14

I installed Certbot by following this tutorial:

sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-nginx

And now I want to set up my cert, but I need the dns-digitalocean plugin:

# certbot certonly --dns-digitalocean
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Could not choose appropriate plugin: The requested dns-digitalocean plugin does not appear to be installed
The requested dns-digitalocean plugin does not appear to be installed

I tried installing it with pip:

pip install certbot-dns-digitalocean

But apparently the apt-get version isn't "seeing" it.

How do I install it properly?

12

Better method, thanks to the others responses for helping me get to this.

Determine what plugins are installed currently:

# certbot-auto plugins
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
* apache
Description: Apache Web Server plugin - Beta
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = certbot_apache.entrypoint:ENTRYPOINT

* nginx
Description: Nginx Web Server plugin
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: nginx = certbot_nginx.configurator:NginxConfigurator

* standalone
Description: Spin up a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = certbot.plugins.standalone:Authenticator

* webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot.plugins.webroot:Authenticator
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Determine where your certbot (in my case certbot-auto) is installed:

# find / -name certbot
/opt/eff.org/certbot
...

Get into the Virtual Env and install plugin

cd /opt/eff.org/certbot/venv
source bin/activate
pip install certbot-dns-google
deactivate

Verify certbot plugins again

# certbot-auto plugins
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
* apache
Description: Apache Web Server plugin - Beta
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = certbot_apache.entrypoint:ENTRYPOINT

* dns-google
Description: Obtain certificates using a DNS TXT record (if you are using Google
Cloud DNS for DNS).
Interfaces: IAuthenticator, IPlugin
Entry point: dns-google = certbot_dns_google.dns_google:Authenticator

* nginx
Description: Nginx Web Server plugin
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: nginx = certbot_nginx.configurator:NginxConfigurator

* standalone
Description: Spin up a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = certbot.plugins.standalone:Authenticator

* webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot.plugins.webroot:Authenticator
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  • Please note that this can be tricky to cron, certbot-auto version upgrades will cause you to need to cron the "pip install" portion again. – Ryan Jun 3 at 3:38
8

Now (July 2018), you should be able to use either

pip install certbot-dns-digitalocean

or

git clone https://github.com/certbot/certbot.git
cd certbot/certbot-dns-digitalocean/
python setup.py install

You may need sudo privileges for either.

After installing you may not be able to see the plugin with certbot plugins, but you should be able to certbot certonly --dns-digitalocean just fine.

  • 1
    Hang on. How did you install certbot then? I think my problem was that I installed certbot with apt and certbot-dns-digitalocean with pip and certbot wasn't able to find it. – mpen Jul 16 '18 at 22:52
  • Yep, and I installed it the same way you did. Maybe the way you installed pip is different? I apt installed python 2.7 and then sudo easy_install pip (may require an apt install of these: python-setuptools python-dev build-essential) – M. Davis Jul 17 '18 at 16:34
7

First run

# type certbot
certbot is hashed (/usr/bin/certbot)

To find out where certbot is installed to. Or command -v certbot if you prefer.

Then run head /usr/bin/certbot and note what version of Python it's using:

#!/usr/bin/python3

In my case, it was using Python 3.

I noticed from my pip output it was trying to install a Python 2.7 package:

# pip install certbot-dns-digitalocean
Requirement already satisfied: certbot-dns-digitalocean in /usr/local/lib/python2.7/dist-packages

So how do we get pip to install Python 3 packages instead? Just copy the instructions from here:

cd /tmp
curl -O https://bootstrap.pypa.io/get-pip.py
python3 get-pip.py
rm get-pip.py

Now you should have the pip3 command, so run this instead:

pip3 install certbot-dns-digitalocean

And now try again:

# certbot plugins
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
* dns-digitalocean
Description: Obtain certs using a DNS TXT record (if you are using DigitalOcean
for DNS).
Interfaces: IAuthenticator, IPlugin
Entry point: dns-digitalocean =
certbot_dns_digitalocean.dns_digitalocean:Authenticator
  • if you run into this error ImportError: cannot import name 'sysconfig' install package python3-distutils. That and using sudo did the trick. I have route53 plugin loaded. – DKebler Jan 17 at 0:32
3

You have to use Docker to use dns plugins. From DNS Plugins:

These plugins are still in the process of being packaged by many distributions and cannot currently be installed with certbot-auto. If, however, you are comfortable installing the certificates yourself, you can run these plugins with Docker.

  • Doc also says: "Most users should use the operating system packages (see instructions at certbot.eff.org) or, as a fallback, certbot-auto. You should only use Docker if you are sure you know what you are doing and have a good reason to do so." – Totor Mar 1 at 9:40
2

The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot plugins in that package manager's repository.

Let's Encrypt also support an alternative installation method: the certbot-auto wrapper. This wrapper creates a private Python virtual installation (generally in /opt/eff.org/certbot/venv), and install certbot into that directory. A nice feature of certbot-auto is that it automatically keeps the certbot client up-to-date. A major downside is that it does not officially supports plugins installation (that is, aside from four plugins that are installed by default).

It is easy enough to work around this limitation, as described in Ryan G's solution. However, plugins installed through that procedure will be lost every time certbot-auto updates itself, which can result in random renew failures. Here, we have had a few situations where some certificates almost reached expiration because of that issue. Several tickets discuss this issue on certbot's bug tracker, and the team acknowledge the problem, but it seems that it might still be a long way before the issue is actually fixed.

Therefore, if using certbot-auto in an automated setup, it is desirable to either prevent certbot-auto's self updating (by running it with --no-self-upgrade), or to implement some strategy to ensure that required plugins are automatically reinstalled every time certbot is updated.

A possible solution to indeed ensure that required plugins are installed is to add a wrapper around certbot-auto. That wrapper could essentially look as follow:

#!/bin/bash

# The list of plugins to be installed
CERTBOT_PLUGINS="certbot-dns-route53"

# Force the venv directory to be where we can easily find it
export VENV_PATH="/opt/eff.org/certbot/venv"

# Force certbot-auto to be where we expect it to be
export CERTBOT_AUTO="/usr/local/bin/certbot-auto-upstream"

# Force certbot-auto to bootstrap or upgrade itself, but do no more
"${CERTBOT_AUTO}"  --install-only  "$@"

# Check if required plugins are installed; install them if they are missing
(
    cd ${VENV_PATH}
    source bin/activate

    for plugin in $CERTBOT_PLUGINS ; do
        if ! pip show -q "$plugin" ; then
            pip install "$plugin"
        fi
    done

    deactivate
)

# Execute the actual certbot command
"${VENV_PATH}/bin/letsencrypt" "$@"

I have made available a more complete version of that wrapper here; the only differences with the longer version is that it ensures that the wrapper is being run as root, and it properly handle the --help argument.

To install that wrapper, download the official certbot-auto program to /usr/local/bin/certbot-auto-upstream, and copy the wrapper to /usr/local/bin/certbot-auto. Make sure both files have proper privileges (chown root:root /usr/local/bin/certbot-auto*, then chmod 755 /usr/local/bin/certbot-auto*). In the wrapper file, make sure the line CERTBOT_PLUGINS="..." includes the list of plugins you actually need. And that's it. Simply use the certbot-auto command, as you would have done previously, and forget about the certbot-auto-upstream file.

1

If you're on ubuntu or debian, you can grab the following packages from debian testing (buster)

python3-certbot-dns-digitalocean_0.23.0-2_all.deb python3-digitalocean_1.13.2-1_all.deb

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.