# Certbot Hacker Approved page: https://hackerapproved.com/p/certbot/ 21 people recommended Certbot in Hacker News comments, 2 had mixed feelings and 18 criticized it, November 2025 to October 2026. It was recommended in 8 of 12 months, in 16 threads. It does not meet the Hacker Approved badge rule. **Verdict:** People recommend Certbot as free, stable software that automatically renews Let's Encrypt TLS certificates with little setup. Critics often complain about its snap-first installation and its lack of CNAME delegation support. Summary written by Claude from 39 comments. ## Why people recommend it - Stable and low maintenance for years (5 comments in the sample): "It'll automatically renew your certs. Very easy to set up and it's been stable for years without touching it." ([source](https://news.ycombinator.com/item?id=48514537)) "Both have been extremely low setup effort and no ongoing effort." ([source](https://news.ycombinator.com/item?id=46108823)) "it's been humming along for me for years at this point" ([source](https://news.ycombinator.com/item?id=47515546)) - Free, widely used ACME client (4 comments in the sample): "developers of certbot, which massively improved the toolchain around certificate deployment" ([source](https://news.ycombinator.com/item?id=46215914)) "boosted the popularity of automated certificate management tools (such as certbot" ([source](https://news.ycombinator.com/item?id=46132110)) "just running a regular, well-defined (and free!) acme client" ([source](https://news.ycombinator.com/item?id=47145572)) - Automatic certificate renewal (3 comments in the sample): "TLS certificates get auto-renewed with letsencrypt every 3 months via certbot." ([source](https://news.ycombinator.com/item?id=47700732)) "Getting certbot up and running wasn't hard, automating renewal wasn't hard" ([source](https://news.ycombinator.com/item?id=46209932)) "You can schedule cert renewal and it happens automatically." ([source](https://news.ycombinator.com/item?id=47492964)) - Easy setup with little effort (1 comment in the sample): "just have to install certbot" ([source](https://news.ycombinator.com/item?id=48571551)) ## What people warn about - Frustrating, low-quality software (5 comments in the sample): "Certbot doesn't support the industry standard PKCS#12 format, which makes it extremely brittle for anyone using a Java based webserver." ([source](https://news.ycombinator.com/item?id=46119269)) "Certbot has earned my ire on just about every occasion I've had to interact with it." ([source](https://news.ycombinator.com/item?id=47513386)) "LE software is pretty low quality, I've had multiple issues over the years" ([source](https://news.ycombinator.com/item?id=46282260)) - Unmonitored automatic renewal feels risky (4 comments in the sample): "This news seems to indicate that I get to babysit certbot even more frequently in the future." ([source](https://news.ycombinator.com/item?id=46281046)) "Not sure I'd want software like that running unmonitored automatically with root privileges." ([source](https://news.ycombinator.com/item?id=47144056)) "I don't want some magical auto update thing" ([source](https://news.ycombinator.com/item?id=46114962)) - No CNAME delegation support (3 comments in the sample): "Certbot doesn't support CNAME for DNS-01 or at least didn't. I was always a fan of Certbot" ([source](https://news.ycombinator.com/item?id=47550715)) "My experience has been that CertBot doesn't play well with CNAME delegation" ([source](https://news.ycombinator.com/item?id=47547119)) "Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME." ([source](https://news.ycombinator.com/item?id=47472797)) - Snap-only installation channel (3 comments in the sample): "it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel" ([source](https://news.ycombinator.com/item?id=47475657)) "I can't believe the default ACME client is a snap" ([source](https://news.ycombinator.com/item?id=50154489)) "you don't have to worry about the RHEL certbot snap updating to a broken version which gets blocked by SELinux" ([source](https://news.ycombinator.com/item?id=48853302)) ## What people recommend instead - [acme.sh](https://hackerapproved.com/p/acme-sh/): 12 recommend, 1 mixed, 2 criticize ## The badge A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged. ## Cite as Hacker Approved, "Certbot", https://hackerapproved.com/p/certbot/ (21 recommend, 2 mixed, 18 criticize; Hacker News comments, November 2025 to October 2026). Counts updated 2 Nov 2026, with data through October 31, 2026.