Certbot

https://eff-certbot.readthedocs.io/en/stable
Admin
Certbot is a tool that automates the process of obtaining and renewing SSL/TLS certificates from...
Tokens:164,426
Snippets:1,244
Trust Score:9.6
Update:7 hours ago
Show doc for...
Tokens:
Raw
### Install plugin snap for use with Certbot

Source: https://eff-certbot.readthedocs.io/en/stable/contributing.html

Installs the Certbot snap, sets trust-plugin-with-root, installs the plugin snap locally, connects the content interface, and lists plugins to verify.

```bash
snap install --classic certbot
snap set certbot trust-plugin-with-root=ok
snap install --dangerous your-snap-filename.snap
sudo snap connect certbot:plugin your-snap-name
sudo /snap/bin/certbot plugins
```

--------------------------------

### Combine webroot authenticator with apache installer

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Command to create a certificate using the webroot plugin for authentication and the apache plugin for installation. Specify authenticator with -a and installer with -i.

```bash
certbot run -a webroot -i apache -w /var/www/html -d example.com
```

--------------------------------

### success_installation

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.display.ops.html

Displays a box confirming the installation of HTTPS.

```APIDOC
## success_installation

### Description
Display a box confirming the installation of HTTPS.

### Method
Function

### Signature
`success_installation(domains: list[str]) -> None`

### Parameters
- **domains** (list) - Required - domain names which were enabled
```

--------------------------------

### Example renewal configuration file

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Example content of the renewal configuration file showing version, archive directory, certificate paths, and renewal parameters.

```ini
version = 4.2.0
archive_dir = /etc/letsencrypt/archive/yourdomain.com-0001
cert = /etc/letsencrypt/live/yourdomain.com-0001/cert.pem
privkey = /etc/letsencrypt/live/yourdomain.com-0001/privkey.pem
chain = /etc/letsencrypt/live/yourdomain.com-0001/chain.pem
fullchain = /etc/letsencrypt/live/yourdomain.com-0001/fullchain.pem
[renewalparams]
account = abcdef12345678910
server = https://acme-staging-v02.api.letsencrypt.org/directory
authenticator = standalone
key_type = ecdsa
post_hook = "echo 'shut down server'"
```

--------------------------------

### Install version-controlled file with hash check

Source: https://eff-certbot.readthedocs.io/en/stable/_modules/certbot/plugins/common.html

Installs a version-controlled file (e.g., options-ssl.conf) from a source path to a destination path, saving a digest of the current file. If the destination file is missing, it installs it. If it exists and is up-to-date, it does nothing. If it matches a known hash, it updates it; otherwise, it warns about manual modification and saves the current digest to avoid repeated warnings.

```python
    current_hash = crypto_util.sha256sum(src_path)

    def _write_current_hash() -> None:
        with open(digest_path, "w") as file_h:
            file_h.write(current_hash)

    def _install_current_file() -> None:
        shutil.copyfile(src_path, dest_path)
        _write_current_hash()

    # Check to make sure options-ssl.conf is installed
    if not os.path.isfile(dest_path):
        _install_current_file()
        return
    # there's already a file there. if it's up to date, do nothing. if it's not but
    # it matches a known file hash, we can update it.
    # otherwise, print a warning once per new version.
    active_file_digest = crypto_util.sha256sum(dest_path)
    if active_file_digest == current_hash: # already up to date
        return
    if active_file_digest in all_hashes: # safe to update
        _install_current_file()
    else:  # has been manually modified, not safe to update
        # did they modify the current version or an old version?
        if os.path.isfile(digest_path):
            with open(digest_path, "r") as f:
                saved_digest = f.read()
            # they modified it after we either installed or told them about this version, so return
            if saved_digest == current_hash:
                return
        # there's a new version but we couldn't update the file, or they deleted the digest.
        # save the current digest so we only print this once, and print a warning
        _write_current_hash()
        logger.warning("%s has been manually modified; updated file "
            "saved to %s. We recommend updating %s for security purposes.",
            dest_path, src_path, dest_path)
```

--------------------------------

### Install certificate with new name

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Command to install the certificate with the new name, updating links on the webserver if Certbot manages installation.

```bash
certbot install --cert-name yourdomain.com
```

--------------------------------

### Example cli.ini configuration file

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Example Certbot configuration file showing commented options for key type, RSA key size, email, authenticator, and ACME server with EAB credentials. Note that options set to false are read as true by older versions, and domains should not be listed here.

```ini
# This is an example of the kind of things you can do in a configuration file.
# All flags used by the client can be configured here. Run Certbot with
# "--help" to learn more about the available options.
#
# Note that these options apply automatically to all use of Certbot for
# obtaining or renewing certificates, so options specific to a single
# certificate on a system with several certificates should not be placed
# here.

# Use ECC for the private key
key-type = ecdsa
elliptic-curve = secp384r1

# Use a 4096 bit RSA key instead of 2048
rsa-key-size = 4096

# Uncomment and update to register with the specified e-mail address
# email = foo@example.com

# Uncomment to use the standalone authenticator on port 80
# authenticator = standalone

# Uncomment to use the webroot authenticator. Replace webroot-path with the
# path to the public_html / webroot folder being served by your web server.
# authenticator = webroot
# webroot-path = /usr/share/nginx/html

# Uncomment to automatically agree to the terms of service of the ACME server
# agree-tos = true

# An example of using an alternate ACME server that uses EAB credentials
# server = https://acme.sectigo.com/v2/InCommonRSAOV 
# eab-kid = somestringofstuffwithoutquotes
# eab-hmac-key = yaddayaddahexhexnotquoted
```

--------------------------------

### Example output of 'certbot certificates'

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Sample output format returned by the 'certificates' subcommand, showing details for a certificate named example.com.

```text
Found the following certificates:
  Certificate Name: example.com
    Domains: example.com, www.example.com
    Expiry Date: 2017-02-19 19:53:00+00:00 (VALID: 30 days)
    Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
    Key Type: RSA
    Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem
```

--------------------------------

### Install plugin in development virtualenv

Source: https://eff-certbot.readthedocs.io/en/stable/contributing.html

Activates a virtualenv, installs the plugin in editable mode from examples/plugins/, and runs certbot_test plugins to verify the plugin is discovered.

```bash
. venv/bin/activate
pip install -e examples/plugins/
certbot_test plugins
```

--------------------------------

### Example output of certbot certificates

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Example output from 'certbot certificates' showing two certificates, including one with a name 'yourdomain.com-0001' that will be renamed.

```text
Found the following certs:
  Certificate Name: yourdomain.com-0001
    Serial Number: 2ce74f4e2b822211dd7648ea26c8927bdef6
    Key Type: ECDSA
    Domains: yourdomain.com subdomain.yourdomain.com
    Expiry Date: 2025-11-16 20:27:27+00:00 (INVALID: TEST_CERT)
    Certificate Path: /etc/letsencrypt/live/yourdomain.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/yourdomain.com-0001/privkey.pem
  Certificate Name: yourdomain.com
    Serial Number: 2c72aa8cf58aa9fe9a33208d82304642d9ed
    Key Type: ECDSA
    Domains: yourdomain.com
    Expiry Date: 2025-11-16 19:22:47+00:00 (INVALID: TEST_CERT)
    Certificate Path: /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/yourdomain.com/privkey.pem
```

--------------------------------

### certbot.util.get_os_info()

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.util.html

Gets OS name and version. Returns a tuple of strings.

```APIDOC
## certbot.util.get_os_info()

### Description
Gets OS name and version. Returns a tuple of strings.

### Returns
- **tuple[str, str]** - (os_name, os_version).
```

--------------------------------

### Example output after deleting conflicting certificate

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Example output from 'certbot certificates' after deleting the certificate named 'yourdomain.com' to free up the name for renaming.

```text
Found the following certs:
  Certificate Name: yourdomain.com-0001
    Serial Number: 2ce74f4e2b822211dd7648ea26c8927bdef6
    Key Type: ECDSA
    Domains: yourdomain.com subdomain.yourdomain.com
    Expiry Date: 2025-11-16 20:27:27+00:00 (INVALID: TEST_CERT)
    Certificate Path: /etc/letsencrypt/live/yourdomain.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/yourdomain.com-0001/privkey.pem
```

--------------------------------

### certbot.util.get_systemd_os_like()

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.util.html

Gets a list of strings that indicate the distribution likeness to other distributions. Returns a list of distribution acronyms.

```APIDOC
## certbot.util.get_systemd_os_like()

### Description
Gets a list of strings that indicate the distribution likeness to other distributions. Returns a list of distribution acronyms.

### Returns
- **list[str]** - List of distribution acronyms.
```

--------------------------------

### certbot.util.get_os_info_ua()

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.util.html

Gets OS name and version string for User Agent. Returns a string.

```APIDOC
## certbot.util.get_os_info_ua()

### Description
Gets OS name and version string for User Agent. Returns a string.

### Returns
- **str** - os_ua.
```

--------------------------------

### Sphinx-style docstring example

Source: https://eff-certbot.readthedocs.io/en/stable/contributing.html

Example of a function with a Sphinx-style docstring, as required by the Google Python Style Guide exception. Use this format for documenting parameters, returns, and return types.

```python
def foo(arg):
    """Short description.

    :param int arg: Some number.

    :returns: Argument
    :rtype: int

    """
    return arg
```

--------------------------------

### dir_setup(test_dir, pkg)

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.plugins.common.html

Sets up the directories necessary for the configurator.

```APIDOC
## dir_setup(test_dir, pkg)

### Description
Sets up the directories necessary for the configurator.

### Parameters
- **test_dir** (str) - Required - Test directory.
- **pkg** (str) - Required - Package name.

### Returns
- **tuple[str, str, str]** - A tuple of three strings representing the setup directories.
```

--------------------------------

### Webroot plugin: example validation request log

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Example HTTP request log line from the Let's Encrypt validation server when the webroot plugin creates challenge files. Shows the GET request to /.well-known/acme-challenge/ with a token and a 200 response.

```log
66.133.109.36 - - [05/Jan/2016:20:11:24 -0500] "GET /.well-known/acme-challenge/HGr8U1IeTW4kY_Z6UIyaakzOkyQgPr_7ArlLgtZE8SX HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
```

--------------------------------

### setup.py entry_points for a Certbot plugin

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.interfaces.html

Shows how to declare a Certbot plugin entry point in setup.py, including the extras_require that may be needed. The plugin object must be importable without extras because the CLI loads the entry point before requiring it.

```python
setup(
    ...
    entry_points={
        'certbot.plugins': [
            'name=example_project.plugin[plugin_deps]',
        ],
    },
    extras_require={
        'plugin_deps': ['dep1', 'dep2'],
    }
)
```

--------------------------------

### Build HTML documentation with make clean html

Source: https://eff-certbot.readthedocs.io/en/stable/contributing.html

Run this command from the docs directory of a package (e.g., certbot/docs) after setting up a local copy of Certbot and activating the virtual environment. It generates HTML documentation in the _build/html directory within the current docs directory.

```bash
make clean html
```

--------------------------------

### certbot.errors.NoInstallationError

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.errors.html

Certbot No Installation error. Raised when no installation is found.

```APIDOC
## certbot.errors.NoInstallationError

### Description
Certbot No Installation error.

### Exception
`certbot.errors.NoInstallationError`

### Base Class
`PluginError`

### Usage
Raised when no installation is found.
```

--------------------------------

### Find references to a certificate in server configuration

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Run this command to locate all references to the certificate (substitute `example.com`) in nginx, httpd, or apache2 configuration files. If no references are found, skip to step 4 of the safe deletion process.

```bash
sudo bash -c 'grep -R live/example.com /etc/{nginx,httpd,apache2}'
```

--------------------------------

### certbot.util.set_up_core_dir()

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.util.html

Ensure directory exists with proper permissions and is locked.

```APIDOC
## certbot.util.set_up_core_dir(directory: str, mode: int, strict: bool) → None

### Description
Ensure directory exists with proper permissions and is locked.

### Parameters
- **directory** (str) – Path to a directory.
- **mode** (int) – Directory mode.
- **strict** (bool) – require directory to be owned by current user

### Raises
- **.errors.LockError** – if the directory cannot be locked
- **.errors.Error** – if the directory cannot be made or verified

```

--------------------------------

### Certbot commands for obtaining and installing certificates

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Shows basic Certbot commands: `certbot` to obtain and install a certificate, `certbot certonly` to obtain without installing, and multiple `certonly` invocations with `-d` flags for different domains. The comments indicate that running Certbot multiple times can obtain and install different certificates.

```bash
# Obtain and install a certificate:
certbot

# Obtain a certificate but don't install it:
certbot certonly

# You may specify multiple domains with -d and obtain and
# install different certificates by running Certbot multiple times:
certbot certonly -d example.com -d www.example.com
certbot certonly -d app.example.com -d api.example.com
```

--------------------------------

### Create test configuration directory structure

Source: https://eff-certbot.readthedocs.io/en/stable/_modules/certbot/tests/util.html

Creates the archive, conf, and live directories under the config directory, copies sample archive files, creates symlinks for all four storage types, and writes a test configuration file with MAGICDIR replaced by the config directory. Returns the path to the configuration file.

```python
    conf_dir = os.path.join(
        config_dir, constants.RENEWAL_CONFIGS_DIR)
    archive_dir = os.path.join(
        config_dir, constants.ARCHIVE_DIR, lineage_name)
    live_dir = os.path.join(
        config_dir, constants.LIVE_DIR, lineage_name)

    for directory in (archive_dir, conf_dir, live_dir,):
        if not os.path.exists(directory):
            filesystem.makedirs(directory)

    sample_archive = vector_path('sample-archive{}'.format('-ec' if ec else ''))
    for kind in os.listdir(sample_archive):
        shutil.copyfile(os.path.join(sample_archive, kind),
                        os.path.join(archive_dir, kind))

    for kind in storage.ALL_FOUR:
        os.symlink(os.path.join(archive_dir, '{0}1.pem'.format(kind)),
                   os.path.join(live_dir, '{0}.pem'.format(kind)))

    conf_path = os.path.join(config_dir, conf_dir, testfile)
    with open(vector_path(testfile)) as src:
        with open(conf_path, 'w') as dst:
            dst.writelines(
                line.replace('MAGICDIR', config_dir) for line in src)

    return conf_path
```

--------------------------------

### Delete Certbot installation created by certbot-auto

Source: https://eff-certbot.readthedocs.io/en/stable/install.html

Removes the Certbot installation directory /opt/eff.org created by certbot-auto.

```bash
sudo rm -rf /opt/eff.org
```

--------------------------------

### Set up the Python virtual environment

Source: https://eff-certbot.readthedocs.io/en/stable/contributing.html

Creates a virtual environment for Certbot development. Run from the cloned repository directory. May need to be repeated when dependencies change or a new plugin is introduced.

```bash
cd certbot
python3 tools/venv.py
```

--------------------------------

### Run Certbot with Docker using certonly

Source: https://eff-certbot.readthedocs.io/en/stable/install.html

Use this Docker command to obtain a certificate without installing it. It mounts the necessary Let's Encrypt directories and runs the certonly command. You must manually install the certificate afterward because installer plugins cannot reach your webserver from inside the container.

```bash
sudo docker run -it --rm --name certbot \
            -v "/etc/letsencrypt:/etc/letsencrypt" \
            -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \
            certbot/certbot certonly
```

--------------------------------

### Plugin.prepare()

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.interfaces.html

Prepares the plugin, finishing up any additional initialization.

```APIDOC
## Plugin.prepare()

### Description
Prepare the plugin. Finish up any additional initialization.

### Method
prepare()

### Raises
- **.PluginError** - when full initialization cannot be completed.
- **.MisconfigurationError** - when full initialization cannot be completed. Plugin will be displayed on a list of available plugins.
- **.NoInstallationError** - when the necessary programs/files cannot be located. Plugin will NOT be displayed on a list of available plugins.
- **.NotSupportedError** - when the installation is recognized, but the version is not currently supported.

```

--------------------------------

### Reverter.__init__

Source: https://eff-certbot.readthedocs.io/en/stable/_modules/certbot/reverter.html

Initializes the Reverter instance with the given configuration and ensures the backup directory exists with proper permissions.

```APIDOC
## Reverter.__init__

### Description
Initializes the Reverter instance with the given configuration and ensures the backup directory exists with proper permissions.

### Method
Constructor

### Signature
`__init__(self, config: configuration.NamespaceConfig) -> None`

### Parameters
- **config** (configuration.NamespaceConfig) - Required - The configuration object.

### Behavior
- Creates or verifies the backup directory using `util.make_or_verify_dir` with mode `constants.CONFIG_DIRS_MODE` and `strict_permissions` from config.

### Returns
None
```

--------------------------------

### Combine manual authenticator with nginx installer

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Command to create a certificate using the manual plugin for authentication and the nginx plugin for installation. Note that this certificate cannot be renewed automatically.

```bash
certbot run -a manual -i nginx -d example.com
```

--------------------------------

### Start local Pebble ACME server with run_acme_server

Source: https://eff-certbot.readthedocs.io/en/stable/contributing.html

Starts a local instance of Pebble in the foreground, printing logs. Press CTRL+C to stop. Configured to validate challenges against certbot executed locally.

```bash
run_acme_server
```

--------------------------------

### Certbot --help all output

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Full command-line help output from `certbot --help all`, listing subcommands and options. Includes the `--max-log-backups` flag with default 1000 and note that setting it to 0 disables log rotation.

```text
usage: 
  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate. The most common SUBCOMMANDS and flags are:

obtain, install, and renew certificates:
    (default) run   Obtain & install a certificate in your current webserver
    certonly        Obtain or renew a certificate, but do not install it
    renew           Renew all previously obtained certificates that are near expiry
    enhance         Add security enhancements to your existing configuration
   -d DOMAINS       Comma-separated list of domains to obtain a certificate for

  --apache          Use the Apache plugin for authentication & installation
  --standalone      Run a standalone webserver for authentication
  --nginx           Use the Nginx plugin for authentication & installation
  --webroot         Place files in a server's webroot folder for authentication
  --manual          Obtain certificates interactively, or using shell script hooks

   -n               Run non-interactively
  --test-cert       Obtain a test certificate from a staging server
  --dry-run         Test "renew" or "certonly" without saving any certificates to disk

manage certificates:
    certificates    Display information about certificates you have from Certbot
    revoke          Revoke a certificate (supply --cert-name or --cert-path)
    delete          Delete a certificate (supply --cert-name)
    reconfigure     Update a certificate's configuration (supply --cert-name)

manage your account:
    register        Create an ACME account
    unregister      Deactivate an ACME account
    update_account  Update an ACME account
    show_account    Display account details
  --agree-tos       Agree to the ACME server's Subscriber Agreement
   -m EMAIL         Email address for important account notifications

options:
  -h, --help            show this help message and exit
  -c, --config CONFIG_FILE
                        path to config file (default: /etc/letsencrypt/cli.ini
                        and ~/.config/letsencrypt/cli.ini)
  -v, --verbose         This flag can be used multiple times to incrementally
                        increase the verbosity of output, e.g. -vvv. (default:
                        0)
  --max-log-backups MAX_LOG_BACKUPS
                        Specifies the maximum number of backup logs that
                        should be kept by Certbot's built in log rotation.
                        Setting this flag to 0 disables log rotation entirely,
                        causing Certbot to always append to the same log file.
                        (default: 1000)
  -n, --non-interactive, --noninteractive
                        Run without ever asking for user input. This may
                        require additional command line flags; the client will
                        try to explain which ones are required if it finds one
                        missing (default: False)
  --force-interactive   Force Certbot to be interactive even if it detects
                        it's not being run in a terminal. This flag cannot be
                        used with the renew subcommand. (default: False)
  -d, --domains, --domain DOMAIN
                        Domain names to include. For multiple domains you can
                        use multiple -d flags or enter a comma separated list
                        of domains as a parameter. All domains will be
                        included as Subject Alternative Names on the
                        certificate. The first domain will be used as the
                        certificate name, unless otherwise specified or if you
                        already have a certificate with the same name. In the
                        case of a name conflict, a number like -0001 will be
                        appended to the certificate name. (default: Ask)
  --ip-address IP_ADDRESSES
```

--------------------------------

### certbot.errors.PluginSelectionError

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.errors.html

A problem with plugin/configurator selection or setup.

```APIDOC
## certbot.errors.PluginSelectionError

### Description
A problem with plugin/configurator selection or setup.

### Exception
`certbot.errors.PluginSelectionError`

### Base Class
`Error`

### Usage
Raised for plugin selection or setup problems.
```

--------------------------------

### setUp method for NamespaceConfig

Source: https://eff-certbot.readthedocs.io/en/stable/_modules/certbot/tests/util.html

Configures a mock NamespaceConfig with deep-copied CLI_DEFAULTS and sets various namespace attributes like verb, config_dir, work_dir, logs_dir, cert_path, fullchain_path, chain_path, and server.

```python
def setUp(self) -> None:
    super().setUp()
    self.config = configuration.NamespaceConfig(
        # We make a copy here so any mutable values from CLI_DEFAULTS do not get modified.
        mock.MagicMock(**copy.deepcopy(constants.CLI_DEFAULTS)),
    )
    self.config.set_argument_sources({})
    self.config.namespace.verb = "certonly"
    self.config.namespace.config_dir = os.path.join(self.tempdir, 'config')
    self.config.namespace.work_dir = os.path.join(self.tempdir, 'work')
    self.config.namespace.logs_dir = os.path.join(self.tempdir, 'logs')
    self.config.namespace.cert_path = constants.CLI_DEFAULTS['auth_cert_path']
    self.config.namespace.fullchain_path = constants.CLI_DEFAULTS['auth_chain_path']
    self.config.namespace.chain_path = constants.CLI_DEFAULTS['auth_chain_path']
    self.config.namespace.server = "https://example.com"
```

--------------------------------

### DNS-01 challenge with Cloudflare API v4 hooks

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Example usage for DNS-01 challenges using the Cloudflare API v4. The auth script creates a TXT record and the cleanup script removes it. This example is for demonstration purposes only and should not be used as-is.

```bash
certbot certonly --manual --preferred-challenges=dns --manual-auth-hook /path/to/dns/authenticator.sh --manual-cleanup-hook /path/to/dns/cleanup.sh -d secure.example.com
```

```bash
#!/bin/bash

# Get your API key from https://www.cloudflare.com/a/account/my-account
API_KEY="your-api-key"
EMAIL="your.email@example.com"

# Strip only the top domain to get the zone id
DOMAIN=$(expr match "$CERTBOT_IDENTIFIER" '.*\.\(.*\..*\)')

# Get the Cloudflare zone id
ZONE_EXTRA_PARAMS="status=active&page=1&per_page=20&order=status&direction=desc&match=all"
ZONE_ID=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN&$ZONE_EXTRA_PARAMS" \
     -H     "X-Auth-Email: $EMAIL" \
     -H     "X-Auth-Key: $API_KEY" \
     -H     "Content-Type: application/json" | python -c "import sys,json;print(json.load(sys.stdin)['result'][0]['id'])")

# Create TXT record
CREATE_DOMAIN="_acme-challenge.$CERTBOT_IDENTIFIER"
RECORD_ID=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
     -H     "X-Auth-Email: $EMAIL" \
     -H     "X-Auth-Key: $API_KEY" \
     -H     "Content-Type: application/json" \
     --data '{"type":"TXT","name":"'"$CREATE_DOMAIN"'","content":"'"$CERTBOT_VALIDATION"'","ttl":120}' \
             | python -c "import sys,json;print(json.load(sys.stdin)['result']['id'])")
# Save info for cleanup
if [ ! -d /tmp/CERTBOT_$CERTBOT_IDENTIFIER ];then
        mkdir -m 0700 /tmp/CERTBOT_$CERTBOT_IDENTIFIER
fi
echo $ZONE_ID > /tmp/CERTBOT_$CERTBOT_IDENTIFIER/ZONE_ID
echo $RECORD_ID > /tmp/CERTBOT_$CERTBOT_IDENTIFIER/RECORD_ID

# Sleep to make sure the change has time to propagate over to DNS
sleep 25
```

```bash
#!/bin/bash

# Get your API key from https://www.cloudflare.com/a/account/my-account
API_KEY="your-api-key"
EMAIL="your.email@example.com"

if [ -f /tmp/CERTBOT_$CERTBOT_IDENTIFIER/ZONE_ID ]; then
        ZONE_ID=$(cat /tmp/CERTBOT_$CERTBOT_IDENTIFIER/ZONE_ID)
        rm -f /tmp/CERTBOT_$CERTBOT_IDENTIFIER/ZONE_ID
fi

if [ -f /tmp/CERTBOT_$CERTBOT_IDENTIFIER/RECORD_ID ]; then
        RECORD_ID=$(cat /tmp/CERTBOT_$CERTBOT_IDENTIFIER/RECORD_ID)
        rm -f /tmp/CERTBOT_$CERTBOT_IDENTIFIER/RECORD_ID
fi

# Remove the challenge TXT record from the zone
if [ -n "${ZONE_ID}" ]; then
    if [ -n "${RECORD_ID}" ]; then
        curl -s -X DELETE "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$RECORD_ID" \
                -H "X-Auth-Email: $EMAIL" \
                -H "X-Auth-Key: $API_KEY" \
                -H "Content-Type: application/json"
    fi
fi
```

--------------------------------

### Addr.fromstring(str_addr: str) -> GenericAddr

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.plugins.common.html

Initialize Addr from string.

```APIDOC
## Addr.fromstring(str_addr: str) -> GenericAddr

### Description
Initialize Addr from string.

### Parameters
- **str_addr** (str) - Required - The string representation of the address.

### Returns
- **GenericAddr** - The Addr instance.
```

--------------------------------

### is_wildcard_domain(domain)

Source: https://eff-certbot.readthedocs.io/en/stable/_modules/certbot/util.html

Checks if the given domain is a wildcard domain (starts with '*.').

```APIDOC
## is_wildcard_domain(domain)

### Description
Determines whether the provided domain is a wildcard domain, i.e., starts with '*.'.

### Parameters
- **domain** (Union[str, bytes]) - Required - The domain to check. Can be a string or bytes.

### Returns
- **bool** - True if the domain is a wildcard, otherwise False.

```

--------------------------------

### Example output of grep for certificate references

Source: https://eff-certbot.readthedocs.io/en/stable/using.html

Shows the typical output when references are found, indicating the configuration file and the certificate file paths. This is the output of the grep command in the previous step.

```text
/etc/apache2/sites-available/000-default-le-ssl.conf:SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
/etc/apache2/sites-available/000-default-le-ssl.conf:SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
```

--------------------------------

### Installer.install_ssl_dhparams() -> None

Source: https://eff-certbot.readthedocs.io/en/stable/api/certbot.plugins.common.html

Copy Certbot’s ssl_dhparams file into the system’s config dir if required.

```APIDOC
## Installer.install_ssl_dhparams() -> None

### Description
Copy Certbot’s ssl_dhparams file into the system’s config dir if required.

### Returns
- **None**
```

--------------------------------

### Install system dependencies for Certbot development

Source: https://eff-certbot.readthedocs.io/en/stable/contributing.html

Installs the OS-level packages required to build and run Certbot. Includes commands for APT-based distributions (Debian/Ubuntu), RPM-based distributions (Fedora/CentOS), and macOS with Homebrew. For macOS, it also sets up CFLAGS and PATH environment variables for Augeas and GNU coreutils.

```bash
# For APT-based distributions (e.g. Debian, Ubuntu ...)
sudo apt update
sudo apt install python3-dev python3-venv libaugeas-dev gcc
# For RPM-based distributions (e.g. Fedora, CentOS ...)
# NB1: old distributions will use yum instead of dnf
# NB2: RHEL-based distributions use python3X instead of python3 (e.g. python38)
sudo dnf install python3 python3-devel augeas-devel gcc
# For macOS installations with Homebrew already installed and configured
# NB: CFLAGS are needed to compile and link to Augeas installed through
#     Homebrew and some of our developer scripts expect GNU coreutils be first in
#     your PATH. The commands below set this up for bash and zsh, but your
#     instructions may be slightly different if you use an alternate shell.
brew install augeas coreutils gnu-sed
BREW_PREFIX=$(brew --prefix)
RC_LINES="export CFLAGS=\"\$CFLAGS -I$BREW_PREFIX/include -L$BREW_PREFIX/lib\"\n"
RC_LINES+="export PATH=\"$BREW_PREFIX/opt/coreutils/libexec/gnubin:"
RC_LINES+="$BREW_PREFIX/opt/gnu-sed/libexec/gnubin:\$PATH\"\n"
printf "$RC_LINES" >> ~/.bashrc  # for bash
printf "$RC_LINES" >> ~/.zshrc  # for zsh
```
Tokens:
Raw