LoginSign Up
← Back to all sparks
C

Certbot

INFRA · APIS
Velocity5.0

Automated client for obtaining and renewing Let's Encrypt certificates

certbot.eff.org ↗

Certbot 5.10 closes a webroot race that could change the wrong file's permissions.

tlscertificatesacmerenewalsecurity-fixes
◆Current state
Certbot 5.10.0 fixes a race in the webroot plugin: if a less privileged user could modify the webroot while Certbot ran, Certbot could change the ownership and mode of an unintended file. It also rejects ARI renewal windows whose end is not after their start. 5.9.0 in October fixed renewal hooks being told failed SANs had renewed.
◆Where it's heading
Certbot is in maintenance mode, with monthly releases focused on correctness and safety around renewals. The last feature step was IP address certificates in 5.3 and 5.4; since then the work has been consolidation and fixes.
◆Prediction
More small releases around renewals, ARI handling and plugin safety are likely; the entries show no new feature direction.

◆Recent moves

  1. 3d ago

    Certbot 5.10.0

    Fixes a webroot race where a less privileged user could make Certbot change permissions on the wrong file, and rejects invalid ARI renewal windows. Another safety and correctness release in the 5.x maintenance run.

    View source ↗
  2. 16d ago

    Certbot 5.9.0

    Renewal hooks no longer receive failed SANs as successfully renewed, and account deactivation confirms the right account. A correctness fix that matters for anyone automating on hook output.

    View source ↗
  3. 2mo ago

    Certbot 5.8.0

    5.8.0 bumps the cryptography library minimum to >=47.0.0 and fixes a prompt bug where removed domains were not shown in the renewal confirmation dialogue. The library floor bump is part of the ongoing pyOpenSSL dependency removal — raising the cryptography floor ensures a consistent underlying implementation.

    View source ↗
  4. 3mo ago

    Certbot 5.7.0

    Fixes nginx configuration parsing when comments appear between tokens of a multi-line directive — an edge case that would silently break parsing for users with commented-out nginx config sections.

    View source ↗
  5. 6mo ago

    Certbot 5.6.0

    5.6.0 updates the OVH DNS plugin to properly delete TXT challenge records after validation (via dns-lexicon 3.25.1), updates Docker images to Python 3.14 and Alpine 3.23, and raises the distro and cloudflare library floors. Routine dependency maintenance that keeps Certbot current with its plugin ecosystem.

    View source ↗
  6. 7mo ago

    Certbot 5.5.0

    5.5.0 moves nearly all nginx and apache plugin code into private modules within the core certbot package — the split packages now exist solely to register the plugins. This is the consolidation step that simplifies Certbot's distribution, test maintenance, and future refactoring. The public OCSP module deprecation also removes a surface that was duplicating capabilities already available via the cryptography library.

    View source ↗