diff --git a/certbot-nginx/certbot_nginx/options-ssl-nginx.conf b/certbot-nginx/certbot_nginx/options-ssl-nginx.conf
index 3faab8818..89c920b3e 100644
--- a/certbot-nginx/certbot_nginx/options-ssl-nginx.conf
+++ b/certbot-nginx/certbot_nginx/options-ssl-nginx.conf
@@ -4,5 +4,4 @@ ssl_session_timeout 1440m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_prefer_server_ciphers on;
 
-# Using list of ciphers from "Bulletproof SSL and TLS"
 ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA";
diff --git a/certbot-nginx/certbot_nginx/parser.py b/certbot-nginx/certbot_nginx/parser.py
index 5b6860690..5bfd9182b 100644
--- a/certbot-nginx/certbot_nginx/parser.py
+++ b/certbot-nginx/certbot_nginx/parser.py
@@ -566,3 +566,17 @@ def _add_directive(block, directive, replace):
                     directive, block[location]))
         else:
             block.append(directive)
+
+def _comment_spaced_block(block):
+    """Adds a "managed by Certbot" comment to every directive."""
+    comment = " # managed by Certbot"
+    indent = 80 - len(comment)
+    for i, entry in enumerate(block):
+        if isinstance(entry, list):
+            line = "".join(entry)
+            line = "".join(c for c in line if c != "\n")
+            linelength = len(line)
+            extra = indent - linelength
+            if extra < 0:
+                extra = 0
+            block[i][-1] += extra * " " + comment