Certbot syntax error with "report-to" and "NEL" header in apache config

Hi,

i have a problem with cerbot does not work with the following two Apache2 headers set in apache2.conf or any other file which apache loads:
Header set Report-To: {“group”:“default”,“max_age”:10886400,“endpoints”:[{“url”:“https://name.uriports.com/reports"}],"include_subdomains”:true}
Header set NEL: {“report_to”:“default”,“max_age”:2592000,“include_subdomains”:true,“failure_fraction”:1.0}

Both lines trigger the syntax error from certbot while parsing the apache config. apachectl configtest does not list this error and also apache ist working and restarting/reloading very well with this config. Also both headers are working as expected for multiple browsers and versions.

Could you help how certbot does work with these headers as I want to continue to use them in my setup? Is there any way certbot accept them or how can I change the syntax so certbot is accepting it but also apache does use these headers?

Thank you and best regards
Matthias

My domain is:
domain.tld --> replaced as this is a general syntax error which occurs on multiple hosts and is not related to the domain

I ran this command:
certbot renew --dry-run

It produced this output:
root@host:/home/host/# certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/domain.tld.conf

Cert is due for renewal, auto-renewing…
Could not choose appropriate plugin: The apache plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘There has been an error in parsing the file /etc/letsencrypt/options-ssl-apache.conf on line 48: Syntax error’,)
Attempting to renew cert (domain.tld) from /etc/letsencrypt/renewal/domain.tld.conf produced an unexpected error: The apache plugin is not working; there may be problems with your existing configuration.
The error was: PluginError(‘There has been an error in parsing the file /etc/letsencrypt/options-ssl-apache.conf on line 48: Syntax error’,). Skipping.

My web server is (include version): Apache 2.4.16

The operating system my web server runs on is (include version): Ubuntu 16.04

My hosting provider, if applicable, is: own vServer

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

Ugh sorry dude, I accidentally edited your post instead of responding.

I was able to fix your issue by wrapping your header values in single quotes:

Header set Report-To: '{"group":"default","max_age":10886400,"endpoints":[{"url":"https://name.uriports.com/reports"}],"include_subdomains":true}'
Header set NEL: '{"report_to":"default","max_age":2592000,"include_subdomains":true,"failure_fraction":1.0}'

This is probably a valid Certbot bug, but you can work around it with the above.

2 Likes

Thank you very much for the fast reply! This seems to work. :slight_smile:

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.