diff --git a/pkgs/development/python-modules/certbot-dns-cloudflare/default.nix b/pkgs/development/python-modules/certbot-dns-cloudflare/default.nix
new file mode 100644
index 000000000000..6c14f6c472f7
--- /dev/null
+++ b/pkgs/development/python-modules/certbot-dns-cloudflare/default.nix
@@ -0,0 +1,35 @@
+{ buildPythonPackage
+, acme
+, certbot
+, cloudflare
+, isPy3k
+, pytest
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  inherit (certbot) src version;
+
+  pname = "certbot-dns-cloudflare";
+
+  propagatedBuildInputs = [
+    acme
+    certbot
+    cloudflare
+  ];
+
+  checkInputs = [
+    pytest
+    pytestCheckHook
+  ];
+
+  disabled = !isPy3k;
+
+  pytestFlagsArray = [ "-o cache_dir=$(mktemp -d)" ];
+
+  sourceRoot = "source/${pname}";
+
+  meta = certbot.meta // {
+    description = "Cloudflare DNS Authenticator plugin for Certbot";
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 35deab0785ac..1c5e70817967 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -579,6 +579,8 @@ in {
 
   cdecimal = callPackage ../development/python-modules/cdecimal { };
 
+  certbot-dns-cloudflare = callPackage ../development/python-modules/certbot-dns-cloudflare { };
+
   cfn-flip = callPackage ../development/python-modules/cfn-flip { };
 
   chalice = callPackage ../development/python-modules/chalice { };