---
id: certbot
version: "5.7.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# certbot — ACME client

License: permissive · Maintenance: active · Downloads: 696.6K/mo

## What it is and what it does

Certbot is an ACME client that automates the process of obtaining and deploying TLS certificates from Let's Encrypt, an open certificate authority. It runs on your web server and handles the full lifecycle: fetching domain-validated certificates, installing them on Apache, nginx, or other servers, and managing renewal. The tool is free and designed to eliminate the manual hassle of certificate management by automating validation, installation, and configuration changes.

The package depends on cryptographic libraries (cryptography, josepy), ACME protocol support (acme), and configuration tools (ConfigArgParse, configobj) to communicate with Let's Encrypt and manage server configuration. It supports multiple deployment modes including direct web server plugins, a standalone mode that runs its own validation server, and webroot mode for shared hosting. Configuration changes are logged and reversible, and the tool can optionally set up automatic HTTP-to-HTTPS redirects.

Use it for:

- Automate initial TLS certificate issuance and deployment on a Linux web server running Apache or nginx.
- Set up automatic certificate renewal to prevent expiration and downtime on production HTTPS sites.
- Obtain domain-validated certificates for multiple subdomains or domains in a single operation.
- Deploy certificates on shared hosting or restricted environments using webroot mode without direct server control.
- Revoke or replace certificates when needed as part of security incident response or certificate rotation.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Certbot is a command-line client that automatically obtains TLS certificates from Let's Encrypt and deploys them to web servers, handling certificate renewal and HTTPS configuration.

Yes. Certbot is production-stable, actively maintained, and widely used. It solves a critical operational need—automating TLS certificate lifecycle management—with no security vulnerabilities and permissive licensing. Install it if you operate a web server and need to manage HTTPS certificates.

## Install

pip install certbot
uv add certbot
poetry add certbot

## Installing certbot

Before you install: Low install friction with a pure Python wheel distribution. Actively maintained with a release 30 days ago and ongoing commits; the project has 33201 stars and supports current Python versions (3.10+).

License in practice: Licensed under Apache-2.0 (permissive), allowing use in commercial and private projects with minimal restrictions beyond attribution.

Quickstart:

pip install certbot
certbot certonly --webroot -w /var/www/html -d example.com

Requires root or administrator access to the web server and direct command-line access; cannot be run from a personal computer to manage a hosted service.

Verify before relying:

- Whether third-party plugins are included or must be installed separately.
- Performance characteristics when managing certificates for many domains.
- Exact compatibility scope beyond Apache 2.4+ and nginx/0.8.48+ mentioned in the description.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 696.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

let's encrypt certificate automation, tls certificate provisioning, acme client, https setup automation, certificate renewal management, web server ssl deployment, domain validation certificates, tls-automation, devops, security-infrastructure

[View on SkillFed](https://skillfed.io/packages/certbot) · [View on PyPI](https://pypi.org/project/certbot/)