Why does certbot fail when installed with pip on Debian 10?

[saveee9]

I'm on Debian 10 and when I run pip3 install certbot-dns-cloudflare I get certbot and certbot-dns-cloudflare both at version 1.16.0 which is the version I want. But when I try to run any certbot command I get this error.

pkg_resources.ContextualVersionConflict: (
cryptography 2.6.1 (/usr/lib/python3/dist-packages),
Requirement.parse('cryptography>=3.2'), {'PyOpenSSL'})

pip3 list shows cryptography package at version 2.6.1 rather than the required one of 3.2. It might be due to another dependency requiring the older version but I don't know how to verify this.

Name: cryptography
Version: 2.6.1
Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Home-page: https://github.com/pyca/cryptography
Author: The cryptography developers
Author-email: cryptography-dev@python.org
License: BSD or Apache License, Version 2.0
Location: /usr/lib/python3/dist-packages
Requires: 
Required-by: pyOpenSSL, josepy, acme

How can I install certbot-dns-cloudflare on Debian 10 so that it runs without errors?

[Osiris]

Did you run those pip3 commands for certbot in a virtual environment, as recommended by the certbot documentation?

[_az]

The relevant pip instructions can be found here.

They seem to work fine on Debian 10, having tried them just now.