[Bug]: webroot related renewal properties remain after reconfigure
OS
Ubuntu 24.04
Installation method
docker (certbot/dns-dnsimple)
Certbot Version
5.7.0
What happened?
I had an existing certificate with the following webroot based renewal configuration
$ docker exec certbot cat /etc/letsencrypt/renewal/example.com.conf
# renew_before_expiry = 30 days
version = 5.6.0
archive_dir = /etc/letsencrypt/archive/example.com
cert = /etc/letsencrypt/live/example.com/cert.pem
privkey = /etc/letsencrypt/live/example.com/privkey.pem
chain = /etc/letsencrypt/live/example.com/chain.pem
fullchain = /etc/letsencrypt/live/example.com/fullchain.pem
# Options used in the renewal process
[renewalparams]
account = ACCOUNTID
authenticator = webroot
webroot_path = /webroot-files,
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
[[webroot_map]]
example.com = /webroot-files
www.example.com = /webroot-files
[acme_renewal_info]
ari_retry_after = 2026-07-15T14:26:27I then ran the reconfigure command to switch from --webroot to DNS based renewal for consistency with other certs.
$ docker exec -it certbot certbot reconfigure --cert-name example.com --authenticator dns-dnsimple --dns-dnsimple-credentials /certbot-creds/dnsimple.ini --installer None
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Simulating renewal of an existing certificate for example.com and www.example.com
Waiting 30 seconds for DNS changes to propagate
Successfully updated configuration.
Changes will apply when the certificate renews.When I inspected the renewal configuration I now find an amalgamation of the webroot and dns properties.
$ docker exec certbot cat /etc/letsencrypt/renewal/example.com.conf
# renew_before_expiry = 30 days
version = 5.7.0
archive_dir = /etc/letsencrypt/archive/example.com
cert = /etc/letsencrypt/live/example.com/cert.pem
privkey = /etc/letsencrypt/live/example.com/privkey.pem
chain = /etc/letsencrypt/live/example.com/chain.pem
fullchain = /etc/letsencrypt/live/example.com/fullchain.pem
# Options used in the renewal process
[renewalparams]
account = ACCOUNTID
authenticator = dns-dnsimple
webroot_path = /webroot-files,
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
dns_dnsimple_credentials = /certbot-creds/dnsimple.ini
[[webroot_map]]
example.com = /webroot-files
www.example.com = /webroot-files
[acme_renewal_info]
ari_retry_after = 2026-07-15T14:26:27I tried explicitly setting --webroot=FALSE but received the following error
certbot: error: argument --webroot: ignored explicit argument 'FALSE'
Expected behavior
I would have expected the resulting config file to no longer have references to the (hopefully?) no longer needed webroot configuration.
Relevant log output
This appears to have a bunch of debug level logs by default? I don't think I've got Debug logging explictly enabled anyway. But here's some of the log lines around saving the configuration after the staging check succeeded.
2026-07-15 20:37:55,746:DEBUG:certbot._internal.renewal:Dry run: skipping updating lineage at /etc/letsencrypt/live/example.com
2026-07-15 20:37:55,858:DEBUG:certbot.configuration:Var account=ACCOUNTID (set by user).
2026-07-15 20:37:55,861:DEBUG:certbot.configuration:Var key_type=ecdsa (set by user).
2026-07-15 20:37:55,863:DEBUG:certbot.configuration:Var server=https://acme-v02.api.letsencrypt.org/directory (set by user).
2026-07-15 20:37:55,865:DEBUG:certbot._internal.plugins.selection:Requested authenticator dns-dnsimple and installer None
2026-07-15 20:37:55,867:DEBUG:certbot._internal.plugins.selection:Requested authenticator dns-dnsimple and installer None
2026-07-15 20:37:55,869:DEBUG:certbot.configuration:Var dns_dnsimple_credentials=/certbot-creds/dnsimple.ini (set by user).
2026-07-15 20:37:55,871:DEBUG:certbot.configuration:Var webroot_path=['/webroot-files'] (set by user).
2026-07-15 20:37:55,872:DEBUG:certbot.configuration:Var webroot_map={'example.com': '/webroot-files', 'www.example.com': '/webroot-files'} (set by user).
2026-07-15 20:37:55,921:DEBUG:certbot._internal.display.obj:Notifying user:
Successfully updated configuration.
Changes will apply when the certificate renews.Source: certbot/certbot