LoginSign Up
← Back to all sparks
C

Certbot

INFRA · APIS
Velocity2.5

Automated client for obtaining and renewing Let's Encrypt certificates

certbot.eff.org ↗

Certbot is rebuilding its API around identifiers so certificates aren't only for domain names.

tlscertificatesacmeapi-refactorpackaginglets-encrypt
◆Current state
Certbot is on a roughly monthly minor cadence and the defining change in this window is IP address certificate support. 5.3.0 added the --ip-address flag for the standalone and manual plugins and began renaming the API's domain concept to identifier; 5.4.0 extended IP issuance to the webroot plugin. The other visible work is structural: the nginx and apache plugin code moved into the certbot package as extras, the pyOpenSSL dependency is being unwound through a series of deprecations, and certbot.ocsp is scheduled for removal from the public API.
◆Where it's heading
The identifier rename is the tell — Certbot's data model assumed a certificate subject was a domain name, and IP address issuance forced that assumption out of the type system. Expect that refactor to continue reaching further into the plugin API, since get_chall_pref has already changed signature. In parallel the project is shedding dependencies and consolidating packaging: plugins as extras rather than separate distributions, pyOpenSSL functions deprecated batch by batch, and Docker images tracking new Python versions promptly. The releases have become small and predictable, with most content in the Changed and Fixed sections rather than Added.
◆Prediction
Expect IP address support to reach the remaining plugins, following standalone and manual then webroot, and expect the pyOpenSSL removal to land as a major version once the deprecation cycle completes. Given 5.5.0 already deprecated certbot.ocsp for removal in the next major, that release is the one to watch for breaking changes.

◆Recent moves

  1. 18d ago

    5.7.0 fixes nginx parsing of comments inside multi-line directives

    A single-line release fixing nginx configuration parsing when comments appear between the tokens of a multi-line directive. Typical of the small, narrowly-scoped releases this project has settled into between structural changes.

    View source ↗
  2. 2mo ago

    5.6.0 bumps dependency floors and rebases Docker on Python 3.14

    Raises minimum versions for distro and the Cloudflare library, fixes the OVH DNS plugin leaving TXT records behind by requiring a newer dns-lexicon, and moves Docker images to Python 3.14 and Alpine 3.23. Maintenance, though the OVH fix matters to anyone whose zone was accumulating stale challenge records.

    View source ↗
  3. 4mo ago

    5.5.0 folds the nginx and apache plugins into certbot extras

    Moves nearly all nginx and apache plugin code into private modules of the certbot package, exposed as extras, with the old distributions surviving as thin registration shims. Also deprecates certbot.ocsp from the public API ahead of removal in the next major, part of the ongoing dependency and surface reduction.

    View source ↗
  4. 5mo ago

    5.4.0 extends IP address issuance to the webroot plugin

    Brings IP address certificates to webroot, after 5.3.0 delivered them for standalone and manual. The plugin-by-plugin rollout is the practical consequence of the identifier refactor working its way through the codebase.

    View source ↗
  5. 6mo ago

    5.3.1 rebuilds snaps with updated dependencies

    A packaging-only release rebuilding the snaps to pick up updated dependency versions. No user-facing change beyond what those dependencies carry.

    View source ↗
  6. 6mo ago

    Certbot adds IP address certificates and an identifier-based API

    ⚡ SPARK

    The release that breaks Certbot's domain-only assumption: --ip-address requests certificates with IP SANs, and the API starts replacing the domain field with a typed identifier across challenges and authenticator interfaces. The webroot support in 5.4.0 and the continuing refactor both descend from this.

    View source ↗