LoginSign Up
← Back to all sparks
C

Certbot

INFRA · APIS
Velocity2.5

Automated client for obtaining and renewing Let's Encrypt certificates

certbot.eff.org ↗

Certbot is consolidating its plugin architecture and quietly expanding into IP address certificate support.

tlscertificatesssldevtoolsopen-sourcesecurity
◆Current state
Certbot is in a steady maintenance and architectural consolidation phase. The nginx and apache plugins have been moved into the core certbot package as private modules (certbot-apache and certbot-nginx now exist primarily to register the plugin), the OCSP module is deprecated, and pyOpenSSL dependencies are being systematically removed in favor of the cryptography library. Version 5.8.0 bumped the cryptography floor to >=47.0.0 and fixed a bug where removed domains were omitted from renewal confirmation prompts — a correctness issue for users who remove SANs from existing certificates.
◆Where it's heading
The architectural direction is a leaner, more self-contained core with fewer external dependencies. The IP address issuance capability added across the 5.3-5.4 cycle reflects Let's Encrypt's expanding IP certificate program — Certbot is tracking the CA's capabilities rather than driving its own feature agenda. The pyOpenSSL removal, when complete, will eliminate a long-standing external dependency that complicated builds and tested certification paths.
◆Prediction
pyOpenSSL removal will complete in a future major release. IP address certificate workflows will mature as Let's Encrypt's IP cert program broadens. The certbot-nginx/certbot-apache split (now thin wrappers over the core package) may eventually collapse entirely.

◆Recent moves

  1. 14d ago

    Certbot 5.8.0

    5.8.0 bumps the cryptography library minimum to >=47.0.0 and fixes a prompt bug where removed domains were not shown in the renewal confirmation dialogue. The library floor bump is part of the ongoing pyOpenSSL dependency removal — raising the cryptography floor ensures a consistent underlying implementation.

    View source ↗
  2. 1mo ago

    Certbot 5.7.0

    Fixes nginx configuration parsing when comments appear between tokens of a multi-line directive — an edge case that would silently break parsing for users with commented-out nginx config sections.

    View source ↗
  3. 4mo ago

    Certbot 5.6.0

    5.6.0 updates the OVH DNS plugin to properly delete TXT challenge records after validation (via dns-lexicon 3.25.1), updates Docker images to Python 3.14 and Alpine 3.23, and raises the distro and cloudflare library floors. Routine dependency maintenance that keeps Certbot current with its plugin ecosystem.

    View source ↗
  4. 5mo ago

    Certbot 5.5.0

    5.5.0 moves nearly all nginx and apache plugin code into private modules within the core certbot package — the split packages now exist solely to register the plugins. This is the consolidation step that simplifies Certbot's distribution, test maintenance, and future refactoring. The public OCSP module deprecation also removes a surface that was duplicating capabilities already available via the cryptography library.

    View source ↗
  5. 6mo ago

    Certbot 5.4.0

    5.4.0 adds IP address issuance support to the webroot plugin, following the --ip-address flag added in 5.3.0. Certbot's IP certificate support is now broadly available across its core authentication methods, aligning with Let's Encrypt's expanded IP certificate program.

    View source ↗
  6. 7mo ago

    Certbot 5.3.1

    Snap rebuild with updated dependencies — no functional changes, routine maintenance for the snap distribution channel.

    View source ↗