Update options-ssl-nginx.conf inprepare if it hasn't been manually modified (#4689)

Fixes #4559.

* Update options-ssl-nginx.conf in prepare, if it hasn't been modified.

* add previous options-ssl-nginx.conf hashes

* InstallSslOptionsConfTest

* remove .new file and only print warning once

* save digest to /etc/letsencrypt

* add comment reminding devs to update hashes

* add comment and test for sha256sum

* treat hash file as text file because python3

* move constants and rename hidden digest file

certbot/crypto_util.py

@@ -4,6 +4,7 @@
     is capable of handling the signatures.
 
 """
+import hashlib
 import logging
 import os
 
@@ -353,3 +354,17 @@ def _notAfterBefore(cert_path, method):
     if six.PY3:
         timestamp_str = timestamp_str.decode('ascii')
     return pyrfc3339.parse(timestamp_str)
+
+
+def sha256sum(filename):
+    """Compute a sha256sum of a file.
+
+    :param str filename: path to the file whose hash will be computed
+
+    :returns: sha256 digest of the file in hexadecimal
+    :rtype: str
+    """
+    sha256 = hashlib.sha256()
+    with open(filename, 'rb') as f:
+        sha256.update(f.read())
+    return sha256.hexdigest()

certbot/tests/crypto_util_test.py

@@ -293,5 +293,14 @@ class NotAfterTest(unittest.TestCase):
                          '2014-12-18T22:34:45+00:00')
 
 
+class Sha256sumTest(unittest.TestCase):
+    """Tests for certbot.crypto_util.notAfter"""
+
+    def test_sha256sum(self):
+        from certbot.crypto_util import sha256sum
+        self.assertEqual(sha256sum(CERT_PATH),
+            '914ffed8daf9e2c99d90ac95c77d54f32cbd556672facac380f0c063498df84e')
+
+
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover