Wildcard certs with certbot + cloudflare on MacOS

First, I'll note this older thread:

In which I link to this github issue: DNS plugin instructions are wrong for macOS · Issue #767 · certbot/website · GitHub

which features the advice of a regular contributor here – and certbot engineer – az, in which it is officially recommend by their team to not use homebrew and instead use pip.

That being, said, lets dive into the issue a bit:

I don't think there is a homebrew recipe for the cloudflare plugin. If anything it might be bew isntall certbot-dns-cloudflare but i don't see that as an option in their repository - and some github issues suggest the homebrew team was not interested in supporting the plugins for a while. I don't know what you expected to install by the above command, but cloudflare is presented as a commandline option flag (due to the leading dash) and without it, one would reasonably expect to install a general cloudflare library -- not a certbot plugin.

Potentially, pip3 is the native pip3 and Python on your mac, while certbot is the one installed by homebrew... and is using a homebrew installed version of Python.

Homebrew has changed their installation strategy a few times. Sometimes they use virtual envs, i think sometimes they use their own python, it is hard to keep up - which is why there are no support channels for it, and it is highly recommended against.

What might work is the following:

$(brew --prefix)/bin/pip3 install certbot-dns-cloudflare

What also might work, depending on your version of homebrew, are the various workarounds shared in this thread that try to leverage a prefix or virtual environment. Please note there are multiple versions because of changes to homebrew over the years, at best one will work, most likely none will work: Make all plugins available via Homebrew · Issue #5680 · certbot/certbot · GitHub

Again, I stress, don't use homebrew for this. Instead use pip with a virtual environment, either leveraging the system python on a custom installation.

5 Likes