Certbot

Certbot is the Electronic Frontier Foundation’s free, open-source command-line tool for obtaining and managing TLS/SSL certificates from Let’s Encrypt and any other certificate authority that speaks the ACME protocol. It automates the entire certificate lifecycle: proving domain control, fetching certificates, and optionally reconfiguring web servers to enable HTTPS.

Certbot ships with plugins for Apache and Nginx that can automatically install certificates and edit server configuration, plus a large family of DNS plugins for cloud providers to solve DNS-01 challenges for wildcard and headless certificates. Automated renewal keeps certificates valid without manual intervention, making it the de facto standard tool for deploying HTTPS across the web.

What You Get

• A CLI that obtains, installs, and renews TLS certificates from Let’s Encrypt and other ACME CAs
• Apache and Nginx plugins that install certificates and edit server config to enable HTTPS
• A broad set of DNS plugins (Cloudflare, Route 53, Google, DigitalOcean, and more) for DNS-01 challenges
• Automated, unattended certificate renewal with hooks for custom deploy actions

Common Use Cases

• Enabling HTTPS on a web server with automatically installed certificates
• Issuing wildcard certificates via DNS-01 challenges through a provider plugin
• Automatically renewing certificates on a schedule to avoid expiry outages
• Acting as a general ACME client for any compatible certificate authority

Under The Hood

Architecture - Certbot is a Python monorepo: the core certbot package (certbot/src) implements the CLI, renewal engine, account and certificate lifecycle, and a plugin interface; the acme package provides a standalone ACME protocol client; and installer/authenticator plugins live in sibling packages (certbot-nginx, certbot-apache, and a large certbot-dns-* family) that are discovered via entry points, cleanly separating challenge-solving from server configuration. Tech Stack - Written almost entirely in Python (94%) with pyproject/setup-based packaging per subpackage, distributed on PyPI and also as an OS snap; supporting Shell, Makefile, and Batchfile scripts drive builds and cross-platform installers, and tooling includes tox, pytest, ruff, and mypy. Code Quality - This is a mature, heavily reviewed codebase with 550+ contributors, consistent CI, type checking (mypy.ini), linting (ruff.toml), a large test suite, and a disciplined release process using towncrier newsfragments and a maintained changelog. API Design - As a tool, its interface is the certbot command with subcommands and plugin flags; the developer experience emphasizes sensible defaults and interactive prompts for first-time users while exposing fine-grained flags and hooks for automation, and the separate acme library offers a clean programmatic API for building ACME clients.