certbot: the Let’s Encrypt client

The EFF's ACME client that obtains free TLS certificates from Let's Encrypt, can configure nginx and Apache for HTTPS automatically and renews everything on a timer.

Works onLinux

Drafted with AI from official documentation. Scripts were run in a test environment and repository links verified. Awaiting a human check. Did it work for you? Last edited 15 Oct 2026 Outdated?

Edit history · 1 edit

Type: Repo
Edits: 1
Editors: 1
First issued: 15 Oct 2026
Last edit: 15 Oct 2026
Source: certbot/certbot

certbot/certbot

Stars: 33.3k
Forks: 3.5k
Language: Python
Licence: NOASSERTION
Last push: 15 Oct 2026

On GitHub: Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.

Open on GitHub

certbot (about 33,300 stars on GitHub) is the reference client for the ACME protocol that Let’s Encrypt and other certificate authorities use. It proves you control a domain (over HTTP on port 80, or by creating a DNS record through one of its DNS plugins), stores certificates under /etc/letsencrypt/, and installs a timer that renews them. The --nginx and --apache plugins also edit the web server configuration and reload it, so a site goes from HTTP to HTTPS with one command.

When to use it

Any public web server, mail server or reverse proxy that needs a certificate browsers trust.
Wildcard certificates and hosts without port 80, through a DNS plugin for your provider.
Internal services that are not reachable from the internet are the exception: there you need either DNS validation for a public name or your own CA.

How to install it

The project recommends the snap, which is identical on every distribution and updates itself:

Check before you run this

Runs with administrator rights. Make sure you understand every line.

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

The instructions page on certbot.eff.org generates the exact steps for your web server and operating system, including the DNS plugin variants. The how-to in this topic walks through a first certificate, the file paths and renewal hooks. Alternatives from the same ecosystem, if a dependency-free client suits you better, are acme.sh (shell) and lego (Go); Caddy and Traefik have ACME built in.

Credit

certbot is developed by the Electronic Frontier Foundation and contributors and released under the Apache-2.0 license. Let’s Encrypt is operated by the Internet Security Research Group (ISRG).

Did this work for you?

No votes yet. Be the first.

If it did not work, the report form below tells the editors what went wrong.

History

Every saved edit is kept. The plot on the sleeve draws one line per edit. Open any edit to see exactly what changed.

15 Oct 2026 Dominik +1,734 chars

Report a problem

Something wrong, unsafe or copied? Tell the editors.