certbot-dns-cloudflare

What it is and what it does

This package is a Certbot plugin that integrates Cloudflare DNS management into the Let's Encrypt certificate issuance workflow. Instead of proving domain control through HTTP challenges, it uses DNS validation by automatically creating and removing DNS records in your Cloudflare account. This is particularly useful for wildcard certificates, internal domains, or environments where HTTP access is restricted.

The plugin sits between Certbot and the Cloudflare API, handling the credential management and record lifecycle during certificate renewal. You configure it once with your Cloudflare API credentials, then Certbot can fully automate certificate issuance and renewal without manual DNS record manipulation. It depends on the cloudflare and acme libraries to communicate with Cloudflare's API and implement the ACME protocol.

Use it for:

• Obtain wildcard certificates for *.example.com without exposing your web server to the internet.
• Automate certificate renewal for internal or non-HTTP-accessible services behind firewalls.
• Manage certificates for multiple subdomains with a single Cloudflare account and Certbot configuration.
• Deploy HTTPS to applications where you control DNS but not the web server directly.
• Integrate certificate lifecycle management into infrastructure-as-code or containerized deployments.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Automates DNS validation for Let's Encrypt certificate issuance by managing Cloudflare DNS records through Certbot's plugin system.

Yes. This is a stable, actively maintained plugin for a critical infrastructure task (TLS certificate automation). It has no known vulnerabilities, low installation friction, and permissive licensing. Install it if you use Cloudflare for DNS and want to automate Let's Encrypt certificate issuance via DNS validation; skip it only if you use a different DNS provider or prefer HTTP-based validation.

Install

certbot-dns-cloudflare on PyPI

pip install certbot-dns-cloudflare

uv add certbot-dns-cloudflare

poetry add certbot-dns-cloudflare

Installing certbot-dns-cloudflare

Before you install

Low friction installation as a pure Python wheel with three runtime dependencies (cloudflare, acme, certbot). Actively maintained with a release 30 days ago and recent commits; part of the well-established Certbot project with 33201 repository stars.

License in practice

Apache-2.0 permissive license allows use in commercial and private projects with minimal restrictions; you must retain license notices but can modify and distribute freely.

Quickstart

pip install certbot-dns-cloudflare

# In Certbot command:
certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.cloudflare.ini -d example.com

Requires Python >=3.10; Cloudflare API credentials must be configured in a credentials file before use.

Verify before relying

• Whether the plugin supports Cloudflare API token rotation or only static credential files.
• Performance characteristics when validating multiple domains or wildcard certificates simultaneously.
• Specific error handling and retry behavior for transient Cloudflare API failures.

Package facts

Evidence: certbot_dns_cloudflare-5.7.0-py3-none-any.whl

Tags

More WWW/HTTP packages

Further reading