PATH validation fails

[m1raculix]

Certbot 4.0.0 on Debian 13.

It seems certbot changed it's behavoir validating such hook scripts.

Unable to find manual-auth-hook command /root/strato-certbot/strato_certbot/auth-hook.py in the PATH.
(PATH is /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/root/.local/bin)
See also the --disable-hook-validation option.

Please update your README.md to address this issue.

I think the best solution is to have a warpper script in PATH.

[m1raculix]

What I did

1. Move scripts to /opt/
2. Create venv: python3 -m venv /opt/strato-certbot/venv
3. Creeate wrapper script /usr/local/bin/strato-auth-hook

#!/bin/bash
exec /opt/strato-certbot/venv/bin/python -m strato_certbot.auth_hook /path/to/your/auth.json

4. Install all requirements with venv pip (please add a requirements.txt file)
5. Create wrapper script for cleanupo hook as well
6. Edit hooks in ``/etc/letsencrypt/renewal/domain.conf
7. certbot renew

[Buxdehuda]

Hi, thanks for your report.
This seems to be an issue on how the shebang line in the python script is handled for venvs.
You could probably get away without a wrapper script by just directly specifying your exec line that calls the venv python binary.

Btw, the dependencies are specified in the pyproject.toml, pip should be able to install these with pip install .

[m1raculix]

Hi, I did not use venv before the problem occurred. The script was located in /root/ and was executed by systems python instance. I'm pretty sure they changed something in certbot.

[Buxdehuda]

Well in that case it probably is a breaking change in certbot. Feel free to open a PR changing the README with a description of your steps.

But don't put too much work into it, as there will be a better way to get certificates in a few months: https://letsencrypt.org/2026/02/18/dns-persist-01
This hook will probably be obsolete by then.