Certbot 5.10.0 has just been released. The changelog for the release is: Fixed Fixes a race condition in the webroot plugin where, if the webroot could be modified by a less privileged user while Certbot ran, the ownership and mode of an unintended file could be changed instead of those of the challenge directory Certbot had just created. Rejects invalid ARI suggested renewal windows whose end time is not after their start time.