Documentation fix-ups

docs/challenges.rst

@@ -3,9 +3,9 @@ Challenges
 
 To receive a certificate from Let's Encrypt certificate authority (CA), you must pass a *challenge* to 
 prove you control each of the domain names that will be listed in the certificate. A challenge is one of 
-three tasks that only someone who controls the domain should be able to accomplish:
+a list of specified tasks that only someone who controls the domain should be able to accomplish, such as:
 
-* Posting a specified file in a specified location on a web site (the HTTP-01 challenge) 
+* Posting a specified file in a specified location on a web site (the HTTP-01 challenge)
 * Posting a specified DNS record in the domain name system (the DNS-01 challenge)
 
 It’s possible to complete each type of challenge *automatically* (Certbot directly makes the necessary 
@@ -15,15 +15,21 @@ design favors performing challenges automatically, and this is the normal case f
 
 Some plugins offer an *authenticator*, meaning that they can satisfy challenges:
 
+* Apache plugin: (HTTP-01) Tries to edit your Apache configuration files to temporarily serve files to
+  satisfy challenges from the certificate authority. Use the Apache plugin when you're running Certbot on a
+  web server with Apache listening on port 80.
+* nginx plugin: (HTTP-01) Tries to edit your nginx configuration files to temporarily serve files to
+  satisfy challenges from the certificate authority. Use the nginx plugin when you're running Certbot on a
+  web server with nginx listening on port 80.
 * Webroot plugin: (HTTP-01) Tries to place a file where it can be served over HTTP on port 80 by a
   web server running on your system. Use the Webroot plugin when you're running Certbot on 
   a web server with any server application listening on port 80 serving files from a folder on disk in response.
-* Standalone plugin: (HTTP-01) Tries to run a temporary web server listening on HTTP on 
-  port 80 (for HTTP-01). Use the Standalone plugin if no existing program 
-  is listening to these ports. Choose HTTP-01 using the `--preferred-challenges` option.
+* Standalone plugin: (HTTP-01) Tries to run a temporary web server listening on HTTP on port 80. Use the
+  Standalone plugin if no existing program is listening to this port.
 * Manual plugin: (DNS-01 or HTTP-01) Either tells you what changes to make to your configuration or updates 
   your DNS records using an external script (for DNS-01) or your webroot (for HTTP-01). Use the Manual 
-  plugin if you have the technical knowledge to make configuration changes yourself when asked to do so. 
+  plugin if you have the technical knowledge to make configuration changes yourself when asked to do so,
+  and are prepared to repeat these steps every time the certificate needs to be renewed. 
 
 Tips for Challenges
 -------------------

docs/contributing.rst

@@ -187,7 +187,7 @@ Authenticators
 
 Authenticators are plugins that prove control of a domain name by solving a
 challenge provided by the ACME server. ACME currently defines three types of
-challenges: HTTP, TLS-SNI, and DNS, represented by classes in `acme.challenges`.
+challenges: HTTP, TLS-SNI (deprecated), TLS-ALPR, and DNS, represented by classes in `acme.challenges`.
 An authenticator plugin should implement support for at least one challenge type.
 
 An Authenticator indicates which challenges it supports by implementing
@@ -215,7 +215,7 @@ support for IIS, Icecast and Plesk.
 Installers and Authenticators will oftentimes be the same class/object
 (because for instance both tasks can be performed by a webserver like nginx)
 though this is not always the case (the standalone plugin is an authenticator
-that listens on port 443, but it cannot install certs; a postfix plugin would
+that listens on port 80, but it cannot install certs; a postfix plugin would
 be an installer but not an authenticator).
 
 Installers and Authenticators are kept separate because

docs/install.rst

@@ -29,7 +29,7 @@ System Requirements
 Certbot currently requires Python 2.7 or 3.4+ running on a UNIX-like operating
 system. By default, it requires root access in order to write to
 ``/etc/letsencrypt``, ``/var/log/letsencrypt``, ``/var/lib/letsencrypt``; to
-bind to ports 80 and 443 (if you use the ``standalone`` plugin) and to read and
+bind to port 80 (if you use the ``standalone`` plugin) and to read and
 modify webserver configurations (if you use the ``apache`` or ``nginx``
 plugins).  If none of these apply to you, it is theoretically possible to run
 without root privileges, but for most users who want to avoid running an ACME

docs/using.rst

@@ -44,10 +44,13 @@ a combination_ of distinct authenticator and installer plugins.
 =========== ==== ==== =============================================================== =============================
 Plugin      Auth Inst Notes                                                           Challenge types (and port)
 =========== ==== ==== =============================================================== =============================
+apache_     Y    Y    | Automates obtaining and installing a certificate with Apache  http-01_ (80)
+                      | 2.4 on OSes with ``libaugeas0`` 1.0+.
+nginx_      Y    Y    | Automates obtaining and installing a certificate with Nginx.  http-01_ (80)
 webroot_    Y    N    | Obtains a certificate by writing to the webroot directory of  http-01_ (80)
                       | an already running webserver.
-standalone_ Y    N    | Uses a "standalone" webserver to obtain a certificate.        http-01_ (80) 
-                      | Requires port 80 to be available. This is useful on    
+standalone_ Y    N    | Uses a "standalone" webserver to obtain a certificate.        http-01_ (80)
+                      | Requires port 80 to be available. This is useful on
                       | systems with no webserver, or when direct integration with
                       | the local webserver is not supported or not desired.
 |dns_plugs| Y    N    | This category of plugins automates obtaining a certificate by dns-01_ (53)
@@ -156,10 +159,7 @@ To obtain a certificate using a "standalone" webserver, you can use the
 standalone plugin by including ``certonly`` and ``--standalone``
 on the command line. This plugin needs to bind to port 80 in
 order to perform domain validation, so you may need to stop your
-existing webserver. To control which port the plugin uses, include
-one of the options shown below on the command line.
-
-    * ``--preferred-challenges http`` to use port 80
+existing webserver.
 
 It must still be possible for your machine to accept inbound connections from
 the Internet on the specified port using each requested domain name.
@@ -252,7 +252,7 @@ installer plugins. To do so, specify the authenticator plugin with
 
 For instance, you may want to create a certificate using the webroot_ plugin
 for authentication and the apache_ plugin for installation, perhaps because you
-use a proxy or CDN for SSL and only want to secure the connection between them
+use a proxy or CDN for HTTPS and only want to secure the connection between them
 and your origin server.
 
 ::