Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server.

Last update: Dec 31, 2022

Related tags

Cryptography python letsencrypt acme-client certificate acme certbot

Overview

Certbot is part of EFF’s effort to encrypt the entire Internet. Secure communication over the Web relies on HTTPS, which requires the use of a digital certificate that lets browsers verify the identity of web servers (e.g., is that really google.com?). Web servers obtain their certificates from trusted third parties called certificate authorities (CAs). Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt—an open certificate authority launched by the EFF, Mozilla, and others—and deploys it to a web server.

Anyone who has gone through the trouble of setting up a secure website knows what a hassle getting and maintaining a certificate is. Certbot and Let’s Encrypt can automate away the pain and let you turn on and manage HTTPS with simple commands. Using Certbot and Let's Encrypt is free, so there’s no need to arrange payment.

How you use Certbot depends on the configuration of your web server. The best way to get started is to use our interactive guide. It generates instructions based on your configuration settings. In most cases, you’ll need root or administrator access to your web server to run Certbot.

Certbot is meant to be run directly on your web server, not on your personal computer. If you’re using a hosted service and don’t have direct access to your web server, you might not be able to use Certbot. Check with your hosting provider for documentation about uploading certificates or using certificates issued by Let’s Encrypt.

Certbot is a fully-featured, extensible client for the Let's Encrypt CA (or any other CA that speaks the ACME protocol) that can automate the tasks of obtaining certificates and configuring webservers to use them. This client runs on Unix-based operating systems.

To see the changes made to Certbot between versions please refer to our changelog.

Contributing

If you'd like to contribute to this project please read Developer Guide.

This project is governed by EFF's Public Projects Code of Conduct.

How to run the client

The easiest way to install and run Certbot is by visiting certbot.eff.org, where you can find the correct instructions for many web server and OS combinations. For more information, see Get Certbot.

Understanding the client in more depth

To understand what the client is doing in detail, it's important to understand the way it uses plugins. Please see the explanation of plugins in the User Guide.

Links

Documentation: https://certbot.eff.org/docs

Software project: https://github.com/certbot/certbot

Notes for developers: https://certbot.eff.org/docs/contributing.html

Main Website: https://certbot.eff.org

Let's Encrypt Website: https://letsencrypt.org

Community: https://community.letsencrypt.org

ACME spec: RFC 8555

ACME working area in github (archived): https://github.com/ietf-wg-acme/acme

System Requirements

See https://certbot.eff.org/docs/install.html#system-requirements.

Current Features

Supports multiple web servers:
- apache/2.x
- nginx/0.8.48+
- webroot (adds files to webroot directories in order to prove control of domains and obtain certificates)
- standalone (runs its own simple webserver to prove you control a domain)
- other server software via third party plugins
The private key is generated locally on your system.
Can talk to the Let's Encrypt CA or optionally to other ACME compliant services.
Can get domain-validated (DV) certificates.
Can revoke certificates.
Adjustable RSA key bit-length (2048 (default), 4096, ...).
Adjustable EC key (secp256r1 (default), secp384r1, secp521r1).
Can optionally install a http -> https redirect, so your site effectively runs https only (Apache only)
Fully automated.
Configuration changes are logged and can be reverted.
Supports an interactive text UI, or can be driven entirely from the command line.
Free and Open Source Software, made with Python.

For extensive documentation on using and contributing to Certbot, go to https://certbot.eff.org/docs. If you would like to contribute to the project or run the latest code from git, you should read our developer guide.

Comments

Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA
My operating system is (include version):

Ubuntu 16.04

I installed Certbot with (certbot-auto, OS package manager, pip, etc):

OS Package Manager

I ran this command and it produced this output:

sudo certbot renew --dry-run or sudo certbot --nginx -d [hostname]

Certbot's behavior differed from what I expected because:

¯_(ツ)_/¯

Here is a Certbot log showing the issue (if available):

Logs are stored in /var/log/letsencrypt by default. Feel free to redact domains, e-mail and IP addresses as you see fit.

2018-01-10 04:20:37,807:INFO:certbot.auth_handler:Performing the following challenges: 2018-01-10 04:20:37,808:CRITICAL:certbot.auth_handler:Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA. 2018-01-10 04:20:37,810:WARNING:certbot.renewal:Attempting to renew cert (www.coolsite.com) from /etc/letsencrypt/renewal/www.coolsite.com.conf produced an unexpected error: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.. Skipping. 2018-01-10 04:20:37,812:DEBUG:certbot.renewal:Traceback was: Traceback (most recent call last): File "/usr/lib/python2.7/dist-packages/certbot/renewal.py", line 425, in handle_renewal_request main.renew_cert(lineage_config, plugins, renewal_candidate) File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 743, in renew_cert _get_and_save_cert(le_client, config, lineage=lineage) File "/usr/lib/python2.7/dist-packages/certbot/main.py", line 80, in _get_and_save_cert renewal.renew_cert(config, domains, le_client, lineage) File "/usr/lib/python2.7/dist-packages/certbot/renewal.py", line 297, in renew_cert new_certr, new_chain, new_key, _ = le_client.obtain_certificate(domains) File "/usr/lib/python2.7/dist-packages/certbot/client.py", line 318, in obtain_certificate self.config.allow_subset_of_names) File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 68, in get_authorizations self._choose_challenges(domains) File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 103, in _choose_challenges self.authzr[dom].body.combinations) File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 374, in gen_challenge_path return _find_smart_path(challbs, preferences, combinations) File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 411, in _find_smart_path _report_no_chall_path() File "/usr/lib/python2.7/dist-packages/certbot/auth_handler.py", line 442, in _report_no_chall_path raise errors.AuthorizationError(msg) AuthorizationError: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.

Here is the relevant nginx server block or Apache virtualhost for the domain I am configuring:

server { listen 3002; server_name www.coolsite.com;

location / { proxy_pass http://coolip:3002; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; }

}
opened by officiallymarky 81
Let's Encrypt intermediate not accepted by Chrome and IE8 on Windows XP

I know and I've heard all the caveats that Windows XP is unsupported, etc etc. But there's still a significant user base left on Windows XP.

If Let's Encrypt certificates are officially known to be broken on Windows XP, that's fine. But there should be a clear official statement of that fact somewhere (e.g. Let's Encrypt FAQ), so everyone who has this issue, knows that they're SoL.

Screenshots of Chrome on Windows XP with certificate details:

opened by intgr 77
Ensure Docker isn't relying on GitHub Services

I got this email from Docker over the holidays:

Docker Hub Automated Builds affected by Github Services deprecation We have identified that your Docker Hub account contains Classic Automated Builds that are using GitHub Services.

GitHub Services are being deprecated on January 31st, 2019 and will experience an interruption of service from January 7th to January 13th, 2019, inclusive. Our attempt to automatically upgrade your Automated Builds to use GitHub Webhooks has failed due to an issue accessing your GitHub repositories.

We advise you to take action to reestablish your build web hooks before Monday, January 7th, 2019 to avoid affecting your workflow.

Thank you for your attention in this matter. If you have any questions or concerns please contact us at [email protected].

It looks like our Docker setup is relying on GitHub services. If I remember correctly, I did things these way to not give Docker a ton of write permissions on our repo. If giving them these permissions is the only way to do things now, we could consider it, but I think it should be avoided if possible.
area: pkging has pr area: docker

opened by bmw 69
Do you support Wildcard Subdomain

[Moderator's note: If you'd like to express your support for wildcard issuance, please hit 'like' on this thread on the community forum rather than opening an issue.]

Hi, I have a question. Does Let's Encrypt supports wildcard subdomain or just just the main domain/www only? Thanks.

opened by gremdev 69
Certbot Ubuntu PPA is out of date

If you're having trouble using Certbot and aren't sure you've found a bug or request for a new feature, please first try asking for help at https://community.letsencrypt.org/. There is a much larger community there of people familiar with the project who will be able to more quickly answer your questions.

My operating system is (include version):

Ubuntu 18.04.2 LTS

I installed Certbot with (certbot-auto, OS package manager, pip, etc):

apt-get (package manager)

Basically, the Ubuntu PPA for certbot and similar packages (in my case, python-certbot-nginx) are several versions behind. Certbot is at 0.31 stable, but the PPA is stuck on 0.28. Should we not be using the PPA at this point, and instead just do a straight install?
wontfix area: debian / ubuntu area: pkging

opened by greggilbert 64
dns-cloudflare: Implement limited-scope API Tokens
A while ago Cloudflare added support for limited-scope API Tokens in place of using a global API key, but support for them in cloudflare/python-cloudflare took a while to get through.

In summary, this PR:

~~Adds the newer version of python-cloudflare with token support to the requirements~~

Implements token functionality through the INI file parameter dns_cloudflare_api_token (in addition to the traditional dns_cloudflare_email and dns_cloudflare_api_key). This needed a more advanced parameter validator than the built in required_variables mechanism.

Updates the docs to reflect the new option, needed token permissions, and version details of the cloudflare module

~~Testing for the plugin with tokens is semi-implemented, but at the moment requires switching between testing with a token and the traditional global key manually. I'm not experienced with unittest so I'll need some help with this.~~

~~Testing is mostly implemented, however coverage is failing on a few lines which I don't think can be tested.~~

Tox also seemed to have some issues running, even though I followed the developer guide. (For future reference, this is because the file /etc/letsencrypt/cli.ini existed on my dev machine)

Fixes #7252

Pull Request Checklist

[x] If the change being made is to a distributed component, edit the master section of CHANGELOG.md to include a description of the change being made.

[X] Add mypy type annotations for any functions that were added or modified.

[X] Include your name in AUTHORS.md if you like.
opened by Tugzrida 55

DNS CAA query timeout

http://xiangyang.li/.well-known/acme-challenge/MQJcfZ4mhvxqB92VnCudMrgN7EbSlhv5PObd7yEY9tVE

Failed authorization procedure. xiangyang.li (http-01): connection :: The server could not connect to the client for DV :: DNS query timed out

IMPORTANT NOTES:
 - The following 'connection' errors were reported by the server:

   Domains: xiangyang.li
   Error: The server could not connect to the client for DV

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client.

area: boulder

opened by sh4wn 55

archive/domain/privkeyN.pem is set to 0644 instead of 0600 (or 0440)

The private keys in /etc/letsencrypt/archive/domain/privkey.pem are currently set to 0644. I guess it's better to have only root to be able to read the private key, hence set them to 0600.
area: security has pr

opened by ZaiLynch 54
Documentation cleanup!
We have documentation in too many places. Let's clean up and deprecate them!

Ones we want to keep:

reStructuredText in this repo (and on readthedocs.org), in three main sections:

including the introduction (README.rst in the top level)

a using.rst "user guide" (is probably too redundant with the introduction...)

a contributing.rst "developer guide"

the instruction generator that lives in certbot/website

FAQs on the Certbot website.

Ones we want to get rid of:

the wiki on this repo

distinctly worded material at https://letsencrypt.org/getting-started

Ones that are in the middle:

docs that are on community.letsencrypt.org

area: documentation
opened by pde 53
Overriding the default challenge domain in DNS authenticators

Support a new option --dns--follow-cnames whereby certbot will follow a (chain of) CNAME record(s) at the challenge domain (_acme-challenge.) and instead update the target domain.

Independently of this option, this change also incidentally fixes the possibly uncommon use case where _acme-challenge is itself a delegation apex (previously the RFC2136 plugin would generate an update for the wrong zone in that case).
area: dns

opened by quinot 49

Amazon Linux: ImportError: No module named cryptography.hazmat.bindings.openssl.binding

While attempting to run on Amazon Linux: Linux ip #1 SMP Sat Oct 24 01:31:37 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

Git commit hash: 6950dbd0708d3ba16b717ad1097332fc37e33f15

I get the following error:

[ec2-user@ip letsencrypt]$ ./letsencrypt-auto
Checking for new version...
Creating virtual environment...
Installing Python packages...
Requesting root privileges to run letsencrypt...
   sudo /home/ec2-user/.local/share/letsencrypt/bin/letsencrypt --no-self-upgrade
Traceback (most recent call last):
  File "/home/ec2-user/.local/share/letsencrypt/bin/letsencrypt", line 7, in <module>
    from letsencrypt.cli import main
  File "/home/ec2-user/.local/share/letsencrypt/local/lib/python2.7/dist-packages/letsencrypt/cli.py", line 21, in <modul
e>
    import OpenSSL
  File "/home/ec2-user/.local/share/letsencrypt/local/lib/python2.7/dist-packages/OpenSSL/__init__.py", line 8, in <modul
e>
    from OpenSSL import rand, crypto, SSL
  File "/home/ec2-user/.local/share/letsencrypt/local/lib/python2.7/dist-packages/OpenSSL/rand.py", line 11, in <module>
    from OpenSSL._util import (
  File "/home/ec2-user/.local/share/letsencrypt/local/lib/python2.7/dist-packages/OpenSSL/_util.py", line 6, in <module>
    from cryptography.hazmat.bindings.openssl.binding import Binding
ImportError: No module named cryptography.hazmat.bindings.openssl.binding

This was working as of Feb 8th... however when trying to checkout an old version to find where things broke, letsencrypt-auto keeps re-upgrading itself to the latest version!

area: certbot-auto area: pyca

opened by gabeguz 49

/etc/letsencrypt/ folder is not created on installing of the certbot

I installed the certbot with snap (edge) but the /etc/letsencrypt/ wasn't exists. I wanted to issue a cert but I need to put my deployment hook and I didn't know to where to put it because the /etc/letsencrypt/renewal-hooks/ didn't created yet. So I just left it somewhere and specified the path directly. And after issuing a cert it finally was created. This seems like a minor issue but I spent for some time and possibly might made a mistake. For such critical things like TLS issuing this is important to have all as clear as possible.

Could you please add some post install hook and create the folder structure?

Similar when I installed on Ubuntu with apt the /etc/letsencrypt/ was created but only with one cli.ini file.

For a Debian packages this is very easy to specify needed folders in the control file but I didn't found debian folder in sources. That means that the certbot is debianized by maintainers which adds a work for them and don't allow to build a deb package yourself.

P.S. When installing a new server ideally I want to just upload files with scp and reboot the server. But I have to ssh into it and perform some commands to issue a cert. This is very inconvenient.
feature request area: ui / ux area: 3rd party area: hooks priority: unplanned

opened by stokito 2
Do not touch modified options-ssl-apache.conf

Hello,

I modified options-ssl-apache.conf to my requirements. The comment at the top of the file says that these modifications will be respected.

Today I encountered downtime because certbot did not respect these changes and modified this file, making clients unable to connect due to improper cipher settings.

This is very frustrating. I want certbot's nasty little hands to never touch this modified file. I know better and do not want any of this "help" in choosing cipher suites. How can I achieve this? I do not want to go through this again on a future renewal.

Apache on Debian 11 x64, using debian packaged version of certbot [1.12.0-2]
area: apache cannot reproduce

opened by purple512 4
Fix josepy GitHub actions warnings

This issue is for https://github.com/certbot/josepy but I'm creating it here for visibility.

While working on https://github.com/certbot/josepy/pull/149, I noticed our CI setup is triggering a lot of warnings from GitHub Actions. I think we should fix this before things break.
area: testing area: code health priority: significant

opened by bmw 0
Deprecate certbot.util.parse_loose_version

We use this function for comparing version strings but it's not type safe in a way that mypy doesn't currently check for. See https://github.com/certbot/certbot/issues/9481.

Because of this, I personally think we should completely stop using this function, deprecate it, and switch to a TBD safer alternative.
area: code health priority: significant

opened by bmw 0
dns-rfc2136: GSS-TSIG (Kerberos) authentication

This would close #7370. It raises the dnspython dependency to 2.1.0 and adds an optional runtime dependency on python-gssapi (and therefore on MIT Krb5 or possibly Heimdal) – although that's only imported when needed so HMAC-TSIG still functions without GSSAPI, and practically anyone who wants GSS-TSIG will already have Krb5 anyway.
area: dns priority: unplanned

opened by grawity 3

Releases(v2.1.1)

v2.1.1(Dec 15, 2022)
Fixed

Our snaps, Docker images, and Windows installer were rebuilt to include updated versions of our dependencies.

This release was not pushed to PyPI since those packages were unaffected.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64_signed.exe(21.03 MB)
v2.1.0(Dec 7, 2022)
Added

Changed

Fixed

Interfaces which plugins register themselves as implementing without inheriting from them now show up in certbot plugins output.

IPluginFactory, IPlugin, IAuthenticator and IInstaller have been re-added to certbot.interfaces.

This is to fix compatibility with a number of third-party DNS plugins which may have started erroring with AttributeError in Certbot v2.0.0.

Plugin authors can find more information about Certbot 2.x compatibility here.

A bug causing our certbot-apache tests to crash on some systems has been resolved.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64_signed.exe(21.04 MB)
v2.0.0(Nov 21, 2022)
Added

Support for Python 3.11 was added to Certbot and all of its components.

acme.challenges.HTTP01Response.simple_verify now accepts a timeout argument which defaults to 30 that causes the verification request to timeout after that many seconds.

Changed

The default key type for new certificates is now ECDSA secp256r1 (P-256). It was previously RSA 2048-bit. Existing certificates are not affected.

The Apache plugin no longer supports Apache 2.2.

acme and Certbot no longer support versions of ACME from before the RFC 8555 standard.

acme and Certbot no longer support the old urn:acme:error: ACME error prefix.

Removed the deprecated certbot-dns-cloudxns plugin.

Certbot will now error if a certificate has --reuse-key set and a conflicting --key-type, --key-size or --elliptic-curve is requested on the CLI. Use --new-key to change the key while preserving --reuse-key.

3rd party plugins no longer support the dist_name:plugin_name format on the CLI and in configuration files. Use the shorter plugin_name format.

acme.client.Client, acme.client.ClientBase, acme.client.BackwardsCompatibleClientV2, acme.mixins, acme.client.DER_CONTENT_TYPE, acme.fields.Resource, acme.fields.resource, acme.magic_typing, acme.messages.OLD_ERROR_PREFIX, acme.messages.Directory.register, acme.messages.Authorization.resolved_combinations, acme.messages.Authorization.combinations have been removed.

acme.messages.Directory now only supports lookups by the exact resource name string in the ACME directory (e.g. directory['newOrder']).

Removed the deprecated source_address argument for acme.client.ClientNetwork.

The zope based interfaces in certbot.interfaces have been removed in favor of the abc based interfaces found in the same module.

Certbot no longer depends on zope.

Removed deprecated function certbot.util.get_strict_version.

Removed deprecated functions certbot.crypto_util.init_save_csr, certbot.crypto_util.init_save_key, and certbot.compat.misc.execute_command

The attributes FileDisplay, NoninteractiveDisplay, SIDE_FRAME, input_with_timeout, separate_list_input, summarize_domain_list, HELP, and ESC from certbot.display.util have been removed.

Removed deprecated functions certbot.tests.util.patch_get_utility*. Plugins should now patch certbot.display.util themselves in their tests or use certbot.tests.util.patch_display_util as a temporary workaround.

Certbot's test API under certbot.tests now uses unittest.mock instead of the 3rd party mock library.

Fixed

Fixes a bug where the certbot working directory has unusably restrictive permissions on systems with stricter default umasks.

Requests to subscribe to the EFF mailing list now time out after 60 seconds.

We plan to slowly roll out Certbot 2.0 to all of our snap users in the coming months. If you want to use the Certbot 2.0 snap now, please follow the instructions at https://community.letsencrypt.org/t/certbot-2-0-beta-call-for-testing/185945.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64_signed.exe(21.04 MB)
v1.32.0(Nov 9, 2022)
Added

Changed

DNS RFC2136 module now uses the TSIG key to check for an authoritative SOA record. Helps the use of split-horizon and multiple views in BIND9 using the key in an ACL to determine which view to use.

Fixed

CentOS 9 and other RHEL-derived OSes now correctly use httpd instead of apachectl for various Apache-related commands

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64_signed.exe(21.37 MB)
v1.31.0(Oct 4, 2022)
Added

Changed

If Certbot exits before setting up its usual log files, the temporary directory created to save logging information will begin with the name certbot-log- rather than a generic name. This should not be considered a stable aspect of Certbot and may change again in the future.

Fixed

Fixed an incompatibility in the certbot-dns-cloudflare plugin and the Cloudflare library which was introduced in the Cloudflare library version 2.10.1. The library would raise an error if a token was specified in the Certbot --dns-cloudflare-credentials file as well as the cloudflare.cfg configuration file of the Cloudflare library.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64_signed.exe(21.37 MB)
v1.30.0(Sep 7, 2022)
Added

Changed

acme.client.ClientBase, acme.messages.Authorization.resolved_combinations, acme.messages.Authorization.combinations, acme.mixins, acme.fields.resource, and acme.fields.Resource are deprecated and will be removed in a future release.

acme.messages.OLD_ERROR_PREFIX (urn:acme:error:) is deprecated and support for the old ACME error prefix in Certbot will be removed in the next major release of Certbot.

acme.messages.Directory.register is deprecated and will be removed in the next major release of Certbot. Furthermore, .Directory will only support lookups by the exact resource name string in the ACME directory (e.g. directory['newOrder']).

The certbot-dns-cloudxns plugin is now deprecated and will be removed in the next major release of Certbot.

The source_address argument for acme.client.ClientNetwork is deprecated and support for it will be removed in the next major release.

Add UI text suggesting users create certs for multiple domains, when possible

Fixed

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64_signed.exe(21.37 MB)
v1.29.0(Jul 7, 2022)
Added

Updated Windows installer to be signed and trusted in Windows

Changed

--allow-subset-of-names will now additionally retry in cases where domains are rejected while creating or finalizing orders. This requires subproblem support from the ACME server.

Fixed

The show_account subcommand now uses the "newAccount" ACME endpoint to fetch the account data, so it doesn't rely on the locally stored account URL. This fixes situations where Certbot would use old ACMEv1 registration info with non-functional account URLs.

The generated Certificate Signing Requests are now generated as version 1 instead of version 3. This resolves situations in where strict enforcement of PKCS#10 meant that CSRs that were generated as version 3 were rejected.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64_signed.exe(18.96 MB)
v1.28.0(Jun 8, 2022)
Added

Updated Apache/NGINX TLS configs to document contents are based on ssl-config.mozilla.org

Changed

A change to order finalization has been made to the acme module and Certbot:

An order's certificate field will only be processed if the order's status is valid.

An order's error field will only be processed if the order's status is invalid.

Fixed

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64.exe(18.95 MB)
v1.27.0(May 3, 2022)
Added

Added support for RFC8555 subproblems to our acme library.

Changed

The PGP key F2871B4152AE13C49519111F447BF683AA3B26C3 was added as an additional trusted key to sign our PyPI packages

When certonly is run with an installer specified (e.g. --nginx), certonly will now also run restart for that installer

Fixed

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64.exe(18.95 MB)
v1.26.0(Apr 5, 2022)
Added

Added --new-key. When renewing or replacing a certificate that has --reuse-key set, it will force a new private key to be generated, one time.

As before, --reuse-key and --no-reuse-key can be used to enable and disable key reuse.

Changed

The default propagation timeout for the OVH DNS plugin (--dns-ovh-propagation-seconds) has been increased from 30 seconds to 120 seconds, based on user feedback.

Fixed

Certbot for Windows has been upgraded to use Python 3.9.11, in response to https://www.openssl.org/news/secadv/20220315.txt.

Previously, when Certbot was in the process of registering a new ACME account and the ACME server did not present any Terms of Service, the user was asked to agree with a non-existent Terms of Service ("None"). This bug is now fixed, so that if an ACME server does not provide any Terms of Service to agree with, the user is not asked to agree to a non-existent Terms of Service any longer.

If account registration fails, Certbot did not relay the error from the ACME server back to the user. This is now fixed: the error message from the ACME server is now presented to the user when account registration fails.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64.exe(18.95 MB)
v1.25.0(Mar 16, 2022)
Added

Changed

Dropped 32 bit support for the Windows beta installer

Windows beta installer is now distributed as "certbot-beta-installer-win_amd64.exe". Users of the Windows beta should uninstall the old version before running this.

Added a check whether OCSP stapling is supported by the installer when requesting a certificate with the run subcommand in combination with the --must-staple option. If the installer does not support OCSP and the --must-staple option is used, Certbot will raise an error and quit.

Certbot and its acme module now depend on josepy>=1.13.0 due to better type annotation support.

Fixed

Updated dependencies to use new version of cryptography that uses OpenSSL 1.1.1n, in response to https://www.openssl.org/news/secadv/20220315.txt.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win_amd64.exe(18.90 MB)
v1.24.0(Mar 1, 2022)
Added

When the --debug-challenges option is used in combination with -v, Certbot now displays the challenge URLs (for http-01 challenges) or FQDNs (for dns-01 challenges) and their expected return values.

Changed

Support for Python 3.6 was removed.

All Certbot components now require setuptools>=41.6.0.

The acme library now requires requests>=2.20.0.

Certbot and its acme library now require pytz>=2019.3.

certbot-nginx now requires pyparsing>=2.2.1.

certbot-dns-route53 now requires boto3>=1.15.15.

Fixed

Nginx plugin now checks included files for the singleton server_names_hash_bucket_size directive.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(17.54 MB)
v1.23.0(Feb 8, 2022)
Added

Added show_account subcommand, which will fetch the account information from the ACME server and show the account details (account URL and, if applicable, email address or addresses)

We deprecated support for Python 3.6 in Certbot and its ACME library. Support for Python 3.6 will be removed in the next major release of Certbot.

Changed

Fixed

GCP Permission list for certbot-dns-google in plugin documentation

dns-digitalocean used the SOA TTL for newly created records, rather than 30 seconds.

Revoking a certificate based on an ECDSA key can now be done with --key-path. See GH #8569.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(17.45 MB)
v1.22.0(Dec 8, 2021)
Added

Support for Python 3.10 was added to Certbot and all of its components.

The function certbot.util.parse_loose_version was added to parse version strings in the same way as the now deprecated distutils.version.LooseVersion class from the Python standard library.

Added --issuance-timeout. This option specifies how long (in seconds) Certbot will wait for the server to issue a certificate.

Changed

The function certbot.util.get_strict_version was deprecated and will be removed in a future release.

Fixed

Fixed an issue on Windows where the web.config created by Certbot would sometimes conflict with preexisting configurations (#9088).

Fixed an issue on Windows where the webroot plugin would crash when multiple domains had the same webroot. This affected Certbot 1.21.0.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(17.47 MB)
v1.21.0(Nov 4, 2021)
Added

Certbot will generate a web.config file on Windows in the challenge path when the webroot plugin is used, if one does not exist. This web.config file lets IIS serve challenge files while they do not have an extension.

Changed

We changed the PGP key used to sign the packages we upload to PyPI. Going forward, releases will be signed with one of three different keys. All of these keys are available on major key servers and signed by our previous PGP key. The fingerprints of these new keys are:

BF6BCFC89E90747B9A680FD7B6029E8500F7DB16

86379B4F0AF371B50CD9E5FF3402831161D1D280

20F201346BF8F3F455A73F9A780CC99432A28621

Fixed

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.98 MB)
v1.20.0(Oct 5, 2021)
Added

Added --no-reuse-key. This remains the default behavior, but the flag may be useful to unset the --reuse-key option on existing certificates.

Changed

Fixed

The certbot-dns-rfc2136 plugin in Certbot 1.19.0 inadvertently had an implicit dependency on dnspython>=2.0. This has been relaxed to dnspython>=1.15.0.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.98 MB)
v1.19.0(Sep 7, 2021)
Added

The certbot-dns-rfc2136 plugin always assumed the use of an IP address as the target server, but this was never checked. Until now. The plugin raises an error if the configured target server is not a valid IPv4 or IPv6 address.

Our acme library now supports requesting certificates for IP addresses. This feature is still unsupported by Certbot and Let's Encrypt.

Changed

Several attributes in certbot.display.util module are deprecated and will be removed in a future release of Certbot. Any import of these attributes will emit a warning to prepare the transition for developers.

zope based interfaces in certbot.interfaces module are deprecated and will be removed in a future release of Certbot. Any import of these interfaces will emit a warning to prepare the transition for developers.

We removed the dependency on chardet from our acme library. Except for when downloading a certificate in an alternate format, our acme library now assumes all server responses are UTF-8 encoded which is required by RFC 8555.

Fixed

Fixed parsing of Defined values in the Apache plugin to allow for = in the value.

Fixed a relatively harmless crash when issuing a certificate with --quiet/-q.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.74 MB)
v1.18.0(Aug 3, 2021)
Added

New functions that Certbot plugins can use to interact with the user have been added to certbot.display.util. We plan to deprecate using IDisplay with zope in favor of these new functions in the future.

The Plugin, Authenticator and Installer classes are added to certbot.interfaces module as alternatives to Certbot's current zope based plugin interfaces. The API of these interfaces is identical, but they are based on Python's abc module instead of zope. Certbot will continue to detect plugins that implement either interface, but we plan to drop support for zope based interfaces in a future version of Certbot.

The class certbot.configuration.NamespaceConfig is added to the Certbot's public API.

Changed

When self-validating HTTP-01 challenges using acme.challenges.HTTP01Response.simple_verify, we now assume that the response is composed of only ASCII characters. Previously we were relying on the default behavior of the requests library which tries to guess the encoding of the response which was error prone.

acme: the .client.Client and .client.BackwardsCompatibleClientV2 classes are now deprecated in favor of .client.ClientV2.

The certbot.tests.patch_get_utility* functions have been deprecated. Plugins should now patch certbot.display.util themselves in their tests or use certbot.tests.util.patch_display_util as a temporary workaround.

In order to simplify the transition to Certbot's new plugin interfaces, the classes Plugin and Installer in certbot.plugins.common module and certbot.plugins.dns_common.DNSAuthenticator now implement Certbot's new plugin interfaces. The Certbot plugins based on these classes are now automatically detected as implementing these interfaces.

We added a dependency on chardet to our acme library so that it will be used over charset_normalizer in newer versions of requests.

Fixed

The Apache authenticator no longer crashes with "Unable to insert label" when encountering a completely empty vhost. This issue affected Certbot 1.17.0.

Users of the Certbot snap on Debian 9 (Stretch) should no longer encounter an "access denied" error when installing DNS plugins.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.87 MB)
v1.17.0(Jul 6, 2021)
Added

Add Void Linux overrides for certbot-apache.

Changed

We changed how dependencies are specified between Certbot packages. For this and future releases, higher level Certbot components will require that lower level components are the same version or newer. More specifically, version X of the Certbot package will now always require acme>=X and version Y of a plugin package will always require acme>=Y and certbot=>Y. Specifying dependencies in this way simplifies testing and development.

The Apache authenticator now always configures virtual hosts which do not have an explicit ServerName. This should make it work more reliably with the default Apache configuration in Debian-based environments.

Fixed

When we increased the logging level on our nginx "Could not parse file" message, it caused a previously-existing inability to parse empty files to become more visible. We have now added the ability to correctly parse empty files, so that message should only show for more significant errors.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.84 MB)
v1.16.0(Jun 1, 2021)
Added

Changed

DNS plugins based on lexicon now require dns-lexicon >= v3.1.0

Use UTF-8 encoding for renewal configuration files

Windows installer now cleans up old Certbot dependency packages before installing the new ones to avoid version conflicts.

This release contains a substantial command-line UX overhaul, based on previous user research. The main goal was to streamline and clarify output. If you would like to see more verbose output, use the -v or -vv flags. UX improvements are an iterative process and the Certbot team welcomes constructive feedback.

Functions certbot.crypto_util.init_save_key and certbot.crypto_util.init_save_csr, whose behaviors rely on the global Certbot config singleton, are deprecated and will be removed in a future release. Please use certbot.crypto_util.generate_key and certbot.crypto_util.generate_csr instead.

Fixed

Fix TypeError due to incompatibility with lexicon >= v3.6.0

Installers (e.g. nginx, Apache) were being restarted unnecessarily after dry-run renewals.

Colors and bold text should properly render in all supported versions of Windows.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.80 MB)
v1.15.0(May 5, 2021)
Added

Changed

Fixed

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.80 MB)
v1.14.0(Apr 6, 2021)
Added

Changed

certbot-auto no longer checks for updates on any operating system.

The module acme.magic_typing is deprecated and will be removed in a future release. Please use the built-in module typing instead.

The DigitalOcean plugin now creates TXT records for the DNS-01 challenge with a lower 30s TTL.

Fixed

Don't output an empty line for a hidden certificate when certbot certificates is being used in combination with --cert-name or -d.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.81 MB)
v1.13.0(Mar 3, 2021)
Added

Changed

CLI flags --os-packages-only, --no-self-upgrade, --no-bootstrap and --no-permissions-check, which are related to certbot-auto, are deprecated and will be removed in a future release.

Certbot no longer conditionally depends on an external mock module. Certbot's test API will continue to use it if it is available for backwards compatibility, however, this behavior has been deprecated and will be removed in a future release.

The acme library no longer depends on the security extras from requests which was needed to support SNI in TLS requests when using old versions of Python 2.

Certbot and all of its components no longer depend on the library six.

The update of certbot-auto itself is now disabled on all RHEL-like systems.

When revoking a certificate by --cert-name, it is no longer necessary to specify the --server if the certificate was obtained from a non-default ACME server.

The nginx authenticator now configures all matching HTTP and HTTPS vhosts for the HTTP-01 challenge. It is now compatible with external HTTPS redirection by a CDN or load balancer.

Fixed

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.58 MB)
v1.12.0(Feb 2, 2021)
Added

Changed

The --preferred-chain flag now only checks the Issuer Common Name of the topmost (closest to the root) certificate in the chain, instead of checking every certificate in the chain. See #8577.

Support for Python 2 has been removed.

In previous releases, we caused certbot-auto to stop updating its Certbot installation. In this release, we are beginning to disable updates to the certbot-auto script itself. This release includes Amazon Linux users, and all other systems that are not based on Debian or RHEL. We plan to make this change to the certbot-auto script for all users in the coming months.

Fixed

Fixed the apache component on openSUSE Tumbleweed which no longer provides an apache2ctl symlink and uses apachectl instead.

Fixed a typo in certbot/crypto_util.py causing an error upon attempting secp521r1 key generation More details about these changes can be found on our GitHub repo.

Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.52 MB)
v1.11.0(Jan 5, 2021)
Added

Changed

We deprecated support for Python 2 in Certbot and its ACME library. Support for Python 2 will be removed in the next planned release of Certbot.

certbot-auto was deprecated on all systems. For more information about this change, see https://community.letsencrypt.org/t/certbot-auto-no-longer-works-on-debian-based-systems/139702/7.

We deprecated support for Apache 2.2 in the certbot-apache plugin and it will be removed in a future release of Certbot.

Fixed

The Certbot snap no longer loads packages installed via pip install --user. This was unintended and DNS plugins should be installed via snap instead.

certbot-dns-google would sometimes crash with HTTP 409/412 errors when used with very large zones. See #6036.

certbot-dns-google would sometimes crash with an HTTP 412 error if preexisting records had an unexpected TTL, i.e.: different than Certbot's default TTL for this plugin. See #8551.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.05 MB)
v1.10.1(Dec 3, 2020)
Fixed

Fixed a bug in certbot.util.add_deprecated_argument that caused the deprecated --manual-public-ip-logging-ok flag to crash Certbot in some scenarios.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.21 MB)
v1.10.0(Dec 1, 2020)
Added

Added timeout to DNS query function calls for dns-rfc2136 plugin.

Confirmation when deleting certificates

CLI flag --key-type has been added to specify 'rsa' or 'ecdsa' (default 'rsa').

CLI flag --elliptic-curve has been added which takes an NIST/SECG elliptic curve. Any of secp256r1, secp284r1 and secp521r1 are accepted values.

The command certbot certficates lists the which type of the private key that was used for the private key.

Support for Python 3.9 was added to Certbot and all of its components.

Changed

certbot-auto was deprecated on Debian based systems.

CLI flag --manual-public-ip-logging-ok is now a no-op, generates a deprecation warning, and will be removed in a future release.

Fixed

Fixed a Unicode-related crash in the nginx plugin when running under Python 2.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.21 MB)
v1.9.0(Oct 7, 2020)
Added

--preconfigured-renewal flag, for packager use only. See the packaging guide.

Changed

certbot-auto was deprecated on all systems except for those based on Debian or RHEL.

Update the packaging instructions to promote usage of python -m pytest to test Certbot instead of the deprecated python setup.py test setuptools approach.

Reduced CLI logging when reloading nginx, if it is not running.

Reduced CLI logging when handling some kinds of errors.

Fixed

Fixed server_name case-sensitivity in the nginx plugin.

The minimum version of the acme library required by Certbot was corrected. In the previous release, Certbot said it required acme>=1.6.0 when it actually required acme>=1.8.0 to properly support removing contact information from an ACME account.

Upgraded the version of httplib2 used in our snaps and Docker images to add support for proxy environment variables and fix the plugin for Google Cloud DNS.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.21 MB)
v1.8.0(Sep 8, 2020)
Added

Added the ability to remove email and phone contact information from an account using update_account --register-unsafely-without-email

Changed

Support for Python 3.5 has been removed.

Fixed

The problem causing the Apache plugin in the Certbot snap on ARM systems to fail to load the Augeas library it depends on has been fixed.

The acme library can now tell the ACME server to clear contact information by passing an empty tuple to the contact field of a Registration message.

Fixed the *** stack smashing detected *** error in the Certbot snap on some systems.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.20 MB)
v1.7.0(Aug 4, 2020)
Added

Third-party plugins can be used without prefix (plugin_name instead of dist_name:plugin_name): this concerns the plugin name, CLI flags, and keys in credential files. The prefixed form is still supported but is deprecated, and will be removed in a future release.

Added --nginx-sleep-seconds (default 1) for environments where nginx takes a long time to reload.

Changed

The Linode DNS plugin now waits 120 seconds for DNS propagation, instead of 1200, due to https://www.linode.com/blog/linode/linode-turns-17/

We deprecated support for Python 3.5 in Certbot and its ACME library. Support for Python 3.5 will be removed in the next major release of Certbot.

More details about these changes can be found on our GitHub repo.
Source code(tar.gz)
Source code(zip)
certbot-beta-installer-win32.exe(16.21 MB)