We would really suggest using certbot-auto instead because it will create a venv for you so that you don't get version conflicts elsewhere. (It does use pip behind the scenes, but in a venv.)