LoginSign Up
← Back to all sparks
C

Certbot

INFRA · APIS
Velocity2.5

Automated client for obtaining and renewing Let's Encrypt certificates

certbot.eff.org ↗

Certbot keeps tidying correctness bugs around renewals and hooks

tlscertificatesacmemaintenancerenewal-hooks
◆Current state
Certbot is in maintenance and consolidation. 5.9.0 fixes a bug where failed SANs were sometimes reported to renewal hooks as renewed, picks the account to deactivate before asking for confirmation, and labels its Docker images for tools like Renovate. Earlier releases moved the nginx and apache plugin code into the core package, raised the cryptography floor, and added IP address certificates in 5.3.0.
◆Where it's heading
Recent work is about correctness in renewal reporting and prompts rather than new capability. The IP-address support from early 2026 remains the last directional change in the feed.
◆Prediction
Expect further monthly-to-bimonthly maintenance releases; the entries do not show new capability work.

◆Recent moves

  1. 12d ago

    Certbot 5.9.0

    Renewal hooks no longer receive failed SANs as successfully renewed, and account deactivation confirms the right account. A correctness fix that matters for anyone automating on hook output.

    View source ↗
  2. 2mo ago

    Certbot 5.8.0

    5.8.0 bumps the cryptography library minimum to >=47.0.0 and fixes a prompt bug where removed domains were not shown in the renewal confirmation dialogue. The library floor bump is part of the ongoing pyOpenSSL dependency removal — raising the cryptography floor ensures a consistent underlying implementation.

    View source ↗
  3. 3mo ago

    Certbot 5.7.0

    Fixes nginx configuration parsing when comments appear between tokens of a multi-line directive — an edge case that would silently break parsing for users with commented-out nginx config sections.

    View source ↗
  4. 6mo ago

    Certbot 5.6.0

    5.6.0 updates the OVH DNS plugin to properly delete TXT challenge records after validation (via dns-lexicon 3.25.1), updates Docker images to Python 3.14 and Alpine 3.23, and raises the distro and cloudflare library floors. Routine dependency maintenance that keeps Certbot current with its plugin ecosystem.

    View source ↗
  5. 7mo ago

    Certbot 5.5.0

    5.5.0 moves nearly all nginx and apache plugin code into private modules within the core certbot package — the split packages now exist solely to register the plugins. This is the consolidation step that simplifies Certbot's distribution, test maintenance, and future refactoring. The public OCSP module deprecation also removes a surface that was duplicating capabilities already available via the cryptography library.

    View source ↗
  6. 8mo ago

    Certbot 5.4.0

    5.4.0 adds IP address issuance support to the webroot plugin, following the --ip-address flag added in 5.3.0. Certbot's IP certificate support is now broadly available across its core authentication methods, aligning with Let's Encrypt's expanded IP certificate program.

    View source ↗