Credential access
Reads account keys, private keys, webroot paths, and DNS provider credentials.
brew
Install certbot with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, winget, zypper
Tool to obtain certs from Let's Encrypt and autoenable HTTPS. Version 5.6.0 via Homebrew; verified 2026-05-20.
agent safety
Agent safety answer
certbot manages TLS certificates and can change web-server certificate state.
Remote mutation
Can request certificates and modify local server config or DNS plugins.
Publish/artifact risk
Can create certificates used by public services.
Recommended control
Gate renew, certonly, private-key reads, and DNS credential use.
Agent-use guidance
Allow certificate status checks; require approval before issuing, renewing, or editing live certs.
install
Additional install commands
macOS
Homebrewverified · 100%
brew install certbotlocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install certbotMacPorts ports tree · security/certbot/Portfile · source: api.github.com
Linux
Alpine Linux apkverified · 92%
sudo apk add certbotAlpine Linux edge package indexes · certbot · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install certbotDebian stable package indexes · certbot · source: deb.debian.org
Fedora dnfverified · 92%
sudo dnf install certbotFedora Rawhide package metadata · certbot · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#certbotnixpkgs package indexes · pkgs/by-name/ce/certbot/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S certbotArch Linux sync databases · certbot · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install python311-certbotopenSUSE Tumbleweed package metadata · python311-certbot · source: download.opensuse.org
Windows
Windows Package Managerverified · 92%
winget install --id EFF.Certbot -eWindows Package Manager source index · EFF.Certbot · source: cdn.winget.microsoft.com
overview
Package summary
Tool to obtain certs from Let's Encrypt and autoenable HTTPS
Project links
Commands and aliases
- certbot
history
Project history and usage
Certbot is EFF's ACME client for obtaining and renewing HTTPS certificates, most commonly from Let's Encrypt, and optionally configuring web servers such as Apache and nginx.
Project history
The repository was created in 2014 during the early Let's Encrypt client era. In 2016, EFF announced the client would move under the Certbot name to distinguish the client from the Let's Encrypt certificate authority and ISRG organization.
Adoption history
Certbot rode the same adoption wave as Let's Encrypt: EFF's 2016 announcement noted Let's Encrypt had issued its three millionth certificate, and EFF later reported Certbot installed on more than 4 million web servers maintaining certificates for more than 31 million websites.
How it is used
Certbot is intended to run on the server that hosts the site. It obtains certificates, saves them under /etc/letsencrypt/live, renews them on a schedule, and can use plugins for Apache, nginx, webroot, standalone, manual, and DNS-based validation.
Why package nerds care
Certbot is one of the canonical examples of a security CLI becoming distribution infrastructure: it appears in many package managers, replaced the older letsencrypt command name in user documentation, deprecated certbot-auto, and standardized operational files under /etc/letsencrypt.
Timeline
- 2014: Public certbot/certbot repository created.
- 2016: EFF announced the Let's Encrypt client rename to Certbot and the new certbot.eff.org site.
- 2025: Certbot 5.0.0 released, removing older deprecated APIs and Python 3.9 support.
- 2026: Certbot 5.6.0 released according to the official changelog.
Related projects
- Let's Encrypt is the default certificate authority commonly used with Certbot.
- ACME is the protocol Certbot speaks, standardized as RFC 8555.
- certbot-apache, certbot-nginx, and Certbot DNS plugins provide authenticator and installer integrations.
Sources
- https://api.github.com/repos/certbot/certbot
- https://github.com/certbot/certbot
- https://certbot.eff.org/
- https://certbot.eff.org/docs
- https://www.eff.org/deeplinks/2016/05/announcing-certbot-new-tls-robot
- https://www.eff.org/deeplinks/2024/03/should-caddy-and-traefik-replace-certbot
- https://github.com/certbot/certbot/blob/main/certbot/CHANGELOG.md
- https://formulae.brew.sh/api/formula/certbot.json
security posture
No protected-tool coverage found yet
No matching local secret-handling manifest was found for certbot. Nucleus package metadata is still published here so future coverage has a stable package URL.
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Installs with 6 runtime dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Credential files
Credential-bearing paths to review before unattended agent runs.
- macOS
~/Library/Application Support/letsencrypt- Unix
~/.config/letsencrypt~/.letsencrypt
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
certbot | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version5.6.0
manager updated2026-05-20
local dataok
upstreamnot checked
latest detectednot detected
- infoRelease/tag comparison is only available for GitHub repositories.https://certbot.eff.org/none confidence
install metadata
Package metadata
| Package key | brew:certbot |
|---|---|
| Version | 5.6.0 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/certbot |
| Homepage | https://certbot.eff.org/ |
| Repository | https://github.com/certbot/certbot |
| Upstream docs | https://certbot.eff.org/docs |
| License | Apache-2.0 |
| Source archive | https://files.pythonhosted.org/packages/4b/c0/838942a6c5fb07e42fdf48a5cc306214fd118c98dae673f1fb0b2d1f88ef/certbot-5.6.0.tar.gz |
| Last updated | 2026-05-20T11:26:15Z |
| Pulse | updated |
| Dependencies | augeas, certifi, cryptography, libyaml, pydantic, python@3.14 |
| Uses from macOS | libffi |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | certbot |
| Version Scheme | 0 |
| Revision | 1 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
certbot 4.0.0-2+deb13u1
automatically configure HTTPS using Let's Encrypt
sudo apt install certbot- Section: web
- Architecture: all
- Source Package: python-certbot
- 4 dependencies
- 1 provides
- 3 optional deps
- normalized package name match
- Matched by: Certbot
Nix95%
certbot
nix profile install nixpkgs#certbot- normalized package name match
- Matched by: Certbot
Ubuntu apt95%
certbot 2.9.0-1
automatically configure HTTPS using Let's Encrypt
sudo apt install certbot- Section: universe/web
- Architecture: all
- Source Package: python-certbot
- 4 dependencies
- 1 provides
- 3 optional deps
- normalized package name match
- Matched by: Certbot
apk95%
certbot 5.6.0-r0
An ACME client that can update Apache/Nginx configurations
https://github.com/certbot/certbot
sudo apk add certbot- License: Apache-2.0
- Architecture: x86_64
- Source Package: certbot
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Certbot
apk95%
certbot-pyc 5.6.0-r0
Precompiled Python bytecode for certbot
https://github.com/certbot/certbot
sudo apk add certbot-pyc- License: Apache-2.0
- Architecture: x86_64
- Source Package: certbot
- 1 dependencies
- normalized package name match
- Matched by: Certbot
dnf95%
certbot 5.6.0-1.fc45
A free, automated certificate authority client
https://github.com/certbot/certbot
sudo dnf install certbot- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 5 dependencies
- 3 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-acme-doc 5.6.0-1.fc45
Documenation for python-acme-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-acme-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-cloudflare-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-cloudflare-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-cloudflare-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-digitalocean-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-digitalocean-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-digitalocean-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-dnsimple-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-dnsimple-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-dnsimple-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-dnsmadeeasy-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-dnsmadeeasy-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-dnsmadeeasy-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-gehirn-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-gehirn-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-gehirn-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-google-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-google-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-google-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-linode-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-linode-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-linode-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-luadns-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-luadns-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-luadns-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
dnf95%
python-certbot-dns-nsone-doc 5.6.0-1.fc45
Documenation for python-certbot-dns-nsone-doc libraries
https://github.com/certbot/certbot
sudo dnf install python-certbot-dns-nsone-doc- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: certbot
- 1 provides
- normalized package name match
- Matched by: Certbot
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated agent safety answer
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment