Skip to main content

Certbot SSH authenticator plugin

Project description

Certbot-ssh - Certbot SSH authenticator plugin

Certbot-ssh is a plugin for the Certbot ACME client that performs HTTP01 challenge validation on a remote computer through a SSH connection.


The Certbot client assumes it runs on the machine that serves web pages for the requested domain.

That is not always desirable or even possible.

The manual authenticator (--manual) allows to run the client on a separate machine; it is then up to the system administrator to make sure the web server responds appropriately to the HTTP01 challenge, by putting a specific value into a specific file under the .well-known/acme-challenge directory of the web server. This can be quite tedious, especially if you require a cert for many domains.

This plugin provides an automatized version of the “manual” process. Upon receiving the challenge data from the ACME server, it will execute a script on a remote machine through a SSH connexion, and feed it with the challenge data. It is then up to the script to write the challenge tokens at the appropriate place.

A sample script is provided. This script assumes the webroot of a requested domain is under a /var/www/domain directory; you will probably need to adjust it according to the layout of your own web server.


Install the package:

$ python install --user

Tweak the script if needed, then upload it to your server. Put it somewhere in the PATH of the user account you use for SSH connection. Remove the .sh extension and make sure the script is executable.

Then you may call Certbot:

certbot certonly \
  --authenticator incenp.certbot.ssh:ssh \
  --incenp.certbot.ssh:ssh-server \

Note that the client will attempt to write to some system directories on the local machine (/etc/letsencrypt, /var/lib/letsencrypt). Use the --config-dir, --work-dir, and --logs-dir options to specify other directories if you want to run the client from a non-root account.


Certbot-ssh is distributed under the same terms as Certbot itself, that is, the Apache License version 2.0. The full license is included in the COPYING file of the source distribution.

Homepage and repository

The project is located at The latest source code is available at

Project details

Release history Release notifications

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
incenp.certbot.ssh-0.2.2-py2.py3-none-any.whl (9.5 kB) Copy SHA256 hash SHA256 Wheel py2.py3
incenp.certbot.ssh-0.2.2.tar.gz (8.1 kB) Copy SHA256 hash SHA256 Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page