# certbot

get a Let's Encrypt certificate

The step runs certbot certonly. Renewal stays with certbot's own timer. Install the package certbot in an earlier pkg step. The nginx and apache authenticators also need python3-certbot-nginx or python3-certbot-apache.

## Keys

| Key | Type | Default | Meaning |
| --- | --- | --- | --- |
| [`name`](#certbot.name) | string | required | certificate name in /etc/letsencrypt |
| [`domains`](#certbot.domains) | string or list of strings | required | no wildcards |
| [`email`](#certbot.email) | string | required | Let's Encrypt account address |
| [`authenticator`](#certbot.authenticator) | string | nginx | challenge plugin |
| [`webroot_path`](#certbot.webroot_path) | string | - | web root for webroot |
| [`pre_hook`](#certbot.pre_hook) | string | - | command before each try |
| [`post_hook`](#certbot.post_hook) | string | - | command after each try |
| [`deploy_hook`](#certbot.deploy_hook) | string | - | command after each new certificate |
| [`reuse_key`](#certbot.reuse_key) | boolean | false | keep the private key at renewal |

### `certbot.name` {#certbot.name}

string, required

Certificate name in /etc/letsencrypt.

### `certbot.domains` {#certbot.domains}

string or list of strings, required

No wildcards. A wildcard needs a DNS challenge.

### `certbot.email` {#certbot.email}

string, required

Let's Encrypt account address.

### `certbot.authenticator` {#certbot.authenticator}

string, default nginx

Challenge plugin: nginx, apache, standalone, or webroot. The nginx and apache plugins do not change the config of the web server. When a challenge runs, they reload it, and the plan says so. standalone binds port 80 itself; pre\_hook and post\_hook can stop and start what holds that port. webroot needs webroot\_path.

### `certbot.webroot_path` {#certbot.webroot_path}

string

Web root for webroot.

### `certbot.pre_hook` {#certbot.pre_hook}

string

Command before each try to get a certificate. certbot stores it in a file that other users can read, so it cannot hold a secret. A hook that needs a secret reads it from a root-only file that a file step writes.

### `certbot.post_hook` {#certbot.post_hook}

string

Command after each try to get a certificate. certbot stores it in a file that other users can read, so it cannot hold a secret.

### `certbot.deploy_hook` {#certbot.deploy_hook}

string

Command after each new certificate, also the first. A failed hook fails the step, and the next apply runs it again. It cannot hold a secret.

### `certbot.reuse_key` {#certbot.reuse_key}

boolean, default false

Keep the private key at renewal.

## Example

```yaml
- certbot:
    name: mail
    domains: [mail.example.com]
    email: admin@example.com
    deploy_hook: systemctl reload postfix
```