prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  don't add includeSubDomains for Strict-Transport-Security header
  Hi,
  
  I think the letsencrypt client shouldn’t add `includeSubDomains` to the Strict-Transport-Security header by default.
  
  If you let the letsencrypt client modify the configuration for a webserver which hosts example.com, this would make it only possible to reach subdomain hosts (foo.example.com) with https. If you forgot only one webserver which serves a subdomain by http only, you can't reach this one any more.
  And as browsers actually don't have an option to clear the HSTS cache, It won't help you to remove the includeSubDomains later from the webserver config.
  
  includeSubDomains is something, that an admin should only add if he truly knows, that all subdomains are reachable by https. So I think this should never be added by an automatic tool, like the letsencrypt client.
  
  RFC 6797 section 11.1 [1] also describes some implications of includeSubDomains
  
  Chris
  
  [1] https://tools.ietf.org/html/rfc6797#section-11.4
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `letsencrypt-apache/letsencrypt_apache/constants.py`
  Content:
  ```
  1 """Apache plugin constants."""
  2 import pkg_resources
  3 
  4 
  5 CLI_DEFAULTS = dict(
  6     server_root="/etc/apache2",
  7     ctl="apache2ctl",
  8     enmod="a2enmod",
  9     dismod="a2dismod",
  10     le_vhost_ext="-le-ssl.conf",
  11 )
  12 """CLI defaults."""
  13 
  14 MOD_SSL_CONF_DEST = "options-ssl-apache.conf"
  15 """Name of the mod_ssl config file as saved in `IConfig.config_dir`."""
  16 
  17 MOD_SSL_CONF_SRC = pkg_resources.resource_filename(
  18     "letsencrypt_apache", "options-ssl-apache.conf")
  19 """Path to the Apache mod_ssl config file found in the Let's Encrypt
  20 distribution."""
  21 
  22 AUGEAS_LENS_DIR = pkg_resources.resource_filename(
  23     "letsencrypt_apache", "augeas_lens")
  24 """Path to the Augeas lens directory"""
  25 
  26 REWRITE_HTTPS_ARGS = [
  27     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,QSA,R=permanent]"]
  28 """Apache version<2.3.9 rewrite rule arguments used for redirections to https vhost"""
  29 
  30 REWRITE_HTTPS_ARGS_WITH_END = [
  31     "^", "https://%{SERVER_NAME}%{REQUEST_URI}", "[END,QSA,R=permanent]"]
  32 """Apache version >= 2.3.9 rewrite rule arguments used for redirections to
  33     https vhost"""
  34 
  35 HSTS_ARGS = ["always", "set", "Strict-Transport-Security",
  36     "\"max-age=31536000; includeSubDomains\""]
  37 """Apache header arguments for HSTS"""
  38 
  39 UIR_ARGS = ["always", "set", "Content-Security-Policy",
  40     "upgrade-insecure-requests"]
  41 
  42 HEADER_ARGS = {"Strict-Transport-Security": HSTS_ARGS,
  43         "Upgrade-Insecure-Requests": UIR_ARGS}
  44 
  45
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/letsencrypt-apache/letsencrypt_apache/constants.py b/letsencrypt-apache/letsencrypt_apache/constants.py
  --- a/letsencrypt-apache/letsencrypt_apache/constants.py
  +++ b/letsencrypt-apache/letsencrypt_apache/constants.py
  @@ -33,7 +33,7 @@
       https vhost"""
   
   HSTS_ARGS = ["always", "set", "Strict-Transport-Security",
  -    "\"max-age=31536000; includeSubDomains\""]
  +    "\"max-age=31536000\""]
   """Apache header arguments for HSTS"""
   
   UIR_ARGS = ["always", "set", "Content-Security-Policy",
  
verification_info: {"golden_diff": "diff --git a/letsencrypt-apache/letsencrypt_apache/constants.py b/letsencrypt-apache/letsencrypt_apache/constants.py\n--- a/letsencrypt-apache/letsencrypt_apache/constants.py\n+++ b/letsencrypt-apache/letsencrypt_apache/constants.py\n@@ -33,7 +33,7 @@\n     https vhost\"\"\"\n \n HSTS_ARGS = [\"always\", \"set\", \"Strict-Transport-Security\",\n-    \"\\\"max-age=31536000; includeSubDomains\\\"\"]\n+    \"\\\"max-age=31536000\\\"\"]\n \"\"\"Apache header arguments for HSTS\"\"\"\n \n UIR_ARGS = [\"always\", \"set\", \"Content-Security-Policy\",\n", "issue": "don't add includeSubDomains for Strict-Transport-Security header\nHi,\n\nI think the letsencrypt client shouldn\u2019t add `includeSubDomains` to the Strict-Transport-Security header by default.\n\nIf you let the letsencrypt client modify the configuration for a webserver which hosts example.com, this would make it only possible to reach subdomain hosts (foo.example.com) with https. If you forgot only one webserver which serves a subdomain by http only, you can't reach this one any more.\nAnd as browsers actually don't have an option to clear the HSTS cache, It won't help you to remove the includeSubDomains later from the webserver config.\n\nincludeSubDomains is something, that an admin should only add if he truly knows, that all subdomains are reachable by https. So I think this should never be added by an automatic tool, like the letsencrypt client.\n\nRFC 6797 section 11.1 [1] also describes some implications of includeSubDomains\n\nChris\n\n[1] https://tools.ietf.org/html/rfc6797#section-11.4\n\n", "before_files": [{"content": "\"\"\"Apache plugin constants.\"\"\"\nimport pkg_resources\n\n\nCLI_DEFAULTS = dict(\n    server_root=\"/etc/apache2\",\n    ctl=\"apache2ctl\",\n    enmod=\"a2enmod\",\n    dismod=\"a2dismod\",\n    le_vhost_ext=\"-le-ssl.conf\",\n)\n\"\"\"CLI defaults.\"\"\"\n\nMOD_SSL_CONF_DEST = \"options-ssl-apache.conf\"\n\"\"\"Name of the mod_ssl config file as saved in `IConfig.config_dir`.\"\"\"\n\nMOD_SSL_CONF_SRC = pkg_resources.resource_filename(\n    \"letsencrypt_apache\", \"options-ssl-apache.conf\")\n\"\"\"Path to the Apache mod_ssl config file found in the Let's Encrypt\ndistribution.\"\"\"\n\nAUGEAS_LENS_DIR = pkg_resources.resource_filename(\n    \"letsencrypt_apache\", \"augeas_lens\")\n\"\"\"Path to the Augeas lens directory\"\"\"\n\nREWRITE_HTTPS_ARGS = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,QSA,R=permanent]\"]\n\"\"\"Apache version<2.3.9 rewrite rule arguments used for redirections to https vhost\"\"\"\n\nREWRITE_HTTPS_ARGS_WITH_END = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,QSA,R=permanent]\"]\n\"\"\"Apache version >= 2.3.9 rewrite rule arguments used for redirections to\n    https vhost\"\"\"\n\nHSTS_ARGS = [\"always\", \"set\", \"Strict-Transport-Security\",\n    \"\\\"max-age=31536000; includeSubDomains\\\"\"]\n\"\"\"Apache header arguments for HSTS\"\"\"\n\nUIR_ARGS = [\"always\", \"set\", \"Content-Security-Policy\",\n    \"upgrade-insecure-requests\"]\n\nHEADER_ARGS = {\"Strict-Transport-Security\": HSTS_ARGS,\n        \"Upgrade-Insecure-Requests\": UIR_ARGS}\n\n", "path": "letsencrypt-apache/letsencrypt_apache/constants.py"}], "after_files": [{"content": "\"\"\"Apache plugin constants.\"\"\"\nimport pkg_resources\n\n\nCLI_DEFAULTS = dict(\n    server_root=\"/etc/apache2\",\n    ctl=\"apache2ctl\",\n    enmod=\"a2enmod\",\n    dismod=\"a2dismod\",\n    le_vhost_ext=\"-le-ssl.conf\",\n)\n\"\"\"CLI defaults.\"\"\"\n\nMOD_SSL_CONF_DEST = \"options-ssl-apache.conf\"\n\"\"\"Name of the mod_ssl config file as saved in `IConfig.config_dir`.\"\"\"\n\nMOD_SSL_CONF_SRC = pkg_resources.resource_filename(\n    \"letsencrypt_apache\", \"options-ssl-apache.conf\")\n\"\"\"Path to the Apache mod_ssl config file found in the Let's Encrypt\ndistribution.\"\"\"\n\nAUGEAS_LENS_DIR = pkg_resources.resource_filename(\n    \"letsencrypt_apache\", \"augeas_lens\")\n\"\"\"Path to the Augeas lens directory\"\"\"\n\nREWRITE_HTTPS_ARGS = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[L,QSA,R=permanent]\"]\n\"\"\"Apache version<2.3.9 rewrite rule arguments used for redirections to https vhost\"\"\"\n\nREWRITE_HTTPS_ARGS_WITH_END = [\n    \"^\", \"https://%{SERVER_NAME}%{REQUEST_URI}\", \"[END,QSA,R=permanent]\"]\n\"\"\"Apache version >= 2.3.9 rewrite rule arguments used for redirections to\n    https vhost\"\"\"\n\nHSTS_ARGS = [\"always\", \"set\", \"Strict-Transport-Security\",\n    \"\\\"max-age=31536000\\\"\"]\n\"\"\"Apache header arguments for HSTS\"\"\"\n\nUIR_ARGS = [\"always\", \"set\", \"Content-Security-Policy\",\n    \"upgrade-insecure-requests\"]\n\nHEADER_ARGS = {\"Strict-Transport-Security\": HSTS_ARGS,\n        \"Upgrade-Insecure-Requests\": UIR_ARGS}\n\n", "path": "letsencrypt-apache/letsencrypt_apache/constants.py"}]}