Certbot
Acme client in Privacy & security
People recommend Certbot as free, stable software that automatically renews Let's Encrypt TLS certificates with little setup. Critics often complain about its snap-first installation and its lack of CNAME delegation support.
People recommend Certbot as free, stable software that automatically renews Let's Encrypt TLS certificates with little setup. Critics often complain about its snap-first installation and its lack of CNAME delegation support.
43 people gave an opinion
- recommend it
- 24
- criticize it
- 19
- approval share
- 56%
Recommended in 9 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Owned for 11 years
Median of the 3 owners who said how long they have had it.
Each square is one year.
Why it doesn’t carry the badge
- 24 people recommend itNeeds 10 or more, met.
- 1.2 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Stable and low maintenance for years
“It'll automatically renew your certs. Very easy to set up and it's been stable for years without touching it.”
Comment from 13 Jun 2026 in “Slightly reducing the sloppiness of AI generated front end” “Both have been extremely low setup effort and no ongoing effort.”
Comment from 1 Dec 2025 in ““Boobs check” – Technique to verify if sites behind CDN are hosted in Iran” “it's been humming along for me for years at this point”
Comment from 25 Mar 2026 in “You Can Run a DNS Server” - Comment from 24 Feb 2026 in “Manjaro website off-line again due to lapsed certificate”
- Comment from 25 Mar 2026 in “You Can Run a DNS Server”
Automatic certificate renewal
“It'll automatically renew your certs. Very easy to set up and it's been stable for years without touching it.”
Comment from 13 Jun 2026 in “Slightly reducing the sloppiness of AI generated front end” “TLS certificates get auto-renewed with letsencrypt every 3 months via certbot.”
Comment from 9 Apr 2026 in “We moved Railway's front end off Next.js. Builds went from 10 minutes to under 2” “Getting certbot up and running wasn't hard, automating renewal wasn't hard”
Comment from 9 Dec 2025 in “10 Years of Let's Encrypt” - Comment from 23 Mar 2026 in “Cyber.mil serving file downloads using TLS certificate which expired 3 days ago”
Free, widely used ACME client
“developers of certbot, which massively improved the toolchain around certificate deployment”
Comment from 10 Dec 2025 in “10 Years of Let's Encrypt” “boosted the popularity of automated certificate management tools (such as certbot)”
Comment from 3 Dec 2025 in “Acme, a history of one of the protocols which has changed the Internet Security” “just running a regular, well-defined (and free!) acme client”
Comment from 25 Feb 2026 in “Manjaro website off-line again due to lapsed certificate” - Comment from 23 Mar 2026 in “Cyber.mil serving file downloads using TLS certificate which expired 3 days ago”
Easy setup with little effort
“Getting certbot up and running wasn't hard, automating renewal wasn't hard”
Comment from 9 Dec 2025 in “10 Years of Let's Encrypt” “Both have been extremely low setup effort and no ongoing effort.”
Comment from 1 Dec 2025 in ““Boobs check” – Technique to verify if sites behind CDN are hosted in Iran” “just have to install certbot”
Comment from 17 Jun 2026 in “Ask HN: What has been bothering you lately?”
What people warn about
Each mark is one comment
Frustrating, low-quality software
“Certbot doesn't support the industry standard PKCS#12 format, which makes it extremely brittle for anyone using a Java based webserver.”
Comment from 2 Dec 2025 in “Decreasing Certificate Lifetimes to 45 Days” “Certbot has earned my ire on just about every occasion I've had to interact with it.”
Comment from 25 Mar 2026 in “You Can Run a DNS Server” “LE software is pretty low quality, I've had multiple issues over the years”
Comment from 15 Dec 2025 in “Upcoming Changes to Let's Encrypt Certificates” - Comment from 2 Dec 2025 in “Decreasing Certificate Lifetimes to 45 Days”
- Comment from 25 Mar 2026 in “You Can Run a DNS Server”
No CNAME delegation support
“Certbot doesn't support CNAME for DNS-01 or at least didn't. I was always a fan of Certbot”
Comment from 28 Mar 2026 in “Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot” “My experience has been that CertBot doesn't play well with CNAME delegation”
Comment from 27 Mar 2026 in “Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot” “Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME.”
Comment from 21 Mar 2026 in “You Can Run a DNS Server” Snap-only installation channel
“it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel”
Comment from 22 Mar 2026 in “You Can Run a DNS Server” “I can't believe the default ACME client is a snap”
Comment from 19 Oct 2026 in “Let's Encrypt is adding two additional remote perspectives for domain validation” “you don't have to worry about the RHEL certbot snap updating to a broken version which gets blocked by SELinux”
Comment from 9 Jul 2026 in “TLS certificates for internal services done right” Unmonitored automatic renewal feels risky
“This news seems to indicate that I get to babysit certbot even more frequently in the future.”
Comment from 15 Dec 2025 in “Upcoming Changes to Let's Encrypt Certificates” “Not sure I'd want software like that running unmonitored automatically with root privileges.”
Comment from 24 Feb 2026 in “Manjaro website off-line again due to lapsed certificate” “I don't want some magical auto update thing”
Comment from 1 Dec 2025 in ““Boobs check” – Technique to verify if sites behind CDN are hosted in Iran” - Comment from 31 Dec 2025 in “Privacy and control. My tech setup”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| CertbotThis page | 24 | 19 | 56% | 9 | 11 yrs3 owners | — |
| acme.sh | 13 | 3 | 81% | 5 | — | Approved |
What people said
40 of the 45 comments that mention it, newest first. Each links to the original comment.
“This is a solved problem, just look at how EFF's certbot works.”
“I can't believe the default ACME client is a snap”
“you wouldn't need programs like certbot to keep your tls certs up to date”
“you don't have to worry about the RHEL certbot snap updating to a broken version which gets blocked by SELinux”
“why does making a site https have to be so hard?”
“just have to install certbot”
“I’d take a cronjob running cert-bot and some monitoring”
“It'll automatically renew your certs. Very easy to set up and it's been stable for years without touching it.”
“the "native" package is outdated and removed from newer systems”
“TLS certificates get auto-renewed with letsencrypt every 3 months via certbot.”
“Certbot doesn't support CNAME for DNS-01 or at least didn't. I was always a fan of Certbot”
“My experience has been that CertBot doesn't play well with CNAME delegation”
“The easiest way to run certbot in a container is to mount a renew script”
“certbot doesn't support the CNAME aliases”
“it's been humming along for me for years at this point”
“the Linux installation instructions on the certbot website give options for pip or snap. Distro packages are not mentioned.”
“Acme and certbot trying to do this is annoying”
“certbot works fine for me”
“Certbot has earned my ire on just about every occasion I've had to interact with it.”
“You can schedule cert renewal and it happens automatically.”
“what Certbot and Lets Encrypt does for me, for free”
“run this binary written by some volunteers in some basements who will not sign a support contract with us”
“it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel”
“Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME.”
“Bonus you can get https certs with certbot and dns challenge.”
“just running a regular, well-defined (and free!) acme client”
“we have had Certbot for 11 years now”
“Not sure I'd want software like that running unmonitored automatically with root privileges.”
“Certbot defaults to running twice a day. Just use something with similar logic”
“certbot fails to renew my ssl certificates”
“LE software is pretty low quality, I've had multiple issues over the years”
“This news seems to indicate that I get to babysit certbot even more frequently in the future.”
“developers of certbot, which massively improved the toolchain around certificate deployment”
“Getting certbot up and running wasn't hard, automating renewal wasn't hard”
“boosted the popularity of automated certificate management tools (such as certbot)”
“I’m also not fond of certbot and other existing clients.”
“Certbot doesn't support the industry standard PKCS#12 format, which makes it extremely brittle for anyone using a Java based webserver.”
“I haven't been impressed with certbot, for example.”
“I don't want some magical auto update thing”
“Both have been extremely low setup effort and no ongoing effort.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.