Install & Compatibility
Where this runs
tested against v5.7.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 46.9MB
glibcpy 3.10–3.910 runs
installs and imports cleanly · install 4.0s · import 0.000s · 47MB
46MB installed
● package 46MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
certbot
✓ Certbot is primarily a command-line utility. Direct programmatic import and use of its core functionality is generally not recommended for end-users managing certificates. For programmatic interaction with the ACME protocol, consider using the 'acme' library (from 'from acme import ...').
Certbot is designed for CLI execution on a web server, not as a Python library for direct application integration.
Certbot's primary interface is the command line. These examples show how to obtain and install a certificate for Nginx, obtain a certificate using the webroot method, and perform a renewal. For full automation, `certbot renew` is typically scheduled via a cron job.
# To obtain and install a certificate for example.com using the Nginx plugin:
sudo certbot --nginx -d example.com -d www.example.com
# To obtain a certificate without installing it (e.g., for manual setup):
sudo certbot certonly --webroot -w /var/www/html -d example.com
# To renew all certificates automatically (typically run via cron):
sudo certbot renew --dry-run # Test renewal without actual changes
sudo certbot renew
certbot --version
Debug
Known issues
breakingIn `v5.0.0`, Certbot removed final instances of `pyopenssl` x509 and PKey objects, and `acme.crypto_util.SSLSocket` was removed. Code directly interacting with these specific internal APIs will break.fixReview your code for direct dependencies on `acme.crypto_util.SSLSocket` or `pyopenssl` x509/PKey objects if you were using Certbot's internal APIs. Most users interacting via CLI will be unaffected.
affects: >=5.0.0
breakingAs of `v5.5.0`, nearly all code for `certbot-nginx` and `certbot-apache` plugins has been moved into private modules within the `certbot` package, which now offers 'apache' and 'nginx' extras. While command-line users should notice no major changes, programmatic users or those with custom plugin integrations might be affected by this architectural shift in package structure and import paths. Existing `certbot-apache` and `certbot-nginx` packages now primarily serve as dependencies that register the plugin functionality.fixEnsure `certbot` is installed with the appropriate extras (`pip install 'certbot[apache]'` or `pip install 'certbot[nginx]'`). If you had custom programmatic interactions with plugin internals, review the new `certbot` package structure.
affects: >=5.5.0
deprecatedThe function `acme.crypto_util.make_self_signed_cert` was deprecated in `v5.1.0` and will be removed in a future release. Additionally, the `certbot.ocsp` module was deprecated in `v5.5.0` and will be removed in the next major release.fixAvoid using `acme.crypto_util.make_self_signed_cert` and `certbot.ocsp` in any custom scripts or integrations.
affects: >=5.1.0 (for `make_self_signed_cert`), >=5.5.0 (for `certbot.ocsp`)
gotchaWhen requesting certificates with IP address SANs using the standalone or manual plugin (via the `--ip-address` flag introduced in `v5.3.0`), you will also need to pass `--preferred-profile shortlived` for Let's Encrypt's implementation of IP address certificates.fixInclude `--preferred-profile shortlived` when requesting IP address SANs with Let's Encrypt to ensure successful issuance: `certbot certonly --standalone --ip-address <your_ip> --preferred-profile shortlived`.
affects: >=5.3.0
gotchaDeploy directory hooks are now also run when using `certbot certonly` or `certbot run` to get a new certificate, not just during renewals. This change was introduced in `v5.3.0`.fixBe aware that any scripts configured as deploy hooks will execute upon initial certificate issuance via `certonly` or `run` commands, in addition to renewals. Adjust hook logic if this behavior is not desired for initial issuance.
affects: >=5.3.0
Upgrade
Version history
5.7.0latest on PyPI · released Jul 15, 2026
Audit
Dependencies
pyparsingoptionalRequired by certbot-nginx plugin (>=3.0.0 since v5.4.0).
augeasoptionalSystem dependency often required for Apache plugin for configuration parsing.