Fix the Nginx configuration during integration tests (#6801)

If you execute `tests/lock_test.py` or `tox -e integration` on a fairly recent machine, you will get the following error during tests executing against a live Nginx instance:
```
no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking, client: x.x.x.x, server: y:y:y:y:z
```

Indeed, having no defined ssl certificate for a ssl port would inevitably lead to an error during the handshake SSL process between a client and this mis-configured nginx instance.

However it was not a problem one year before, because the handshake was not occurring in practice: the test just need to have a nginx started, and then immediately proceed to modify the configuration with a correct SSL setup. And nginx was able to start with a mis-configuration on SSL. 

But then this fix has been done: https://trac.nginx.org/nginx/ticket/178

Basically with this, validation of the configuration is done during nginx startup, that will refuse to start with invalid configuration on SSL. Consequently, all related tests are failing with a sufficiently up-to-date nginx. For now, it is not seen on Travis because Ubuntu Trusty is used, with an old Nginx.

The PR fixes that, by generating on the fly self-signed certificates in the two impacted tests, and pushing the right parameters in the Nginx configuration.

* Fix nginx configuration with self-signed certificates generated on the fly

* Fix lint/mypy

* Fix old cryptography

* Unattended openssl

* Update lock_test.py

certbot-nginx/tests/boulder-integration.conf.sh

@@ -3,16 +3,22 @@
 # https://www.exratione.com/2014/03/running-nginx-as-a-non-root-user/
 # https://github.com/exratione/non-root-nginx/blob/9a77f62e5d5cb9c9026fd62eece76b9514011019/nginx.conf
 
+# USAGE: ./boulder-integration.conf.sh /path/to/root cert.key cert.pem >> nginx.conf
+
+ROOT=$1
+CERT_KEY_PATH=$2
+CERT_PATH=$3
+
 cat <<EOF
 # This error log will be written regardless of server scope error_log
 # definitions, so we have to set this here in the main scope.
 #
 # Even doing this, Nginx will still try to create the default error file, and
 # log a non-fatal error when it fails. After that things will work, however.
-error_log $root/error.log;
+error_log $ROOT/error.log;
 
 # The pidfile will be written to /var/run unless this is set.
-pid $root/nginx.pid;
+pid $ROOT/nginx.pid;
 
 worker_processes 1;
 
@@ -23,12 +29,12 @@ events {
 http {
   # Set an array of temp, cache and log file options that will otherwise default to
   # restricted locations accessible only to root.
-  client_body_temp_path $root/client_body;
-  fastcgi_temp_path $root/fastcgi_temp;
-  proxy_temp_path $root/proxy_temp;
-  #scgi_temp_path $root/scgi_temp;
-  #uwsgi_temp_path $root/uwsgi_temp;
-  access_log $root/error.log;
+  client_body_temp_path $ROOT/client_body;
+  fastcgi_temp_path $ROOT/fastcgi_temp;
+  proxy_temp_path $ROOT/proxy_temp;
+  #scgi_temp_path $ROOT/scgi_temp;
+  #uwsgi_temp_path $ROOT/uwsgi_temp;
+  access_log $ROOT/error.log;
 
   # This should be turned off in a Virtualbox VM, as it can cause some
   # interesting issues with data corruption in delivered files.
@@ -55,7 +61,7 @@ http {
     listen [::]:5002 $default_server;
     server_name nginx.wtf nginx-tls.wtf nginx2.wtf;
 
-    root $root/webroot;
+    root $ROOT/webroot;
 
     location / {
       # First attempt to serve request as file, then as directory, then fall
@@ -69,7 +75,7 @@ http {
     listen [::]:5002;
     server_name nginx3.wtf;
 
-    root $root/webroot;
+    root $ROOT/webroot;
 
     location /.well-known/ {
       return 404;
@@ -93,6 +99,9 @@ http {
       return 301 https://\$host\$request_uri;
     }
     server_name nginx6.wtf nginx7.wtf;
+
+    ssl_certificate ${CERT_PATH};
+    ssl_certificate_key ${CERT_KEY_PATH};
   }
 }
 EOF