Python3-certbot-nginx vs certbot-nginx via pip, what's the difference?

Help
1

My system is running Ubuntu 24.04. Can someone clarify the following confusion?

I've been many guides online use the following to install certbot for nginx:

sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx         # start using certbot

However on eff.org website, it says to install certbot via PIP:

sudo python3 -m venv /opt/certbot/
sudo /opt/certbot/bin/pip install certbot certbot-nginx
sudo ln -s /opt/certbot/bin/certbot /usr/bin/certbot

sudo certbot --nginx         # start using certbot

The EFF's page seems to need more manual steps done before one can start using certbot. Additionally, there's an entire section that says to uninstall any certbot installed through the OS package:

If you have any Certbot packages installed using an OS package manager like apt , dnf , or yum , you should remove them before installing the Certbot snap to ensure that when you run the command certbot the snap is used rather than the installation from your OS package manager.

If the official EFF webpage says to use only PIP to install, why do I see so many online guides use python3-certbot-nginx? Is EFF officially maintaining the python3-certbot-nginx package on ubuntu, or is a 3rd party doing that? I would prefer to use what's officially maintaining and not through 3rd party, but I can't seem to find much info on this.

IF the EFF is officially maintaining python3-certbot-nginx, why does this not show up when I'm asked what my website is running? I don't see an option for linux (Ubuntu). I only see options for Linux (pip) and Linux (snap).

2

Installing via pip gets you a current version supported by the certbot developers.

Installing an OS package may get you an older version, managed by Ubuntu (or often, Debian and then merged into Ubuntu) by whoever manages that - which isn’t the certbot developers.

You definitely can use your OS provided packages, just know that you may not be able to get help with any bug fixes without upgrading first. Ubuntu 24.04 ships a version of certbot from Feb 2024, several versions behind.

4 Likes
3

The pip installation method is only supported by best effort. The recommended installation method is the snap method. Unfortunately this isn't clearly stated on the Certbot website anywhere.. :confused:

It's also confusing that the pip installation page speaks about snap, as you've quoted yourself.

Because all previous Ubuntu/Debian/other options were just presenting the same page: the snap installation page. The Certbot team decided that it would be simpler to just put all those separate entries going to the same page into a single entry, the "Linux (snap)" entry.

Please note that installing using pip makes upgrading relatively difficult compared to the snap installation method. And the pip method doesn't install a systemd timer for automated renewals, while the snap method does. Some third party package manager maintainers (e.g. Ubuntu/Debian) might install a cronjob for you to do that, but I'm not sure if all maintainers have implemented that.

1 Like
4

Does this mean the snap packages are maintained by official certbot developers?

5

Yes.

Note that third party developers can also publish snaps for their own third party plugins e.g., but the certbot snap, which also includes the nginx plugin, is maintained by the Certbot team.

You can view the other snaps from the Certbot team at Certbot Project (certbot-eff) published snaps in the Snap Store, which includes a few DNS plugins for the dns-01 challenge. (Well, only DNS plugins actually, as the other official plugins are already included in the main snap.)

1 Like
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.