{"slug": "certbot", "name": "Certbot", "category": "selfhosted", "category_name": "Self-hosted and home server", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 2.965, "rising": 0.35, "first": "2026-03-25", "latest": "2026-08-11", "why": "You should have used the `--deploy-hook` on certbot.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 2, 0, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "You should have used the `--deploy-hook` on certbot.", "icon": true, "domain": "letsencrypt.org", "github_repo": null, "official_url": "https://certbot.eff.org", "pricing": "", "aliases": ["Certbot"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 788194848, "item_id": 49262178, "url": "https://news.ycombinator.com/item?id=49262178", "by": "emn4tor", "date": "2026-08-11", "stance": "recommend", "quote": "set up a cronjob (auto repeating task) that refreshes your ssl certificate via certbot and you should be good to go", "excerpt": "It depends, it can be... But tbh just set up a cronjob (auto repeating task) that refreshes your ssl certificate via certbot and you should be good to go. The initial setup might that a few hours of tinkering, but once you've made it you can easily have a mail server for $1-3. If you really don't wanna fully self host you can buy a Plesk workspace for like 99ct-5$ which allows emails, websites and databases", "context": "", "use_case": "SSL certificates for self-hosted mail", "switched_from": "", "story": "Ask HN: What email provider do you recommend for personal email?"}, {"id": 760715392, "item_id": 47544712, "url": "https://news.ycombinator.com/item?id=47544712", "by": "yegle", "date": "2026-03-27", "stance": "recommend", "quote": "You should have used the `--deploy-hook` on certbot.", "excerpt": "You should have used the `--deploy-hook` on certbot. I use this to copy the cert to Synology NAS and trigger a reload of the cert on the NAS. BTW: The easiest way to run certbot in a container is to mount a renew script (some shell script as simple as `certbot renew`) to /etc/periodic/daily/renew, then change the container's entrypoint to `crond -d6 -f`.", "context": "runs certbot in a container, copies certs to a Synology NAS", "use_case": "TLS certificate renewal", "switched_from": "", "story": "Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot"}, {"id": 760239792, "item_id": 47514987, "url": "https://news.ycombinator.com/item?id=47514987", "by": "rdevilla", "date": "2026-03-25", "stance": "recommend", "quote": "certbot is Let's Encrypt's recommended ACME client", "excerpt": "> Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let\u2019s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can us", "context": "", "use_case": "ACME DNS-01 certificate issuance", "switched_from": "", "story": "You Can Run a DNS Server"}]}], "caveats": [], "who": [{"by": "yegle", "context": "runs certbot in a container, copies certs to a Synology NAS", "url": "https://news.ycombinator.com/item?id=47544712", "date": "2026-03-27"}], "tags": [], "use_cases": ["ssl certificates for self-hosted mail", "acme certificates", "tls certificate renewal", "acme dns-01 certificate issuance"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49261634", "title": "Ask HN: What email provider do you recommend for personal email?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48453275", "title": "Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47542644", "title": "Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47453738", "title": "You Can Run a DNS Server", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 2}, "2026-04": {}, "2026-05": {}, "2026-06": {"neutral": 1}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 788194848, "item_id": 49262178, "url": "https://news.ycombinator.com/item?id=49262178", "by": "emn4tor", "date": "2026-08-11", "stance": "recommend", "quote": "set up a cronjob (auto repeating task) that refreshes your ssl certificate via certbot and you should be good to go", "excerpt": "It depends, it can be... But tbh just set up a cronjob (auto repeating task) that refreshes your ssl certificate via certbot and you should be good to go. The initial setup might that a few hours of tinkering, but once you've made it you can easily have a mail server for $1-3. If you really don't wanna fully self host you can buy a Plesk workspace for like 99ct-5$ which allows emails, websites and databases", "context": "", "use_case": "SSL certificates for self-hosted mail", "switched_from": "", "story": "Ask HN: What email provider do you recommend for personal email?"}, {"id": 775442434, "item_id": 48465152, "url": "https://news.ycombinator.com/item?id=48465152", "by": "matharmin", "date": "2026-06-09", "stance": "neutral", "quote": "It works without issue with Kubernetes Certbot", "excerpt": "I use them in some cases to avoid the rate limits on LetsEncrypt, and they have better support for some older platforms (like ancient Android versions), and I'm pretty happy so far. I have a paid account to support them, but it's not a requirement for ACME certs. It works without issue with Kubernetes Certbot, and seamless to switch between ZeroSSL and LetsEncrypt. I can't comment on the EU part though - not that rel", "context": "", "use_case": "ACME certificates", "switched_from": "", "story": "Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]"}, {"id": 760715392, "item_id": 47544712, "url": "https://news.ycombinator.com/item?id=47544712", "by": "yegle", "date": "2026-03-27", "stance": "recommend", "quote": "You should have used the `--deploy-hook` on certbot.", "excerpt": "You should have used the `--deploy-hook` on certbot. I use this to copy the cert to Synology NAS and trigger a reload of the cert on the NAS. BTW: The easiest way to run certbot in a container is to mount a renew script (some shell script as simple as `certbot renew`) to /etc/periodic/daily/renew, then change the container's entrypoint to `crond -d6 -f`.", "context": "runs certbot in a container, copies certs to a Synology NAS", "use_case": "TLS certificate renewal", "switched_from": "", "story": "Installing a Let's Encrypt TLS Certificate on a Brother Printer with Certbot"}, {"id": 760239792, "item_id": 47514987, "url": "https://news.ycombinator.com/item?id=47514987", "by": "rdevilla", "date": "2026-03-25", "stance": "recommend", "quote": "certbot is Let's Encrypt's recommended ACME client", "excerpt": "> Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let\u2019s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can us", "context": "", "use_case": "ACME DNS-01 certificate issuance", "switched_from": "", "story": "You Can Run a DNS Server"}]}