== Why we're going to be using Certbot as our new Let's Encrypt client [[We need a new Let's Encrypt client to replace _acmetool_ LetsEncryptClientWants]], and I'm on record as not particularly liking [[Certbot https://certbot.eff.org/]]; it lacks some features that are important to us, it's a pretty big program, and it's quite ornate (and there's the issue of the EFF trying to get you to sign up for their mailing list when you register a Let's Encrypt account with an email address). But despite that, Certbot is going to be our future Let's Encrypt client unless we uncover some fatal problem as we finalize how we're going to operate it. The reason why is very simple; ~~I never want to go through changing clients again~~, because [[changing clients is very disruptive and a lot of work LetsEncryptClientChangeHassle]]. We're forced to change clients now because our previous client of choice has stopped being maintained and hasn't kept up with Let's Encrypt's changes. Certbot is pretty much the closest thing Let's Encrypt has to an official client, so the odds are very good that it will keep up with any Let's Encrypt changes, and probably also any other changes needed to keep working on popular Linuxes such as various versions of Ubuntu LTS. ([[Let's Encrypt officially recommends Certbot https://letsencrypt.org/docs/client-options/]] and has for some time.) Certbot is not my ideal Let's Encrypt client. But it is a workable client (and we can make it more workable with a cover script), and it's extremely likely to stay that way for as long as we want to use Let's Encrypt. This is good enough to make it my choice. (On a pragmatic basis, Certbot also seems to be the closest I can get to _acmetool_ in a client that is written in a way that I'm okay with. In particular, as someone who has dealt with OpenSSL and written things in Bash, my view is that I don't think either are the right foundation for a Let's Encrypt client that I want to entrust our systems to. I admire the spirit of aggressive minimalism that makes people write Let's Encrypt clients with little or no dependencies, but that isn't what's important to us.) === Sidebar: I don't regret picking _acmetool_ way back when Back when [[I initially picked _acmetool_ LetsEncryptMyClients]], my usage case was different and Certbot was significantly more work and more intrusive to install than it is today. Carrying over using _acmetool_ [[when we switched to Let's Encrypt LetsEncryptSwitchover]] was natural, and it worked well. Also, acmetool is a very simple client to use and in the beginning that was important to us because we weren't sold on [[the benefits of Let's Encrypt ../web/LetsEncryptAutomationGreat]]; a complex install and operation process wouldn't have been half as attractive, and we might have kept on using manually obtained TLS certificates (especially after we could get free ones through the university's central IT). In short, _acmetool_ has worked great for years and was the no hassle client we needed at the start. Especially at the time when we started using it, I don't think there was a better alternative for us.