Certbot vs lego
Certbot
certbot.eff.org
lego
go-acme.github.ioSide by side
| Figure | Certbot | lego |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Certificate Management Software | 8.1 (#9) | 8.5 (#6) |
| Purpose | Certbot automatically uses Let’s Encrypt certificates on manually administered websites to enable HTTPS. | lego is an ACME client and library written in Go for obtaining and renewing certificates. |
| Support | The site points users to project documentation and the Let’s Encrypt community forum for help. | The project links to GitHub issues and discussions for help and community participation. |
Plans
In their own words
Certbot
Certbot is free, open-source software from the Electronic Frontier Foundation for enabling HTTPS on websites that administrators manage themselves. It obtains Let’s Encrypt certificates and can install them on a web server automatically in many cases. The command-line tool names Apache and Nginx integrations, along with webroot and standalone methods. DNS validation avoids requiring an inbound connection from Let’s Encrypt, so it does not depend on an existing HTTP site or an open port 80. Certbot renews certificates when less than one-third of their lifetime remains; for certificates lasting 10 days or less, renewal occurs when half their lifetime remains. It is generally run on a Unix-like server, often remotely over SSH, and is intended for administrators comfortable with command-line work on a dedicated server, VPS or cloud-hosted server. The project points users to its documentation and the Let’s Encrypt community forum for help.
lego
lego is an independent, free, open-source ACME client and Go library for obtaining, renewing, and revoking certificates. It supports wildcard and SAN certificates and can work with multiple ACME servers, including Let’s Encrypt and ZeroSSL. Validation choices include DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01. The project lists more than 200 DNS providers, including Cloudflare, Amazon Route 53, Google Cloud DNS, and Azure DNS, with CNAME support enabled by default. Users can run lego from the command line or call it as a Go library. DNS credentials and settings are supplied through environment variables, with file references and dotenv files supported. Installation options include prebuilt binaries, Docker, package managers, and source. The maintainers look after the AUR and Snap packages; other listed packages are community maintained. The project lists support for ACME RFC 8555 and certificate validation and renewal extensions. It is licensed under MIT, and installing from source requires Go 1.25 or later. The project points to GitHub issues and discussions for help.