:1)\r\n```\r\n\r\nThe nginx config file is (masked):\r\n```\r\nserver {\r\n    listen       80 default_server;\r\n    listen  [::]:80 default_server;\r\n\r\n    server_name  XXX.org www.XXX.org;\r\n\r\n    listen       443 ssl http2 default_server;\r\n    listen  [::]:443 ssl http2 default_server;\r\n\r\n\tssl_certificate /etc/letsencrypt/live/XXX.org/fullchain.pem;\r\n\tssl_certificate_key /etc/letsencrypt/live/XXX.org/privkey.pem;\r\n\r\n\r\n    # from https://cipherli.st/\r\n    # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html\r\n\r\n    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;\r\n    ssl_prefer_server_ciphers on;\r\n    ssl_ciphers \"XXX\";\r\n    ssl_ecdh_curve secp384r1;\r\n    ssl_session_cache shared:SSL:10m;\r\n    ssl_session_tickets off;\r\n    ssl_stapling on;\r\n    ssl_stapling_verify on;\r\n    resolver 8.8.8.8 8.8.4.4 valid=300s;\r\n    resolver_timeout 5s;\r\n    # Disable preloading HSTS for now.  You can use the commented out header line that includes\r\n    # the \"preload\" directive if you understand the implications.\r\n    #add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";\r\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains\";\r\n    # add_header X-Frame-Options SAMEORIGIN;\r\n    # add_header X-Content-Type-Options nosniff;\r\n\r\n    ssl_dhparam /etc/ssl/certs/dhparam.pem;\r\n\r\n    access_log  /var/log/nginx/log/host.access.log  main;\r\n\r\n    server_name_in_redirect off;\r\n\r\n    location /ddd {\r\n\t\treturn 302 $request_uri/;\r\n    }\r\n\r\n    location /ddd/ {\r\n\t\tproxy_pass       http://XXX:91/;\r\n\t\tproxy_set_header Host $http_host;\r\n\t\tproxy_set_header X-Origin-URI $uri;\r\n\t\tproxy_set_header Forwarded \"for=$remote_addr;proto=$scheme\";\r\n    }\r\n\r\n    location /ccc {\r\n\t\treturn 302 $request_uri/;\r\n    }\r\n\r\n    location /bbb/ {\r\n\t\tproxy_pass       http://XXX:90/;\r\n\t\tproxy_set_header Host $http_host;\r\n\t\tproxy_set_header X-Origin-URI $uri;\r\n\t\tproxy_set_header Forwarded \"for=$remote_addr;proto=$scheme\";\r\n    }\r\n\r\n    location /aaa/ {\r\n    \tproxy_pass       http://XXX:89/;\r\n\t\tproxy_set_header Host $http_host;\r\n\t\tproxy_set_header X-Origin-URI $uri;\r\n\t\tproxy_set_header Forwarded \"for=$remote_addr;proto=$scheme\";\r\n    }\r\n\r\n    location / {\r\n    \tproxy_pass\t http://XXX:88/;\r\n\t\tproxy_set_header Host $http_host;\r\n\t\tproxy_set_header X-Origin-URI ${scheme}://${http_host}/$request_uri;\r\n\t\tproxy_set_header Forwarded \"for=$remote_addr;proto=$scheme\";\r\n    }\r\n\r\n}\r\n```\r\n\r\nAny ideas what might be going on?"},"comment":{"url":"https://api.github.com/repos/certbot/certbot/issues/comments/422217438","html_url":"https://github.com/certbot/certbot/issues/6376#issuecomment-422217438","issue_url":"https://api.github.com/repos/certbot/certbot/issues/6376","id":422217438,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMjIxNzQzOA==","user":{"login":"ohemorange","id":1227205,"node_id":"MDQ6VXNlcjEyMjcyMDU=","avatar_url":"https://avatars0.githubusercontent.com/u/1227205?v=4","gravatar_id":"","url":"https://api.github.com/users/ohemorange","html_url":"https://github.com/ohemorange","followers_url":"https://api.github.com/users/ohemorange/followers","following_url":"https://api.github.com/users/ohemorange/following{/other_user}","gists_url":"https://api.github.com/users/ohemorange/gists{/gist_id}","starred_url":"https://api.github.com/users/ohemorange/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ohemorange/subscriptions","organizations_url":"https://api.github.com/users/ohemorange/orgs","repos_url":"https://api.github.com/users/ohemorange/repos","events_url":"https://api.github.com/users/ohemorange/events{/privacy}","received_events_url":"https://api.github.com/users/ohemorange/received_events","type":"User","site_admin":false},"created_at":"2018-09-18T00:52:24Z","updated_at":"2018-09-18T00:52:24Z","author_association":"CONTRIBUTOR","body":"Ah! You're using a newer version of Nginx than I am. Your version contains this change: https://github.com/nginx/nginx/commit/0ad556fe59ad132dc4d34dea9e80f2ff2c3c1314#diff-44ce6e0a027219f5b99513de6d08642a\r\n\r\nThanks for catching this, time to update our parser."}}
{"actor":{"display_login":"ohemorange"}}