The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot plugins in that package manager's repository.
Let's Encrypt also support an alternative installation method: the certbot-auto wrapper. This wrapper creates a private Python virtual installation (generally in /opt/eff.org/certbot/venv), and install certbot into that directory. A nice feature of certbot-auto is that it automatically keeps the certbot client up-to-date. A major downside is that it does not officially supports plugins installation (that is, aside from four plugins that are installed by default).
It is easy enough to work around this limitation, as described in Ryan G's solution. However, plugins installed through that procedure will be lost every time certbot-auto updates itself, which can result in random renew failures. Here, we have had a few situations where some certificates almost reached expiration because of that issue. Several tickets discuss this issue on certbot's bug tracker, and the team acknowledge the problem, but it seems that it might still be a long way before the issue is actually fixed.
Therefore, if using certbot-auto in an automated setup, it is desirable to either prevent certbot-auto's self updating (by running it with --no-self-upgrade), or to implement some strategy to ensure that required plugins are automatically reinstalled every time certbot is updated.
A possible solution to indeed ensure that required plugins are installed is to add a wrapper around certbot-auto. That wrapper could essentially look as follow:
#!/bin/bash
# The list of plugins to be installed
CERTBOT_PLUGINS="certbot-dns-route53"
# Force the venv directory to be where we can easily find it
export VENV_PATH="/opt/eff.org/certbot/venv"
# Force certbot-auto to be where we expect it to be
export CERTBOT_AUTO="/usr/local/bin/certbot-auto-upstream"
# Force certbot-auto to bootstrap or upgrade itself, but do no more
"${CERTBOT_AUTO}" --install-only "$@"
# Check if required plugins are installed; install them if they are missing
(
cd ${VENV_PATH}
source bin/activate
for plugin in $CERTBOT_PLUGINS ; do
if ! pip show -q "$plugin" ; then
pip install "$plugin"
fi
done
deactivate
)
# Execute the actual certbot command
"${VENV_PATH}/bin/letsencrypt" "$@"
I have made available a more complete version of that wrapper here; the only differences with the longer version is that it ensures that the wrapper is being run as root, and it properly handle the --help argument.
To install that wrapper, download the official certbot-auto program to /usr/local/bin/certbot-auto-upstream, and copy the wrapper to /usr/local/bin/certbot-auto. Make sure both files have proper privileges (chown root:root /usr/local/bin/certbot-auto*, then chmod 755 /usr/local/bin/certbot-auto*). In the wrapper file, make sure the line CERTBOT_PLUGINS="..." includes the list of plugins you actually need. And that's it. Simply use the certbot-auto command, as you would have done previously, and forget about the certbot-auto-upstream file.
