diff --git a/certbot-apache/certbot_apache/configurator.py b/certbot-apache/certbot_apache/configurator.py
index e0a4baade..295c7cee6 100644
--- a/certbot-apache/certbot_apache/configurator.py
+++ b/certbot-apache/certbot_apache/configurator.py
@@ -436,19 +436,20 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
                 return True
         return False
 
-    def find_best_http_vhost(self, target):
+    def find_best_http_vhost(self, target, filter_defaults):
         """Returns non-HTTPS vhost objects found from the Apache config
 
         :param str target: Domain name of the desired VirtualHost
+        :param bool filter_defaults: whether _default_ vhosts should be
+            included if it is the best match
 
         :returns: VirtualHost object that's the best match for target name
         :rtype: `obj.VirtualHost` or None
         """
         nonssl_vhosts = [i for i in self.vhosts if not i.ssl]
-        return self._find_best_vhost(target, nonssl_vhosts)
+        return self._find_best_vhost(target, nonssl_vhosts, filter_defaults)
 
-
-    def _find_best_vhost(self, target_name, vhosts=None):
+    def _find_best_vhost(self, target_name, vhosts=None, filter_defaults=False):
         """Finds the best vhost for a target_name.
 
         This does not upgrade a vhost to HTTPS... it only finds the most
@@ -457,6 +458,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
         :param str target_name: domain handled by the desired vhost
         :param vhosts: vhosts to consider
         :type vhosts: `collections.Iterable` of :class:`~certbot_apache.obj.VirtualHost`
+        :param bool filter_defaults: whether a vhost with a _default_
+            addr is acceptable
 
         :returns: VHost or None
 
@@ -497,8 +500,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator):
 
         # No winners here... is there only one reasonable vhost?
         if best_candidate is None:
-            # reasonable == Not all _default_ addrs
-            vhosts = self._non_default_vhosts(vhosts)
+            if filter_defaults:
+                vhosts = self._non_default_vhosts(vhosts)
             # remove mod_macro hosts from reasonable vhosts
             reasonable_vhosts = [vh for vh
                                  in vhosts if vh.modmacro is False]
diff --git a/certbot-apache/certbot_apache/http_01.py b/certbot-apache/certbot_apache/http_01.py
index fbb219d54..f3057a9b3 100644
--- a/certbot-apache/certbot_apache/http_01.py
+++ b/certbot-apache/certbot_apache/http_01.py
@@ -73,7 +73,7 @@ class ApacheHttp01(common.TLSSNI01):
     def _mod_config(self):
         moded_vhosts = set()
         for chall in self.achalls:
-            vh = self.configurator.find_best_http_vhost(chall.domain)
+            vh = self.configurator.find_best_http_vhost(chall.domain, filter_defaults=False)
             if vh and vh not in moded_vhosts:
                 self._set_up_include_directive(vh)
                 moded_vhosts.add(vh)
diff --git a/certbot-apache/certbot_apache/tests/configurator_test.py b/certbot-apache/certbot_apache/tests/configurator_test.py
index fa2d4b62d..110bd4e98 100644
--- a/certbot-apache/certbot_apache/tests/configurator_test.py
+++ b/certbot-apache/certbot_apache/tests/configurator_test.py
@@ -260,6 +260,12 @@ class MultipleVhostsTest(util.ApacheTest):
         self.assertRaises(
             errors.PluginError, self.config.choose_vhost, "none.com")
 
+    def test_find_best_http_vhost(self):
+        vh = obj.VirtualHost("
+            fp", "ap", set([obj.Addr.fromstring("_default_:80")]), False, True)
+        self.config.vhosts = [vh]
+        self.assertEqual(self.config.find_best_http_vhost("foo.bar", False))
+
     def test_findbest_continues_on_short_domain(self):
         # pylint: disable=protected-access
         chosen_vhost = self.config._find_best_vhost("purple.com")