How to change the Certbot account email

A Certbot account email is where the ACME certificate authority sends important certificate and account notices. If the address points to a former operator, deleted mailbox, or unmonitored personal inbox, certificates can keep renewing while expiry, revocation, or account notices go to the wrong place.

Certbot updates the contact address on the ACME account selected by the local Certbot configuration. The change does not issue, replace, revoke, or reinstall any certificates; it changes the account contact used for future CA notices.

Run the change on the host and configuration tree that owns the account used for renewals, normally the server where /etc/letsencrypt is maintained. If the host uses a non-default ACME server, containerized Certbot directory, or custom --config-dir, use the same settings for the email update so the intended account is changed.

Steps to change the Certbot account email:

Show the Certbot account configured on the host.

$ sudo certbot show_account
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Account details for server https://acme-v02.api.letsencrypt.org/directory:
  Account URL: https://acme-v02.api.letsencrypt.org/acme/acct/123456789
  Account Thumbprint: L2xH2YvJdP8qJQ-example-thumbprint
  Email contact: old-certbot-contact@your-domain.com

Use this step to confirm the account and ACME server before changing the contact address. Some current Certbot and ACME server combinations may show Email contact: none even after a successful update, so keep the later update_account success output as the change record.

Choose the new monitored mailbox for certificate notices, such as pki@your-domain.com.

Use a shared operations mailbox or distribution group instead of a personal address when several people own certificate renewals.
Update the account email address.
```
$ sudo certbot update_account --email pki@your-domain.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Your e-mail address was updated to pki@your-domain.com.
```
If Certbot asks for the current ACME Subscriber Agreement, accept it only if you are authorized to do so. For an approved non-interactive run, add --non-interactive and --agree-tos to the same command.
Repeat the update with the same account-selection options if this Certbot installation does not use the default account path or ACME server.
```
$ sudo certbot update_account --config-dir /srv/certbot/config --work-dir /srv/certbot/work --logs-dir /srv/certbot/logs --email pki@your-domain.com
Saving debug log to /srv/certbot/logs/letsencrypt.log
Your e-mail address was updated to pki@your-domain.com.
```
Use this form only when renewals already use custom Certbot directories. For staging or another CA, include the same --staging or --server setting used by that account.
Display the account again and record the result.
```
$ sudo certbot show_account
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Account details for server https://acme-v02.api.letsencrypt.org/directory:
  Account URL: https://acme-v02.api.letsencrypt.org/acme/acct/123456789
  Account Thumbprint: L2xH2YvJdP8qJQ-example-thumbprint
  Email contact: pki@your-domain.com
```
If the command still shows Email contact: none but update_account returned the success message with the new address, do not delete or reissue certificates just to force an email prompt. Keep the success transcript with the account URL and check future CA notices through the monitored mailbox.

Repeat the change on any other host that owns a separate Certbot account for the same service.

$ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: host.example.com
    Domains: host.example.com www.host.example.com
    Expiry Date: 2026-09-04 03:51:58+00:00 (VALID: 83 days)
    Certificate Path: /etc/letsencrypt/live/host.example.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/host.example.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Certificate names are not account names, but this check helps identify other renewal hosts or config trees that may need the same account-contact review.