coldfix / certbot-dns-netcup Goto Github PK

47.0 7.0 6.0 85 KB

netcup DNS Authenticator plugin for Certbot

License: Other

Dockerfile 3.70% Python 96.30%

certbot-dns-netcup's Introduction

certbot-dns-netcup

netcup DNS Authenticator plugin for certbot.

This plugin automates the process of completing a dns-01 challenge by creating, and subsequently removing, TXT records using the netcup CCP API via lexicon.

Note: This manual assumes certbot ≥ v1.7, which has improved the naming scheme for external plugins. If you cannot upgrade, please also refer to the Old option naming scheme section below.

Installation

Since this package acts as a plugin for certbot, the installation method can vary depending on how certbot is installed.

pip

If certbot is installed normally as a python package, the plugin can be installed using:

pip install certbot-dns-netcup

snap

If certbot is installed as a snap, you'll have to install this plugin as follows:

sudo snap install certbot-dns-netcup

Furthermore, the following seems to be required in order to connect the plugin to certbot:

sudo snap set certbot trust-plugin-with-root=ok
sudo snap connect certbot:plugin certbot-dns-netcup

docker

Using docker, you can pull an image that contains both certbot and a matching version of the plugin:

docker pull coldfix/certbot-dns-netcup

Usage

To acquire a single certificate for both example.com and *.example.com, waiting 1200 seconds (20min) for DNS propagation:

certbot certonly \\
  --authenticator dns-netcup \\
  --dns-netcup-credentials ~/.secrets/certbot/netcup.ini \\
  --dns-netcup-propagation-seconds 1200 \\
  --keep-until-expiring --non-interactive --expand \
  --server https://acme-v02.api.letsencrypt.org/directory \
  -d 'example.com' \\
  -d '*.example.com'

The parameters and the format of the credentials file are described below.

Named Arguments

To start using DNS authentication for netcup, pass the following arguments on certbot's command line:

`--authenticator dns-netcup`	select the authenticator plugin (Required)
`--dns-netcup-credentials FILE`	netcup credentials INI file. (Required)
`--dns-netcup-propagation-seconds NUM`	waiting time for DNS to propagate before asking the ACME server to verify the DNS record. (Default: 900, Recommended: >= 600)

NOTE: You may need to set an unexpectedly high propagation time (≥ 900 seconds) to give the netcup DNS time to propagate the entries! This may be annoying when calling certbot manually but should not be a problem in automated setups. In exceptional cases, 20 minutes may be required. See #28.

Credentials

Use of this plugin requires a configuration file containing netcup API credentials, obtained from your netcup account page. See also the CCP API documentation.

An example credentials.ini file:

dns_netcup_customer_id  = 123456
dns_netcup_api_key      = 0123456789abcdef0123456789abcdef01234567
dns_netcup_api_password = abcdef0123456789abcdef01234567abcdef0123

The path to this file can be provided interactively or using the --dns-netcup-credentials command-line argument. Certbot records the path to this file for use during renewal, but does not store the file's contents.

CAUTION: You should protect these API credentials as you would the password to your netcup account. Users who can read this file can use these credentials to issue arbitrary API calls on your behalf. Users who can cause Certbot to run using these credentials can complete a dns-01 challenge to acquire new certificates or revoke existing certificates for associated domains, even if those domains aren't being managed by this server.

Certbot will emit a warning if it detects that the credentials file can be accessed by other users on your system. The warning reads "Unsafe permissions on credentials configuration file", followed by the path to the credentials file. This warning will be emitted each time Certbot uses the credentials file, including for renewal, and cannot be silenced except by addressing the issue (e.g., by using a command like chmod 600 to restrict access to the file).

Docker

You can pull the latest version of the docker image directly from Docker Hub as follows:

docker pull coldfix/certbot-dns-netcup

Alternatively, the docker image can be built from a local checkout and the included Dockerfile as follows:

docker build -t coldfix/certbot-dns-netcup .

Once that's finished, the application can be run as follows:

docker run --rm \
  -v /var/lib/letsencrypt:/var/lib/letsencrypt \
  -v /etc/letsencrypt:/etc/letsencrypt \
  --cap-drop=all \
  coldfix/certbot-dns-netcup certbot certonly \
    --authenticator dns-netcup \
    --dns-netcup-propagation-seconds 900 \
    --dns-netcup-credentials /var/lib/letsencrypt/netcup_credentials.ini \
    --keep-until-expiring --non-interactive --expand \
    --server https://acme-v02.api.letsencrypt.org/directory \
    --agree-tos --email "[email protected]" \
    -d example.com -d '*.example.com'

You may want to change the volumes /var/lib/letsencrypt and /etc/letsencrypt to local directories where the certificates and configuration should be stored.

Old option naming scheme

It is recommended to use the newest certbot version, at least v1.7.

If you're using a certbot version below v1.7 all options related to external plugins (such as this one) must be prefixed by the name of the plugin. This means that every occurence of dns-netcup in the command line options must be replaced by certbot-dns-netcup:dns-netcup, i.e.:

--authenticator certbot-dns-netcup:dns-netcup
--certbot-dns-netcup:dns-netcup-credentials
--certbot-dns-netcup:dns-netcup-propagation-seconds

Further, every occurence of dns_netcup in the config file must be prefixed by certbot_dns_netcup:, resulting in a file like this:

certbot_dns_netcup:dns_netcup_customer_id  = ...
certbot_dns_netcup:dns_netcup_api_key      = ...
certbot_dns_netcup:dns_netcup_api_password = ...

certbot-dns-netcup's People

Contributors

Stargazers

Watchers

Forkers

miigotu kagenoki andybe mdartmann tobwen mustafaelms

certbot-dns-netcup's Issues

Missing Snap Arm64

Installation via Arm64 is not possible

https://snapcraft.io/docs/architectures

Issue with docker run instructions

I tried following the docker instruction but I had the error certbot: error: unrecognized arguments: certbot. Apparently certbot is executed already so I had to remove it and it almost worked

docker run --rm \
  -v /var/lib/letsencrypt:/var/lib/letsencrypt \
  -v /etc/letsencrypt:/etc/letsencrypt \
  --cap-drop=all \
  coldfix/certbot-dns-netcup certonly \
    --authenticator dns-netcup \
    --dns-netcup-propagation-seconds 900 \
    --dns-netcup-credentials /var/lib/letsencrypt/netcup_credentials.ini \
    --no-self-upgrade \
    --keep-until-expiring --non-interactive --expand \
    --server https://acme-v02.api.letsencrypt.org/directory \
    -d example.com -d '*.example.com'

after that I still had issues and the message You should register before running non-interactively, or provide --agree-tos and --email <email_address> flags.

docker run --rm \
  -v /var/lib/letsencrypt:/var/lib/letsencrypt \
  -v /etc/letsencrypt:/etc/letsencrypt \
  --cap-drop=all \
  coldfix/certbot-dns-netcup certonly \
    --authenticator dns-netcup \
    --dns-netcup-propagation-seconds 900 \
    --dns-netcup-credentials /var/lib/letsencrypt/netcup_credentials.ini \
    --no-self-upgrade \
    --keep-until-expiring --non-interactive --expand \
    --server https://acme-v02.api.letsencrypt.org/directory \
    --agree-tos \
    --email [email protected] \
    -d example.com -d '*.example.com'

This made it work

Timeout connecting API backend

I was trying this plugin today and had connection timeouts while connecting to the Netcup API backend. The server seems to be really slow. I am not sure if this is temporary issue but it might be a good idea to add a timeout parameter to the plugin.

I fixed this for me by adding a hard coded value of 30 seconds. The default from nc_dnsapi is 5 seconds.

def _get_netcup_client(self):
    credentials = self.credentials.conf
    return nc_dnsapi.Client(
        credentials('customer-id'),
        credentials('api-key'),
        credentials('api-password'), 30)

Thanks for you work on this plugin!

ARM builds?

Is it possible to provide ARM builds out of the box ? I checked the base image https://hub.docker.com/r/certbot/certbot/tags?page=1&name=arm64 and simply built the Dockerfile using the base image tag 'arm64v8-v1.26.0'.
I have setup an ARM Ampere vps in the oracle free cloud tier and this is why I needed this architecture.

Assuming podman instead of docker is used on linux one just needs to

clone this repo
replace first line with 'FROM docker.io/certbot/certbot:arm64v8-v1.26.0'
change to the directory of the Dockerfile and run podman build -t certbot-netcup .

This results in a local image 'localhost/certbot-netcup' which works on the mentioned ARM machine.

(if using docker just replace 'podman' with 'docker')

Unexpected keyword argument 'type'

Hello,

I've noticed an error when using this plugin! The full CLI output is as follows:

bug@github:~$ sudo certbot certonly --authenticator dns-netcup --dns-netcup-credentials /root/.secrets/d
omain-credentials.ini --dns-netcup-propagation-seconds 900 --non-interactive -d *.censor.ed --key-type ecdsa
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-netcup, Installer None
Requesting a certificate for *.censor.ed
Performing the following challenges:
dns-01 challenge for censor.ed
Cleaning up challenges
Encountered exception during recovery: TypeError: delete_record() got an unexpected keyword argument 'type'
An unexpected error occurred:
TypeError: create_record() got an unexpected keyword argument 'type'
Please see the logfiles in /var/log/letsencrypt for more details.

What is going on? My certbot version is certbot 1.12.0 and my server is running Debian 11.

It seems that only one subdomain level is supported

If I use domain names like
srv.sub.example.org
the following error message is thrown:

Exception: Value in field domainname does not match requirements of type: domainname.  (4013)

Could it be that in these cases the domain name is not properly extracted?

unrecognized arguments: --certbot-dns-netcup

It seems that something didn't install correctly on my server.

I issued the following command:

certbot certonly \
   --authenticator certbot-dns-netcup:dns-netcup \
   --certbot-dns-netcup:dns-netcup-propagation-seconds 900 \
   --certbot-dns-netcup:dns-netcup-credentials \
       ~/.secrets/certbot/netcup.ini \
   --server https://acme-v02.api.letsencrypt.org/directory \
   -d 'example.com' -d '*.example.com'

and this was the result:

usage:
  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate.
certbot: error: unrecognized arguments: --certbot-dns-netcup:dns-netcup-propagation-seconds 900 --certbot-dns-netcup:dns-netcup-credentials /user/.secrets/certbot/netcup.ini

I've installed certbot with the commands found here:

sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install certbot python-certbot-apache

unrecognized arguments: --dns-netcup-credentials --dns-netcup-propagation-seconds

After installing and running the certbot I'm getting this error:

certbot: error: unrecognized arguments: --dns-netcup-credentials /root/.secrets/certbot/netcup.ini --dns-netcup-propagation-seconds 900

Requirement.parse('acme>=0.40.0'))

I'm getting an error when trying to run certbot-dns-netcup on Ubuntu 18.4:

pkg_resources.VersionConflict: (acme 0.31.0 (/usr/lib/python3/dist-packages), Requirement.parse('acme>=0.40.0'))

Best

Exception: The session id is not in a valid format. (4001)

I'm not sure if this is an error from the client or an error from the netcup API, but as I'm trying to request a new certificate I get the following error:

Exiting abnormally:
Traceback (most recent call last):
  File "/snap/certbot/3643/bin/certbot", line 8, in <module>
    sys.exit(main())
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/_internal/main.py", line 1894, in main
    return config.func(config, plugins)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/_internal/main.py", line 1600, in certonly
    lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/_internal/main.py", line 143, in _get_and_save_cert
    lineage = le_client.obtain_and_enroll_certificate(domains, certname)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/_internal/client.py", line 517, in obtain_and_enroll_certificate
    cert, chain, key, _ = self.obtain_certificate(domains)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/_internal/client.py", line 428, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/_internal/client.py", line 496, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/_internal/auth_handler.py", line 88, in handle_authorizations
    resps = self.auth.perform(achalls)
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/plugins/dns_common.py", line 76, in perform
    self._perform(domain, validation_domain_name, validation)
  File "/snap/certbot-dns-netcup/current/lib/python3.8/site-packages/certbot_dns_netcup.py", line 69, in _perform
    self._get_netcup_client().add_txt_record(
  File "/snap/certbot/3643/lib/python3.8/site-packages/certbot/plugins/dns_common_lexicon.py", line 63, in add_txt_record
    self.provider.create_record(rtype='TXT', name=record_name, content=record_content)
  File "/snap/certbot-dns-netcup/current/lib/python3.8/site-packages/lexicon/_private/providers/netcup.py", line 60, in create_record
    self._update_records(
  File "/snap/certbot-dns-netcup/current/lib/python3.8/site-packages/lexicon/_private/providers/netcup.py", line 151, in _update_records
    return self._apicall(
  File "/snap/certbot-dns-netcup/current/lib/python3.8/site-packages/lexicon/_private/providers/netcup.py", line 175, in _apicall
    raise Exception(f"{data['longmessage']} ({data['statuscode']})")
Exception: The session id is not in a valid format. (4001)
An unexpected error occurred:
Exception: The session id is not in a valid format. (4001)

This is taken from the API-Log:

certbot v2: AttributeError: module 'certbot.interfaces' has no attribute 'IAuthenticator'

bug report

After upgrading to https://github.com/certbot/certbot/releases/tag/v2.0.0, renew fails.

log

2022-11-27 04:18:21,312:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/opt/.local/bin/certbot", line 8, in <module>
    sys.exit(main())
  File "/opt/.local/pipx/venvs/certbot/lib/python3.9/site-packages/certbot/main.py", line 19, in main
    return internal_main.main(cli_args)
  File "/opt/.local/pipx/venvs/certbot/lib/python3.9/site-packages/certbot/_internal/main.py", line 1707, in main
    plugins = plugins_disco.PluginsRegistry.find_all()
  File "/opt/.local/pipx/venvs/certbot/lib/python3.9/site-packages/certbot/_internal/plugins/disco.py", line 208, in find_all
    cls._load_entry_point(entry_point, plugins)
  File "/opt/.local/pipx/venvs/certbot/lib/python3.9/site-packages/certbot/_internal/plugins/disco.py", line 215, in _load_entry_point
    plugin_ep = PluginEntryPoint(entry_point)
  File "/opt/.local/pipx/venvs/certbot/lib/python3.9/site-packages/certbot/_internal/plugins/disco.py", line 56, in __init__
    self.plugin_cls: Type[interfaces.Plugin] = entry_point.load()
  File "/opt/.local/pipx/shared/lib/python3.9/site-packages/pkg_resources/__init__.py", line 2471, in load
    return self.resolve()
  File "/opt/.local/pipx/shared/lib/python3.9/site-packages/pkg_resources/__init__.py", line 2477, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
  File "/opt/.local/pipx/venvs/certbot/lib/python3.9/site-packages/certbot_dns_netcup.py", line 22, in <module>
    @zope.interface.implementer(interfaces.IAuthenticator)
AttributeError: module 'certbot.interfaces' has no attribute 'IAuthenticator'
2022-11-27 04:18:21,312:ERROR:certbot._internal.log:An unexpected error occurred:
2022-11-27 04:18:21,312:ERROR:certbot._internal.log:AttributeError: module 'certbot.interfaces' has no attribute 'IAuthenticator'

hint

helgeerbe/certbot-dns-ionos@c12f443

Challenge failed

I tried to create a new cert for one of my subdomains. Installed a clean new certbot and setup the plugin but when I run the command to get the certs, I get a "Challenge failed".

My netcup api-key and api-password is working as I've tested it with a different script and was able to update dns settings.

Running on macOS Catalina and certbot 1.0.0. Any hints?

How to use this Plugin with Certbot v2.4

Hey,

I try to setup a certificate Server using the latest Certbot Version (2.4) - This Plugins works fine on my other Server with Certbot V.1.19 installed.
Certbot 2.4 does not seem to find the Plugin when installed (Certbot is installed using SNAP (and for testing Python)... According to this: https://community.letsencrypt.org/t/the-requested-plugin-does-not-appear-to-be-installed/190632/2 the naming scheme was changed in V.2... - I've seen that you already changed something to allow this plugin working with Certbot 2.4 but when I use certbot plugin command it can't be find :/

Did this plugin work in general with Certbot V2.4 or is it planned to make it working? - using the SNAP installation method ^^

Thank you for this great Plugin it helped me a llot during the last years :).

~j54j6

Type error still in docker container

Hey, the TypeError (#11) problem got fixed in certbot 1.16.0. Could you please publish a new docker image with the fixed version?
Still getting the error there. :)

Please set the default --dns-netcup-propagation-seconds >= 630

Hi @coldfix, please have a look at:

and especially the netcup forum, for example, most clearly:

https://forum.netcup.de/netcup-applications/ccp-customer-control-panel/p168229-nxdomain-looking-up-txt-for-acme-challenge-subdomain-lokale-ip/#post168229

Zwischen des Eintrags der challenge als TXT und dem Verifizierungsvorgang habe ich 300 Sekunden gewartet. Sind hier 5min zu wenig Zeit?

Definitiv, da der Reload der DNS-Zonen immer nur alle 10 Minuten stattfindet. In Ausnahmefällen dauert es manchmal auch 20 Minuten.

So the absolute bare minimum for netcup would be 10 minutes, but to give DNS 5 minutes to propagate, you need 900 seconds.

I needed to use 900 to make the DNS challenge it work. You can check the DNS output of the netcups DNS using:

$ while true;do dig +short -t txt _acme-challenge.subdomain.yourdomain.at root-dns.netcup.net;sleep 10;done

DerRene (with bonn13 confirming) reports that he uses 630 seconds since a long time, but their messages are from 2021, so you may want to confirm that it really works (and it likely only works when DNSSEC is not enabled for the zone), like m_ueberall wrote above it:
https://forum.netcup.de/netcup-applications/ccp-customer-control-panel/p168232-nxdomain-looking-up-txt-for-acme-challenge-subdomain-lokale-ip/#post168232

QUESTION: Will the docker container check for updates if run continuously

I am planing to run this via docker compose in combination with other containers.
I am wondering if I can run this continuously and if I do so if it will renew certificates automatically.

Unexpected Keyword 'type'

Hi guys & girls,

I was using your example script to obtain my own certificate using this authenticator. Unfortunately I ran into the following error message:

2021-05-02 20:35:48,901:DEBUG:lexicon.providers.netcup:login({})
2021-05-02 20:35:48,904:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): ccp.netcup.net:443
2021-05-02 20:35:49,056:DEBUG:urllib3.connectionpool:https://ccp.netcup.net:443 "POST /run/webservice/servers/endpoint.php?JSON HTTP/1.1" 200 227
2021-05-02 20:35:49,059:DEBUG:lexicon.providers.netcup:infoDnsZone({'domainname': 'carlo-hildebrandt.de'})
2021-05-02 20:35:49,061:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): ccp.netcup.net:443
2021-05-02 20:35:49,235:DEBUG:urllib3.connectionpool:https://ccp.netcup.net:443 "POST /run/webservice/servers/endpoint.php?JSON HTTP/1.1" 200 246
2021-05-02 20:35:49,239:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/certbot/_internal/auth_handler.py", line 70, in handle_authorizations
    resps = self.auth.perform(achalls)
  File "/usr/lib/python3.9/site-packages/certbot/plugins/dns_common.py", line 60, in perform
    self._perform(domain, validation_domain_name, validation)
  File "/usr/local/lib/python3.9/site-packages/certbot_dns_netcup.py", line 58, in _perform
    self._get_netcup_client().add_txt_record(
  File "/usr/lib/python3.9/site-packages/certbot/plugins/dns_common_lexicon.py", line 48, in add_txt_record
    self.provider.create_record(type='TXT', name=record_name, content=record_content)
TypeError: create_record() got an unexpected keyword argument 'type'

The program aborted and I did not obtain any certificates. The shown message indicates an internal error in the lexicon library. But I am not sure if that error is caused by a bug in the library implementation or by the way it is integrated into this project. Can you help me identifying the root of all evil?

I am running on a fedora machine with certbot 1.14.0 and certbot-dns-netcup 1.1.0 installed.

Already thanks in advance!
Best regards

'Namespace' object has no attribute 'certbot_dns_netcup:dns_netcup_propagation_seconds'

I get the following error every time the automatic certbot-task starts:

certbot[*****]: Renewal configuration file /etc/letsencrypt/renewal/domain.tld.conf (cert: domain.tld) produced an unexpected error: 'Namespace' object has no attribute 'certbot_dns_netcup:dns_netcup_propagation_seconds'. Skipping.
certbot[*****]: Renewal configuration file /etc/letsencrypt/renewal/domain2.tld.conf (cert: domain2.tld) produced an unexpected error: 'Namespace' object has no attribute 'certbot_dns_netcup:dns_netcup_propagation_seconds'. Skipping.
certbot[*****]: 0 renew failure(s), 2 parse failure(s)

Excerpt from Configuration-File:

# Options used in the renewal process
[renewalparams]
authenticator = certbot-dns-netcup:dns-netcup
certbot_dns_netcup:dns_netcup_propagation_seconds = 900

It seems like the certificates don't get automatically renewed

Timeout connecting API backend with timeout=30

Hi,
i have a similar problem to #2. i have changed the timeout to 30 seconds but it doesn't work.
The setup is using a docker container to run the certbot for a wildcard domain. Everytime i run it, it shows the following in the log

Unsafe permissions on credentials configuration file: /var/lib/letsencrypt/netcup_credentials.ini
Cleaning up challenges
Encountered exception during recovery:
Traceback (most recent call last):
  File "/opt/certbot/src/certbot/error_handler.py", line 108, in _call_registered
    self.funcs[-1]()
  File "/opt/certbot/src/certbot/auth_handler.py", line 316, in _cleanup_challenges
    self.auth.cleanup(achalls)
  File "/opt/certbot/src/certbot/plugins/dns_common.py", line 76, in cleanup
    self._cleanup(domain, validation_domain_name, validation)
  File "/usr/local/lib/python2.7/site-packages/certbot_dns_netcup/dns_netcup.py", line 54, in _cleanup
    with self._get_netcup_client() as api:
  File "/usr/local/lib/python2.7/site-packages/certbot_dns_netcup/dns_netcup.py", line 64, in _get_netcup_client
    credentials('api-password'),timeout=30)
  File "/usr/local/lib/python2.7/site-packages/nc_dnsapi/__init__.py", line 186, in __init__
    self.login()
  File "/usr/local/lib/python2.7/site-packages/nc_dnsapi/__init__.py", line 101, in login
    data = self.request("login", params={"apipassword": self.__api_password})
  File "/usr/local/lib/python2.7/site-packages/nc_dnsapi/__init__.py", line 80, in request
    timeout=self.__api_timeout
  File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 116, in post
    return request('post', url, data=data, json=json, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 60, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 524, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 637, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/requests/adapters.py", line 529, in send
    raise ReadTimeout(e, request=request)
ReadTimeout: HTTPSConnectionPool(host='ccp.netcup.net', port=443): Read timed out. (read timeout=30)
An unexpected error occurred:
ReadTimeout: HTTPSConnectionPool(host='ccp.netcup.net', port=443): Read timed out. (read timeout=30)
Please see the logfiles in /var/log/letsencrypt for more details.

Kind regards
Stefan

Make package available on snap

It looks like the issue some people were having (and I am having it right now too), that the plugin is not recognized by certbot, is caused by using a snap installation of certbot.
Using snap is the strongly suggested method of installation for certbot though.
Apparently, certbot installs it's own Python and uses that, so installing the dns-netcup pip package on the normal python enviroment does not make it available to certbot. I also tried accessing the snap python and installing the plugin there but I could not get it to work. According to the certbot forum, the "correct" method of installing plugins for the snap version of certbot is installing them as snap packages ( https://community.letsencrypt.org/t/certbot-dns-plugin-listed-in-certbot-plugins-but-still-not-working/139614/9 ), so having this package on snap would probably fix this issue.