diff --git a/certbot-apache/certbot_apache/configurator.py b/certbot-apache/certbot_apache/configurator.py
index 3868451f5..6ff7d328e 100644
--- a/certbot-apache/certbot_apache/configurator.py
+++ b/certbot-apache/certbot_apache/configurator.py
@@ -2345,7 +2345,7 @@ class ApacheConfigurator(common.Installer):
         Enable the AutoHSTS enhancement for defined domains
 
         :param _unused_lineage: Certificate lineage object, unused
-        :type _unused_lineage: certbot.storage.RenewableCert
+        :type _unused_lineage: certbot._internal.storage.RenewableCert
 
         :param domains: List of domains in certificate to enhance
         :type domains: str
@@ -2470,7 +2470,7 @@ class ApacheConfigurator(common.Installer):
         and changes the HSTS max-age to a high value.
 
         :param lineage: Certificate lineage object
-        :type lineage: certbot.storage.RenewableCert
+        :type lineage: certbot._internal.storage.RenewableCert
         """
         self._autohsts_fetch_state()
         if not self._autohsts:
diff --git a/certbot-nginx/local-oldest-requirements.txt b/certbot-nginx/local-oldest-requirements.txt
index a959ad44f..3192f8360 100644
--- a/certbot-nginx/local-oldest-requirements.txt
+++ b/certbot-nginx/local-oldest-requirements.txt
@@ -1,3 +1,3 @@
 # Remember to update setup.py to match the package versions below.
-acme[dev]==0.29.0
-certbot[dev]==0.36.0
+-e acme[dev]
+-e .[dev]
diff --git a/certbot-nginx/setup.py b/certbot-nginx/setup.py
index f3f0b6640..50febc33a 100644
--- a/certbot-nginx/setup.py
+++ b/certbot-nginx/setup.py
@@ -9,8 +9,8 @@ version = '1.0.0.dev0'
 # Remember to update local-oldest-requirements.txt when changing the minimum
 # acme/certbot version.
 install_requires = [
-    'acme>=0.29.0',
-    'certbot>=0.35.0',
+    'acme>=1.0.0.dev0',
+    'certbot>=1.0.0.dev0',
     'mock',
     'PyOpenSSL',
     'pyparsing>=1.5.5',  # Python3 support; perhaps unnecessary?
diff --git a/certbot/_internal/__init__.py b/certbot/_internal/__init__.py
new file mode 100644
index 000000000..45ec6ac9c
--- /dev/null
+++ b/certbot/_internal/__init__.py
@@ -0,0 +1,6 @@
+"""
+Modules internal to Certbot.
+
+This package contains modules that are not considered part of Certbot's public
+API. They may be changed without updating Certbot's major version.
+"""
diff --git a/certbot/account.py b/certbot/_internal/account.py
similarity index 100%
rename from certbot/account.py
rename to certbot/_internal/account.py
diff --git a/certbot/auth_handler.py b/certbot/_internal/auth_handler.py
similarity index 99%
rename from certbot/auth_handler.py
rename to certbot/_internal/auth_handler.py
index a8c8f6e9b..5c037e8dc 100644
--- a/certbot/auth_handler.py
+++ b/certbot/_internal/auth_handler.py
@@ -13,7 +13,7 @@ from acme.magic_typing import Dict, List, Tuple
 # pylint: enable=unused-import, no-name-in-module
 from certbot import achallenges
 from certbot import errors
-from certbot import error_handler
+from certbot._internal import error_handler
 from certbot import interfaces
 
 logger = logging.getLogger(__name__)
@@ -29,7 +29,7 @@ class AuthHandler(object):
     :ivar acme.client.BackwardsCompatibleClientV2 acme_client: ACME client API.
 
     :ivar account: Client's Account
-    :type account: :class:`certbot.account.Account`
+    :type account: :class:`certbot._internal.account.Account`
 
     :ivar list pref_challs: sorted user specified preferred challenges
         type strings with the most preferred challenge listed first
diff --git a/certbot/cert_manager.py b/certbot/_internal/cert_manager.py
similarity index 99%
rename from certbot/cert_manager.py
rename to certbot/_internal/cert_manager.py
index cd228ac12..ed72b12e5 100644
--- a/certbot/cert_manager.py
+++ b/certbot/_internal/cert_manager.py
@@ -12,8 +12,8 @@ from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-
 from certbot import crypto_util
 from certbot import errors
 from certbot import interfaces
-from certbot import ocsp
-from certbot import storage
+from certbot._internal import ocsp
+from certbot._internal import storage
 from certbot import util
 from certbot.compat import os
 from certbot.display import util as display_util
diff --git a/certbot/client.py b/certbot/_internal/client.py
similarity index 99%
rename from certbot/client.py
rename to certbot/_internal/client.py
index 91b54b205..7a0daf77b 100644
--- a/certbot/client.py
+++ b/certbot/_internal/client.py
@@ -18,16 +18,16 @@ from acme import messages
 from acme.magic_typing import Optional, List  # pylint: disable=unused-import,no-name-in-module
 
 import certbot
-from certbot import account
-from certbot import auth_handler
+from certbot._internal import account
+from certbot._internal import auth_handler
 from certbot import cli
 from certbot import constants
 from certbot import crypto_util
 from certbot import eff
-from certbot import error_handler
+from certbot._internal import error_handler
 from certbot import errors
 from certbot import interfaces
-from certbot import storage
+from certbot._internal import storage
 from certbot import util
 from certbot.compat import os
 from certbot.display import enhancements
@@ -408,7 +408,7 @@ class Client(object):
         :param certname: requested name of lineage
         :type certname: `str` or `None`
 
-        :returns: A new :class:`certbot.storage.RenewableCert` instance
+        :returns: A new :class:`certbot._internal.storage.RenewableCert` instance
             referred to the enrolled cert lineage, False if the cert could not
             be obtained, or None if doing a successful dry run.
 
diff --git a/certbot/error_handler.py b/certbot/_internal/error_handler.py
similarity index 100%
rename from certbot/error_handler.py
rename to certbot/_internal/error_handler.py
diff --git a/certbot/lock.py b/certbot/_internal/lock.py
similarity index 100%
rename from certbot/lock.py
rename to certbot/_internal/lock.py
diff --git a/certbot/main.py b/certbot/_internal/main.py
similarity index 99%
rename from certbot/main.py
rename to certbot/_internal/main.py
index 620e33be9..1552131e8 100644
--- a/certbot/main.py
+++ b/certbot/_internal/main.py
@@ -14,10 +14,10 @@ from acme import errors as acme_errors
 from acme.magic_typing import Union  # pylint: disable=unused-import, no-name-in-module
 
 import certbot
-from certbot import account
-from certbot import cert_manager
+from certbot._internal import account
+from certbot._internal import cert_manager
 from certbot import cli
-from certbot import client
+from certbot._internal import client
 from certbot import configuration
 from certbot import constants
 from certbot import crypto_util
@@ -26,10 +26,10 @@ from certbot import errors
 from certbot import hooks
 from certbot import interfaces
 from certbot import log
-from certbot import renewal
-from certbot import reporter
-from certbot import storage
-from certbot import updater
+from certbot._internal import renewal
+from certbot._internal import reporter
+from certbot._internal import storage
+from certbot._internal import updater
 from certbot import util
 from certbot.compat import filesystem
 from certbot.compat import misc
@@ -483,7 +483,7 @@ def _determine_account(config):
 
     :returns: Account and optionally ACME client API (biproduct of new
         registration).
-    :rtype: tuple of :class:`certbot.account.Account` and :class:`acme.client.Client`
+    :rtype: tuple of :class:`certbot._internal.account.Account` and :class:`acme.client.Client`
 
     :raises errors.Error: If unable to register an account with ACME server
 
diff --git a/certbot/notify.py b/certbot/_internal/notify.py
similarity index 100%
rename from certbot/notify.py
rename to certbot/_internal/notify.py
diff --git a/certbot/ocsp.py b/certbot/_internal/ocsp.py
similarity index 99%
rename from certbot/ocsp.py
rename to certbot/_internal/ocsp.py
index 1cc1e7529..2a63412a0 100644
--- a/certbot/ocsp.py
+++ b/certbot/_internal/ocsp.py
@@ -22,7 +22,7 @@ import requests
 from acme.magic_typing import Optional, Tuple  # pylint: disable=unused-import, no-name-in-module
 from certbot import crypto_util
 from certbot import errors
-from certbot.storage import RenewableCert # pylint: disable=unused-import
+from certbot._internal.storage import RenewableCert # pylint: disable=unused-import
 from certbot import util
 
 logger = logging.getLogger(__name__)
diff --git a/certbot/renewal.py b/certbot/_internal/renewal.py
similarity index 99%
rename from certbot/renewal.py
rename to certbot/_internal/renewal.py
index b9b45ee40..c11e675c1 100644
--- a/certbot/renewal.py
+++ b/certbot/_internal/renewal.py
@@ -20,8 +20,8 @@ from certbot import crypto_util
 from certbot import errors
 from certbot import hooks
 from certbot import interfaces
-from certbot import storage
-from certbot import updater
+from certbot._internal import storage
+from certbot._internal import updater
 from certbot import util
 from certbot.compat import os
 from certbot.plugins import disco as plugins_disco
@@ -429,7 +429,7 @@ def handle_renewal_request(config):  # pylint: disable=too-many-locals,too-many-
                 # XXX: ensure that each call here replaces the previous one
                 zope.component.provideUtility(lineage_config)
                 renewal_candidate.ensure_deployed()
-                from certbot import main
+                from certbot._internal import main
                 plugins = plugins_disco.PluginsRegistry.find_all()
                 if should_renew(lineage_config, renewal_candidate):
                     # Apply random sleep upon first renewal if needed
diff --git a/certbot/reporter.py b/certbot/_internal/reporter.py
similarity index 100%
rename from certbot/reporter.py
rename to certbot/_internal/reporter.py
diff --git a/certbot/storage.py b/certbot/_internal/storage.py
similarity index 99%
rename from certbot/storage.py
rename to certbot/_internal/storage.py
index 9bf85fa0f..f19efe728 100644
--- a/certbot/storage.py
+++ b/certbot/_internal/storage.py
@@ -15,7 +15,7 @@ import certbot
 from certbot import cli
 from certbot import constants
 from certbot import crypto_util
-from certbot import error_handler
+from certbot._internal import error_handler
 from certbot import errors
 from certbot import util
 from certbot.compat import os
@@ -248,7 +248,7 @@ def _relevant(namespaces, option):
 
     :rtype: bool
     """
-    from certbot import renewal
+    from certbot._internal import renewal
 
     return (option in renewal.CONFIG_ITEMS or
             any(option.startswith(namespace) for namespace in namespaces))
diff --git a/certbot/updater.py b/certbot/_internal/updater.py
similarity index 100%
rename from certbot/updater.py
rename to certbot/_internal/updater.py
diff --git a/certbot/cli.py b/certbot/cli.py
index 9b116fe3f..7f09f4638 100644
--- a/certbot/cli.py
+++ b/certbot/cli.py
@@ -438,7 +438,7 @@ class HelpfulArgumentParser(object):
 
 
     def __init__(self, args, plugins, detect_defaults=False):
-        from certbot import main
+        from certbot._internal import main
         self.VERBS = {
             "auth": main.certonly,
             "certonly": main.certonly,
@@ -1256,7 +1256,7 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False):  # pylint: dis
 
 
 def _create_subparsers(helpful):
-    from certbot.client import sample_user_agent # avoid import loops
+    from certbot._internal.client import sample_user_agent # avoid import loops
     helpful.add(
         None, "--user-agent", default=flag_default("user_agent"),
         help='Set a custom user agent string for the client. User agent strings allow '
diff --git a/certbot/display/ops.py b/certbot/display/ops.py
index b5f3655fe..1a36744a5 100644
--- a/certbot/display/ops.py
+++ b/certbot/display/ops.py
@@ -75,7 +75,7 @@ def choose_account(accounts):
     """Choose an account.
 
     :param list accounts: Containing at least one
-        :class:`~certbot.account.Account`
+        :class:`~certbot._internal.account.Account`
 
     """
     # Note this will get more complicated once we start recording authorizations
diff --git a/certbot/plugins/common_test.py b/certbot/plugins/common_test.py
index cdcde2c76..8fa642ced 100644
--- a/certbot/plugins/common_test.py
+++ b/certbot/plugins/common_test.py
@@ -178,7 +178,7 @@ class InstallerTest(test_util.ConfigTestCase):
 
 
 class AddrTest(unittest.TestCase):
-    """Tests for certbot.client.plugins.common.Addr."""
+    """Tests for certbot._internal.client.plugins.common.Addr."""
 
     def setUp(self):
         from certbot.plugins.common import Addr
diff --git a/certbot/plugins/enhancements.py b/certbot/plugins/enhancements.py
index 7ca096610..353ff44d5 100644
--- a/certbot/plugins/enhancements.py
+++ b/certbot/plugins/enhancements.py
@@ -51,7 +51,7 @@ def enable(lineage, domains, installer, config):
     Run enable method for each requested enhancement that is supported.
 
     :param lineage: Certificate lineage object
-    :type lineage: certbot.storage.RenewableCert
+    :type lineage: certbot._internal.storage.RenewableCert
 
     :param domains: List of domains in certificate to enhance
     :type domains: str
@@ -112,7 +112,7 @@ class AutoHSTSEnhancement(object):
         Implementation of this method should increase the max-age value.
 
         :param lineage: Certificate lineage object
-        :type lineage: certbot.storage.RenewableCert
+        :type lineage: certbot._internal.storage.RenewableCert
 
         .. note:: prepare() method inherited from `interfaces.IPlugin` might need
             to be called manually within implementation of this interface method
@@ -126,7 +126,7 @@ class AutoHSTSEnhancement(object):
         Long max-age value should be set in implementation of this method.
 
         :param lineage: Certificate lineage object
-        :type lineage: certbot.storage.RenewableCert
+        :type lineage: certbot._internal.storage.RenewableCert
         """
 
     @abc.abstractmethod
@@ -137,7 +137,7 @@ class AutoHSTSEnhancement(object):
         over the subsequent runs of Certbot renew.
 
         :param lineage: Certificate lineage object
-        :type lineage: certbot.storage.RenewableCert
+        :type lineage: certbot._internal.storage.RenewableCert
 
         :param domains: List of domains in certificate to enhance
         :type domains: str
diff --git a/certbot/tests/account_test.py b/certbot/tests/account_test.py
index cad103052..29ec4fc33 100644
--- a/certbot/tests/account_test.py
+++ b/certbot/tests/account_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.account."""
+"""Tests for certbot._internal.account."""
 import datetime
 import json
 import unittest
@@ -19,10 +19,10 @@ KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key.pem"))
 
 
 class AccountTest(unittest.TestCase):
-    """Tests for certbot.account.Account."""
+    """Tests for certbot._internal.account.Account."""
 
     def setUp(self):
-        from certbot.account import Account
+        from certbot._internal.account import Account
         self.regr = mock.MagicMock()
         self.meta = Account.Meta(
             creation_host="test.certbot.org",
@@ -31,9 +31,9 @@ class AccountTest(unittest.TestCase):
         self.acc = Account(self.regr, KEY, self.meta)
         self.regr.__repr__ = mock.MagicMock(return_value="i_am_a_regr")
 
-        with mock.patch("certbot.account.socket") as mock_socket:
+        with mock.patch("certbot._internal.account.socket") as mock_socket:
             mock_socket.getfqdn.return_value = "test.certbot.org"
-            with mock.patch("certbot.account.datetime") as mock_dt:
+            with mock.patch("certbot._internal.account.datetime") as mock_dt:
                 mock_dt.datetime.now.return_value = self.meta.creation_dt
                 self.acc_no_meta = Account(self.regr, KEY)
 
@@ -55,18 +55,18 @@ class AccountTest(unittest.TestCase):
           "<Account(i_am_a_regr, 7adac10320f585ddf118429c0c4af2cd, Meta("))
 
 class ReportNewAccountTest(test_util.ConfigTestCase):
-    """Tests for certbot.account.report_new_account."""
+    """Tests for certbot._internal.account.report_new_account."""
 
     def _call(self):
-        from certbot.account import report_new_account
+        from certbot._internal.account import report_new_account
         report_new_account(self.config)
 
-    @mock.patch("certbot.account.zope.component.queryUtility")
+    @mock.patch("certbot._internal.account.zope.component.queryUtility")
     def test_no_reporter(self, mock_zope):
         mock_zope.return_value = None
         self._call()
 
-    @mock.patch("certbot.account.zope.component.queryUtility")
+    @mock.patch("certbot._internal.account.zope.component.queryUtility")
     def test_it(self, mock_zope):
         self._call()
         call_list = mock_zope().add_message.call_args_list
@@ -74,10 +74,10 @@ class ReportNewAccountTest(test_util.ConfigTestCase):
 
 
 class AccountMemoryStorageTest(unittest.TestCase):
-    """Tests for certbot.account.AccountMemoryStorage."""
+    """Tests for certbot._internal.account.AccountMemoryStorage."""
 
     def setUp(self):
-        from certbot.account import AccountMemoryStorage
+        from certbot._internal.account import AccountMemoryStorage
         self.storage = AccountMemoryStorage()
 
     def test_it(self):
@@ -92,16 +92,16 @@ class AccountMemoryStorageTest(unittest.TestCase):
 
 
 class AccountFileStorageTest(test_util.ConfigTestCase):
-    """Tests for certbot.account.AccountFileStorage."""
+    """Tests for certbot._internal.account.AccountFileStorage."""
     #pylint: disable=too-many-public-methods
 
     def setUp(self):
         super(AccountFileStorageTest, self).setUp()
 
-        from certbot.account import AccountFileStorage
+        from certbot._internal.account import AccountFileStorage
         self.storage = AccountFileStorage(self.config)
 
-        from certbot.account import Account
+        from certbot._internal.account import Account
         new_authzr_uri = "hi"
         self.acc = Account(
             regr=messages.RegistrationResource(
@@ -162,7 +162,7 @@ class AccountFileStorageTest(test_util.ConfigTestCase):
         # pylint: disable=protected-access
         self.storage._load_for_server_path = mock.MagicMock(
             side_effect=["x", errors.AccountStorageError, "z"])
-        with mock.patch("certbot.account.os.listdir") as mock_listdir:
+        with mock.patch("certbot._internal.account.os.listdir") as mock_listdir:
             mock_listdir.return_value = ["x", "y", "z"]
             self.assertEqual(["x", "z"], self.storage.find_all())
 
@@ -171,7 +171,7 @@ class AccountFileStorageTest(test_util.ConfigTestCase):
 
     def _set_server(self, server):
         self.config.server = server
-        from certbot.account import AccountFileStorage
+        from certbot._internal.account import AccountFileStorage
         self.storage = AccountFileStorage(self.config)
 
     def test_find_all_neither_exists(self):
diff --git a/certbot/tests/acme_util.py b/certbot/tests/acme_util.py
index 58f3e29c4..c88fcd706 100644
--- a/certbot/tests/acme_util.py
+++ b/certbot/tests/acme_util.py
@@ -7,7 +7,7 @@ import six
 from acme import challenges
 from acme import messages
 
-from certbot import auth_handler
+from certbot._internal import auth_handler
 
 from certbot.tests import util
 
diff --git a/certbot/tests/auth_handler_test.py b/certbot/tests/auth_handler_test.py
index 9f58b95d3..75bd9b45b 100644
--- a/certbot/tests/auth_handler_test.py
+++ b/certbot/tests/auth_handler_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.auth_handler."""
+"""Tests for certbot._internal.auth_handler."""
 import functools
 import logging
 import unittest
@@ -24,7 +24,7 @@ class ChallengeFactoryTest(unittest.TestCase):
     # pylint: disable=protected-access
 
     def setUp(self):
-        from certbot.auth_handler import AuthHandler
+        from certbot._internal.auth_handler import AuthHandler
 
         # Account is mocked...
         self.handler = AuthHandler(None, None, mock.Mock(key="mock_key"), [])
@@ -64,7 +64,7 @@ class HandleAuthorizationsTest(unittest.TestCase):  # pylint: disable=too-many-p
     """
 
     def setUp(self):
-        from certbot.auth_handler import AuthHandler
+        from certbot._internal.auth_handler import AuthHandler
 
         self.mock_display = mock.Mock()
         zope.component.provideUtility(
@@ -96,7 +96,7 @@ class HandleAuthorizationsTest(unittest.TestCase):  # pylint: disable=too-many-p
         mock_order = mock.MagicMock(authorizations=[authzr])
 
         self.mock_net.poll.side_effect = _gen_mock_on_poll(retry=1, wait_value=30)
-        with mock.patch('certbot.auth_handler.time') as mock_time:
+        with mock.patch('certbot._internal.auth_handler.time') as mock_time:
             authzr = self.handler.handle_authorizations(mock_order)
 
             self.assertEqual(self.mock_net.answer_challenge.call_count, 1)
@@ -326,7 +326,7 @@ class HandleAuthorizationsTest(unittest.TestCase):  # pylint: disable=too-many-p
 
         mock_order = mock.MagicMock(authorizations=authzrs)
 
-        with mock.patch('certbot.auth_handler._report_failed_authzrs') as mock_report:
+        with mock.patch('certbot._internal.auth_handler._report_failed_authzrs') as mock_report:
             valid_authzr = self.handler.handle_authorizations(mock_order, True)
 
         # Because best_effort=True, we did not blow up. Instead ...
@@ -414,10 +414,10 @@ def _gen_mock_on_poll(status=messages.STATUS_VALID, retry=0, wait_value=1):
 
 
 class ChallbToAchallTest(unittest.TestCase):
-    """Tests for certbot.auth_handler.challb_to_achall."""
+    """Tests for certbot._internal.auth_handler.challb_to_achall."""
 
     def _call(self, challb):
-        from certbot.auth_handler import challb_to_achall
+        from certbot._internal.auth_handler import challb_to_achall
         return challb_to_achall(challb, "account_key", "domain")
 
     def test_it(self):
@@ -430,7 +430,7 @@ class ChallbToAchallTest(unittest.TestCase):
 
 
 class GenChallengePathTest(unittest.TestCase):
-    """Tests for certbot.auth_handler.gen_challenge_path.
+    """Tests for certbot._internal.auth_handler.gen_challenge_path.
 
     .. todo:: Add more tests for dumb_path... depending on what we want to do.
 
@@ -443,7 +443,7 @@ class GenChallengePathTest(unittest.TestCase):
 
     @classmethod
     def _call(cls, challbs, preferences, combinations):
-        from certbot.auth_handler import gen_challenge_path
+        from certbot._internal.auth_handler import gen_challenge_path
         return gen_challenge_path(challbs, preferences, combinations)
 
     def test_common_case(self):
@@ -473,7 +473,7 @@ class GenChallengePathTest(unittest.TestCase):
 
 
 class ReportFailedAuthzrsTest(unittest.TestCase):
-    """Tests for certbot.auth_handler._report_failed_authzrs."""
+    """Tests for certbot._internal.auth_handler._report_failed_authzrs."""
     # pylint: disable=protected-access
 
     def setUp(self):
@@ -505,7 +505,7 @@ class ReportFailedAuthzrsTest(unittest.TestCase):
 
     @test_util.patch_get_utility()
     def test_same_error_and_domain(self, mock_zope):
-        from certbot import auth_handler
+        from certbot._internal import auth_handler
 
         auth_handler._report_failed_authzrs([self.authzr1], 'key')
         call_list = mock_zope().add_message.call_args_list
@@ -514,7 +514,7 @@ class ReportFailedAuthzrsTest(unittest.TestCase):
 
     @test_util.patch_get_utility()
     def test_different_errors_and_domains(self, mock_zope):
-        from certbot import auth_handler
+        from certbot._internal import auth_handler
 
         auth_handler._report_failed_authzrs([self.authzr1, self.authzr2], 'key')
         self.assertTrue(mock_zope().add_message.call_count == 2)
diff --git a/certbot/tests/cert_manager_test.py b/certbot/tests/cert_manager_test.py
index 83946a0f7..4cff508e5 100644
--- a/certbot/tests/cert_manager_test.py
+++ b/certbot/tests/cert_manager_test.py
@@ -1,5 +1,5 @@
 
-"""Tests for certbot.cert_manager."""
+"""Tests for certbot._internal.cert_manager."""
 # pylint: disable=protected-access
 import re
 import shutil
@@ -14,7 +14,7 @@ from certbot import errors
 from certbot.compat import os
 from certbot.compat import filesystem
 from certbot.display import util as display_util
-from certbot.storage import ALL_FOUR
+from certbot._internal.storage import ALL_FOUR
 from certbot.tests import storage_test
 from certbot.tests import util as test_util
 
@@ -64,13 +64,13 @@ class BaseCertManagerTest(test_util.ConfigTestCase):
 
 
 class UpdateLiveSymlinksTest(BaseCertManagerTest):
-    """Tests for certbot.cert_manager.update_live_symlinks
+    """Tests for certbot._internal.cert_manager.update_live_symlinks
     """
     def test_update_live_symlinks(self):
         """Test update_live_symlinks"""
         # pylint: disable=too-many-statements
         # create files with incorrect symlinks
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         archive_paths = {}
         for domain in self.domains:
             custom_archive = self.domains[domain]
@@ -104,16 +104,16 @@ class UpdateLiveSymlinksTest(BaseCertManagerTest):
 
 
 class DeleteTest(storage_test.BaseRenewableCertTest):
-    """Tests for certbot.cert_manager.delete
+    """Tests for certbot._internal.cert_manager.delete
     """
 
     def _call(self):
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         cert_manager.delete(self.config)
 
     @test_util.patch_get_utility()
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.storage.delete_files')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.storage.delete_files')
     def test_delete_from_config(self, mock_delete_files, mock_lineage_for_certname,
         unused_get_utility):
         """Test delete"""
@@ -123,8 +123,8 @@ class DeleteTest(storage_test.BaseRenewableCertTest):
         mock_delete_files.assert_called_once_with(self.config, "example.org")
 
     @test_util.patch_get_utility()
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.storage.delete_files')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.storage.delete_files')
     def test_delete_interactive_single(self, mock_delete_files, mock_lineage_for_certname,
         mock_util):
         """Test delete"""
@@ -134,8 +134,8 @@ class DeleteTest(storage_test.BaseRenewableCertTest):
         mock_delete_files.assert_called_once_with(self.config, "example.org")
 
     @test_util.patch_get_utility()
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.storage.delete_files')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.storage.delete_files')
     def test_delete_interactive_multiple(self, mock_delete_files, mock_lineage_for_certname,
         mock_util):
         """Test delete"""
@@ -148,20 +148,20 @@ class DeleteTest(storage_test.BaseRenewableCertTest):
 
 
 class CertificatesTest(BaseCertManagerTest):
-    """Tests for certbot.cert_manager.certificates
+    """Tests for certbot._internal.cert_manager.certificates
     """
     def _certificates(self, *args, **kwargs):
-        from certbot.cert_manager import certificates
+        from certbot._internal.cert_manager import certificates
         return certificates(*args, **kwargs)
 
-    @mock.patch('certbot.cert_manager.logger')
+    @mock.patch('certbot._internal.cert_manager.logger')
     @test_util.patch_get_utility()
     def test_certificates_parse_fail(self, mock_utility, mock_logger):
         self._certificates(self.config)
         self.assertTrue(mock_logger.warning.called) #pylint: disable=no-member
         self.assertTrue(mock_utility.called)
 
-    @mock.patch('certbot.cert_manager.logger')
+    @mock.patch('certbot._internal.cert_manager.logger')
     @test_util.patch_get_utility()
     def test_certificates_quiet(self, mock_utility, mock_logger):
         self.config.quiet = True
@@ -170,10 +170,10 @@ class CertificatesTest(BaseCertManagerTest):
         self.assertTrue(mock_logger.warning.called) #pylint: disable=no-member
 
     @mock.patch('certbot.crypto_util.verify_renewable_cert')
-    @mock.patch('certbot.cert_manager.logger')
+    @mock.patch('certbot._internal.cert_manager.logger')
     @test_util.patch_get_utility()
-    @mock.patch("certbot.storage.RenewableCert")
-    @mock.patch('certbot.cert_manager._report_human_readable')
+    @mock.patch("certbot._internal.storage.RenewableCert")
+    @mock.patch('certbot._internal.cert_manager._report_human_readable')
     def test_certificates_parse_success(self, mock_report, mock_renewable_cert,
         mock_utility, mock_logger, mock_verifier):
         mock_verifier.return_value = None
@@ -184,7 +184,7 @@ class CertificatesTest(BaseCertManagerTest):
         self.assertTrue(mock_utility.called)
         self.assertTrue(mock_renewable_cert.called)
 
-    @mock.patch('certbot.cert_manager.logger')
+    @mock.patch('certbot._internal.cert_manager.logger')
     @test_util.patch_get_utility()
     def test_certificates_no_files(self, mock_utility, mock_logger):
         empty_tempdir = tempfile.mkdtemp()
@@ -201,10 +201,10 @@ class CertificatesTest(BaseCertManagerTest):
         self.assertTrue(mock_utility.called)
         shutil.rmtree(empty_tempdir)
 
-    @mock.patch('certbot.cert_manager.ocsp.RevocationChecker.ocsp_revoked')
+    @mock.patch('certbot._internal.cert_manager.ocsp.RevocationChecker.ocsp_revoked')
     def test_report_human_readable(self, mock_revoked): #pylint: disable=too-many-statements
         mock_revoked.return_value = None
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         import datetime
         import pytz
         expiry = pytz.UTC.fromutc(datetime.datetime.utcnow())
@@ -271,59 +271,59 @@ class CertificatesTest(BaseCertManagerTest):
 
 
 class SearchLineagesTest(BaseCertManagerTest):
-    """Tests for certbot.cert_manager._search_lineages."""
+    """Tests for certbot._internal.cert_manager._search_lineages."""
 
     @mock.patch('certbot.util.make_or_verify_dir')
-    @mock.patch('certbot.storage.renewal_conf_files')
-    @mock.patch('certbot.storage.RenewableCert')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.RenewableCert')
     def test_cert_storage_error(self, mock_renewable_cert, mock_renewal_conf_files,
                                 mock_make_or_verify_dir):
         mock_renewal_conf_files.return_value = ["badfile"]
         mock_renewable_cert.side_effect = errors.CertStorageError
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         # pylint: disable=protected-access
         self.assertEqual(cert_manager._search_lineages(self.config, lambda x: x, "check"), "check")
         self.assertTrue(mock_make_or_verify_dir.called)
 
 
 class LineageForCertnameTest(BaseCertManagerTest):
-    """Tests for certbot.cert_manager.lineage_for_certname"""
+    """Tests for certbot._internal.cert_manager.lineage_for_certname"""
 
     @mock.patch('certbot.util.make_or_verify_dir')
-    @mock.patch('certbot.storage.renewal_file_for_certname')
-    @mock.patch('certbot.storage.RenewableCert')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.storage.RenewableCert')
     def test_found_match(self, mock_renewable_cert, mock_renewal_conf_file,
                          mock_make_or_verify_dir):
         mock_renewal_conf_file.return_value = "somefile.conf"
         mock_match = mock.Mock(lineagename="example.com")
         mock_renewable_cert.return_value = mock_match
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         self.assertEqual(cert_manager.lineage_for_certname(self.config, "example.com"), mock_match)
         self.assertTrue(mock_make_or_verify_dir.called)
 
     @mock.patch('certbot.util.make_or_verify_dir')
-    @mock.patch('certbot.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
     def test_no_match(self, mock_renewal_conf_file, mock_make_or_verify_dir):
         mock_renewal_conf_file.return_value = "other.com.conf"
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         self.assertEqual(cert_manager.lineage_for_certname(self.config, "example.com"), None)
         self.assertTrue(mock_make_or_verify_dir.called)
 
     @mock.patch('certbot.util.make_or_verify_dir')
-    @mock.patch('certbot.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
     def test_no_renewal_file(self, mock_renewal_conf_file, mock_make_or_verify_dir):
         mock_renewal_conf_file.side_effect = errors.CertStorageError()
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         self.assertEqual(cert_manager.lineage_for_certname(self.config, "example.com"), None)
         self.assertTrue(mock_make_or_verify_dir.called)
 
 
 class DomainsForCertnameTest(BaseCertManagerTest):
-    """Tests for certbot.cert_manager.domains_for_certname"""
+    """Tests for certbot._internal.cert_manager.domains_for_certname"""
 
     @mock.patch('certbot.util.make_or_verify_dir')
-    @mock.patch('certbot.storage.renewal_file_for_certname')
-    @mock.patch('certbot.storage.RenewableCert')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.storage.RenewableCert')
     def test_found_match(self, mock_renewable_cert, mock_renewal_conf_file,
                          mock_make_or_verify_dir):
         mock_renewal_conf_file.return_value = "somefile.conf"
@@ -331,22 +331,22 @@ class DomainsForCertnameTest(BaseCertManagerTest):
         domains = ["example.com", "example.org"]
         mock_match.names.return_value = domains
         mock_renewable_cert.return_value = mock_match
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         self.assertEqual(cert_manager.domains_for_certname(self.config, "example.com"),
             domains)
         self.assertTrue(mock_make_or_verify_dir.called)
 
     @mock.patch('certbot.util.make_or_verify_dir')
-    @mock.patch('certbot.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
     def test_no_match(self, mock_renewal_conf_file, mock_make_or_verify_dir):
         mock_renewal_conf_file.return_value = "somefile.conf"
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         self.assertEqual(cert_manager.domains_for_certname(self.config, "other.com"), None)
         self.assertTrue(mock_make_or_verify_dir.called)
 
 
 class RenameLineageTest(BaseCertManagerTest):
-    """Tests for certbot.cert_manager.rename_lineage"""
+    """Tests for certbot._internal.cert_manager.rename_lineage"""
 
     def setUp(self):
         super(RenameLineageTest, self).setUp()
@@ -354,10 +354,10 @@ class RenameLineageTest(BaseCertManagerTest):
         self.config.new_certname = "after"
 
     def _call(self, *args, **kwargs):
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         return cert_manager.rename_lineage(*args, **kwargs)
 
-    @mock.patch('certbot.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
     @test_util.patch_get_utility()
     def test_no_certname(self, mock_get_utility, mock_renewal_conf_files):
         self.config.certname = None
@@ -388,7 +388,7 @@ class RenameLineageTest(BaseCertManagerTest):
         self.assertRaises(errors.Error, self._call, self.config)
 
     @test_util.patch_get_utility()
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
     def test_no_existing_certname(self, mock_lineage_for_certname, unused_get_utility):
         self.config.certname = "one"
         self.config.new_certname = "two"
@@ -397,30 +397,30 @@ class RenameLineageTest(BaseCertManagerTest):
             self._call, self.config)
 
     @test_util.patch_get_utility()
-    @mock.patch("certbot.storage.RenewableCert._check_symlinks")
+    @mock.patch("certbot._internal.storage.RenewableCert._check_symlinks")
     def test_rename_cert(self, mock_check, unused_get_utility):
         mock_check.return_value = True
         self._call(self.config)
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         updated_lineage = cert_manager.lineage_for_certname(self.config, self.config.new_certname)
         self.assertTrue(updated_lineage is not None)
         self.assertEqual(updated_lineage.lineagename, self.config.new_certname)
 
     @test_util.patch_get_utility()
-    @mock.patch("certbot.storage.RenewableCert._check_symlinks")
+    @mock.patch("certbot._internal.storage.RenewableCert._check_symlinks")
     def test_rename_cert_interactive_certname(self, mock_check, mock_get_utility):
         mock_check.return_value = True
         self.config.certname = None
         util_mock = mock_get_utility()
         util_mock.menu.return_value = (display_util.OK, 0)
         self._call(self.config)
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         updated_lineage = cert_manager.lineage_for_certname(self.config, self.config.new_certname)
         self.assertTrue(updated_lineage is not None)
         self.assertEqual(updated_lineage.lineagename, self.config.new_certname)
 
     @test_util.patch_get_utility()
-    @mock.patch("certbot.storage.RenewableCert._check_symlinks")
+    @mock.patch("certbot._internal.storage.RenewableCert._check_symlinks")
     def test_rename_cert_bad_new_certname(self, mock_check, unused_get_utility):
         mock_check.return_value = True
 
@@ -442,7 +442,7 @@ class DuplicativeCertsTest(storage_test.BaseRenewableCertTest):
 
     @mock.patch('certbot.util.make_or_verify_dir')
     def test_find_duplicative_names(self, unused_makedir):
-        from certbot.cert_manager import find_duplicative_certs
+        from certbot._internal.cert_manager import find_duplicative_certs
         test_cert = test_util.load_vector('cert-san_512.pem')
         with open(self.test_rc.cert, 'wb') as f:
             f.write(test_cert)
@@ -471,7 +471,7 @@ class DuplicativeCertsTest(storage_test.BaseRenewableCertTest):
 
 
 class CertPathToLineageTest(storage_test.BaseRenewableCertTest):
-    """Tests for certbot.cert_manager.cert_path_to_lineage"""
+    """Tests for certbot._internal.cert_manager.cert_path_to_lineage"""
 
     def setUp(self):
         super(CertPathToLineageTest, self).setUp()
@@ -482,11 +482,11 @@ class CertPathToLineageTest(storage_test.BaseRenewableCertTest):
         self.config.cert_path = (self.fullchain, '')
 
     def _call(self, cli_config):
-        from certbot.cert_manager import cert_path_to_lineage
+        from certbot._internal.cert_manager import cert_path_to_lineage
         return cert_path_to_lineage(cli_config)
 
     def _archive_files(self, cli_config, filetype):
-        from certbot.cert_manager import _archive_files
+        from certbot._internal.cert_manager import _archive_files
         return _archive_files(cli_config, filetype)
 
     def test_basic_match(self):
@@ -498,13 +498,13 @@ class CertPathToLineageTest(storage_test.BaseRenewableCertTest):
                 'SailorMoon', 'fullchain.pem')
         self.assertRaises(errors.Error, self._call, bad_test_config)
 
-    @mock.patch('certbot.cert_manager._acceptable_matches')
+    @mock.patch('certbot._internal.cert_manager._acceptable_matches')
     def test_options_fullchain(self, mock_acceptable_matches):
         mock_acceptable_matches.return_value = [lambda x: x.fullchain_path]
         self.config.fullchain_path = self.fullchain
         self.assertEqual('example.org', self._call(self.config))
 
-    @mock.patch('certbot.cert_manager._acceptable_matches')
+    @mock.patch('certbot._internal.cert_manager._acceptable_matches')
     def test_options_cert_path(self, mock_acceptable_matches):
         mock_acceptable_matches.return_value = [lambda x: x.cert_path]
         test_cert_path = os.path.join(self.config.config_dir, 'live', 'example.org',
@@ -512,7 +512,7 @@ class CertPathToLineageTest(storage_test.BaseRenewableCertTest):
         self.config.cert_path = (test_cert_path, '')
         self.assertEqual('example.org', self._call(self.config))
 
-    @mock.patch('certbot.cert_manager._acceptable_matches')
+    @mock.patch('certbot._internal.cert_manager._acceptable_matches')
     def test_options_archive_cert(self, mock_acceptable_matches):
         # Also this and the next test check that the regex of _archive_files is working.
         self.config.cert_path = (os.path.join(self.config.config_dir, 'archive', 'example.org',
@@ -520,7 +520,7 @@ class CertPathToLineageTest(storage_test.BaseRenewableCertTest):
         mock_acceptable_matches.return_value = [lambda x: self._archive_files(x, 'cert')]
         self.assertEqual('example.org', self._call(self.config))
 
-    @mock.patch('certbot.cert_manager._acceptable_matches')
+    @mock.patch('certbot._internal.cert_manager._acceptable_matches')
     def test_options_archive_fullchain(self, mock_acceptable_matches):
         self.config.cert_path = (os.path.join(self.config.config_dir, 'archive',
             'example.org', 'fullchain11.pem'), '')
@@ -530,7 +530,8 @@ class CertPathToLineageTest(storage_test.BaseRenewableCertTest):
 
 
 class MatchAndCheckOverlaps(storage_test.BaseRenewableCertTest):
-    """Tests for certbot.cert_manager.match_and_check_overlaps w/o overlapping archive dirs."""
+    """Tests for certbot._internal.cert_manager.match_and_check_overlaps w/o overlapping
+       archive dirs."""
     # A test with real overlapping archive dirs can be found in tests/boulder_integration.sh
     def setUp(self):
         super(MatchAndCheckOverlaps, self).setUp()
@@ -541,27 +542,27 @@ class MatchAndCheckOverlaps(storage_test.BaseRenewableCertTest):
         self.config.cert_path = (self.fullchain, '')
 
     def _call(self, cli_config, acceptable_matches, match_func, rv_func):
-        from certbot.cert_manager import match_and_check_overlaps
+        from certbot._internal.cert_manager import match_and_check_overlaps
         return match_and_check_overlaps(cli_config, acceptable_matches, match_func, rv_func)
 
     def test_basic_match(self):
-        from certbot.cert_manager import _acceptable_matches
+        from certbot._internal.cert_manager import _acceptable_matches
         self.assertEqual(['example.org'], self._call(self.config, _acceptable_matches(),
             lambda x: self.config.cert_path[0], lambda x: x.lineagename))
 
-    @mock.patch('certbot.cert_manager._search_lineages')
+    @mock.patch('certbot._internal.cert_manager._search_lineages')
     def test_no_matches(self, mock_search_lineages):
         mock_search_lineages.return_value = []
         self.assertRaises(errors.Error, self._call, self.config, None, None, None)
 
-    @mock.patch('certbot.cert_manager._search_lineages')
+    @mock.patch('certbot._internal.cert_manager._search_lineages')
     def test_too_many_matches(self, mock_search_lineages):
         mock_search_lineages.return_value = ['spider', 'dance']
         self.assertRaises(errors.OverlappingMatchFound, self._call, self.config, None, None, None)
 
 
 class GetCertnameTest(unittest.TestCase):
-    """Tests for certbot.cert_manager."""
+    """Tests for certbot._internal.cert_manager."""
 
     def setUp(self):
         self.get_utility_patch = test_util.patch_get_utility()
@@ -572,12 +573,12 @@ class GetCertnameTest(unittest.TestCase):
     def tearDown(self):
         self.get_utility_patch.stop()
 
-    @mock.patch('certbot.storage.renewal_conf_files')
-    @mock.patch('certbot.storage.lineagename_for_filename')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.lineagename_for_filename')
     def test_get_certnames(self, mock_name, mock_files):
         mock_files.return_value = ['example.com.conf']
         mock_name.return_value = 'example.com'
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         prompt = "Which certificate would you"
         self.mock_get_utility().menu.return_value = (display_util.OK, 0)
         self.assertEqual(
@@ -586,12 +587,12 @@ class GetCertnameTest(unittest.TestCase):
         self.assertTrue(
             prompt in self.mock_get_utility().menu.call_args[0][0])
 
-    @mock.patch('certbot.storage.renewal_conf_files')
-    @mock.patch('certbot.storage.lineagename_for_filename')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.lineagename_for_filename')
     def test_get_certnames_custom_prompt(self, mock_name, mock_files):
         mock_files.return_value = ['example.com.conf']
         mock_name.return_value = 'example.com'
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         prompt = "custom prompt"
         self.mock_get_utility().menu.return_value = (display_util.OK, 0)
         self.assertEqual(
@@ -601,24 +602,24 @@ class GetCertnameTest(unittest.TestCase):
         self.assertEqual(self.mock_get_utility().menu.call_args[0][0],
                           prompt)
 
-    @mock.patch('certbot.storage.renewal_conf_files')
-    @mock.patch('certbot.storage.lineagename_for_filename')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.lineagename_for_filename')
     def test_get_certnames_user_abort(self, mock_name, mock_files):
         mock_files.return_value = ['example.com.conf']
         mock_name.return_value = 'example.com'
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         self.mock_get_utility().menu.return_value = (display_util.CANCEL, 0)
         self.assertRaises(
             errors.Error,
             cert_manager.get_certnames,
             self.config, "erroring_anyway", allow_multiple=False)
 
-    @mock.patch('certbot.storage.renewal_conf_files')
-    @mock.patch('certbot.storage.lineagename_for_filename')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.lineagename_for_filename')
     def test_get_certnames_allow_multiple(self, mock_name, mock_files):
         mock_files.return_value = ['example.com.conf']
         mock_name.return_value = 'example.com'
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         prompt = "Which certificate(s) would you"
         self.mock_get_utility().checklist.return_value = (display_util.OK,
                                                           ['example.com'])
@@ -628,12 +629,12 @@ class GetCertnameTest(unittest.TestCase):
         self.assertTrue(
             prompt in self.mock_get_utility().checklist.call_args[0][0])
 
-    @mock.patch('certbot.storage.renewal_conf_files')
-    @mock.patch('certbot.storage.lineagename_for_filename')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.lineagename_for_filename')
     def test_get_certnames_allow_multiple_custom_prompt(self, mock_name, mock_files):
         mock_files.return_value = ['example.com.conf']
         mock_name.return_value = 'example.com'
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         prompt = "custom prompt"
         self.mock_get_utility().checklist.return_value = (display_util.OK,
                                                           ['example.com'])
@@ -645,12 +646,12 @@ class GetCertnameTest(unittest.TestCase):
             self.mock_get_utility().checklist.call_args[0][0],
             prompt)
 
-    @mock.patch('certbot.storage.renewal_conf_files')
-    @mock.patch('certbot.storage.lineagename_for_filename')
+    @mock.patch('certbot._internal.storage.renewal_conf_files')
+    @mock.patch('certbot._internal.storage.lineagename_for_filename')
     def test_get_certnames_allow_multiple_user_abort(self, mock_name, mock_files):
         mock_files.return_value = ['example.com.conf']
         mock_name.return_value = 'example.com'
-        from certbot import cert_manager
+        from certbot._internal import cert_manager
         self.mock_get_utility().checklist.return_value = (display_util.CANCEL, [])
         self.assertRaises(
             errors.Error,
diff --git a/certbot/tests/cli_test.py b/certbot/tests/cli_test.py
index 7a2a7fabf..a2491f153 100644
--- a/certbot/tests/cli_test.py
+++ b/certbot/tests/cli_test.py
@@ -86,10 +86,10 @@ class ParseTest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         def write_msg(message, *args, **kwargs): # pylint: disable=missing-docstring,unused-argument
             output.write(message)
 
-        with mock.patch('certbot.main.sys.stdout', new=output):
+        with mock.patch('certbot._internal.main.sys.stdout', new=output):
             with test_util.patch_get_utility() as mock_get_utility:
                 mock_get_utility().notification.side_effect = write_msg
-                with mock.patch('certbot.main.sys.stderr'):
+                with mock.patch('certbot._internal.main.sys.stderr'):
                     self.assertRaises(SystemExit, self._unmocked_parse, args, output)
 
         return output.getvalue()
@@ -126,7 +126,7 @@ class ParseTest(unittest.TestCase):  # pylint: disable=too-many-public-methods
         chain = 'chain'
         fullchain = 'fullchain'
 
-        with mock.patch('certbot.main.install'):
+        with mock.patch('certbot._internal.main.install'):
             namespace = self.parse(['install', '--cert-path', cert,
                                     '--key-path', 'key', '--chain-path',
                                     'chain', '--fullchain-path', 'fullchain'])
diff --git a/certbot/tests/client_test.py b/certbot/tests/client_test.py
index f624c5320..b98d53008 100644
--- a/certbot/tests/client_test.py
+++ b/certbot/tests/client_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.client."""
+"""Tests for certbot._internal.client."""
 import platform
 import shutil
 import tempfile
@@ -9,7 +9,7 @@ import mock
 from josepy import interfaces
 
 import certbot.tests.util as test_util
-from certbot import account
+from certbot._internal import account
 from certbot import errors
 from certbot.compat import os
 from certbot.compat import filesystem
@@ -18,12 +18,13 @@ from certbot import util
 KEY = test_util.load_vector("rsa512_key.pem")
 CSR_SAN = test_util.load_vector("csr-san_512.pem")
 
+# pylint: disable=line-too-long
 
 class DetermineUserAgentTest(test_util.ConfigTestCase):
-    """Tests for certbot.client.determine_user_agent."""
+    """Tests for certbot._internal.client.determine_user_agent."""
 
     def _call(self):
-        from certbot.client import determine_user_agent
+        from certbot._internal.client import determine_user_agent
         return determine_user_agent(self.config)
 
     @mock.patch.dict(os.environ, {"CERTBOT_DOCS": "1"})
@@ -52,7 +53,7 @@ class DetermineUserAgentTest(test_util.ConfigTestCase):
 
 
 class RegisterTest(test_util.ConfigTestCase):
-    """Tests for certbot.client.register."""
+    """Tests for certbot._internal.client.register."""
 
     def setUp(self):
         super(RegisterTest, self).setUp()
@@ -62,7 +63,7 @@ class RegisterTest(test_util.ConfigTestCase):
         self.account_storage = account.AccountMemoryStorage()
 
     def _call(self):
-        from certbot.client import register
+        from certbot._internal.client import register
         tos_cb = mock.MagicMock()
         return register(self.config, self.account_storage, tos_cb)
 
@@ -85,11 +86,11 @@ class RegisterTest(test_util.ConfigTestCase):
         return False
 
     def test_no_tos(self):
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client.new_account_and_tos().terms_of_service = "http://tos"
             mock_client().external_account_required.side_effect = self._false_mock
             with mock.patch("certbot.eff.handle_subscription") as mock_handle:
-                with mock.patch("certbot.account.report_new_account"):
+                with mock.patch("certbot._internal.account.report_new_account"):
                     mock_client().new_account_and_tos.side_effect = errors.Error
                     self.assertRaises(errors.Error, self._call)
                     self.assertFalse(mock_handle.called)
@@ -99,20 +100,20 @@ class RegisterTest(test_util.ConfigTestCase):
                     self.assertTrue(mock_handle.called)
 
     def test_it(self):
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().external_account_required.side_effect = self._false_mock
-            with mock.patch("certbot.account.report_new_account"):
+            with mock.patch("certbot._internal.account.report_new_account"):
                 with mock.patch("certbot.eff.handle_subscription"):
                     self._call()
 
-    @mock.patch("certbot.account.report_new_account")
-    @mock.patch("certbot.client.display_ops.get_email")
+    @mock.patch("certbot._internal.account.report_new_account")
+    @mock.patch("certbot._internal.client.display_ops.get_email")
     def test_email_retry(self, _rep, mock_get_email):
         from acme import messages
         self.config.noninteractive_mode = False
         msg = "DNS problem: NXDOMAIN looking up MX for example.com"
         mx_err = messages.Error.with_code('invalidContact', detail=msg)
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().external_account_required.side_effect = self._false_mock
             with mock.patch("certbot.eff.handle_subscription") as mock_handle:
                 mock_client().new_account_and_tos.side_effect = [mx_err, mock.MagicMock()]
@@ -120,13 +121,13 @@ class RegisterTest(test_util.ConfigTestCase):
                 self.assertEqual(mock_get_email.call_count, 1)
                 self.assertTrue(mock_handle.called)
 
-    @mock.patch("certbot.account.report_new_account")
+    @mock.patch("certbot._internal.account.report_new_account")
     def test_email_invalid_noninteractive(self, _rep):
         from acme import messages
         self.config.noninteractive_mode = True
         msg = "DNS problem: NXDOMAIN looking up MX for example.com"
         mx_err = messages.Error.with_code('invalidContact', detail=msg)
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().external_account_required.side_effect = self._false_mock
             with mock.patch("certbot.eff.handle_subscription"):
                 mock_client().new_account_and_tos.side_effect = [mx_err, mock.MagicMock()]
@@ -136,12 +137,12 @@ class RegisterTest(test_util.ConfigTestCase):
         self.config.email = None
         self.assertRaises(errors.Error, self._call)
 
-    @mock.patch("certbot.client.logger")
+    @mock.patch("certbot._internal.client.logger")
     def test_without_email(self, mock_logger):
         with mock.patch("certbot.eff.handle_subscription") as mock_handle:
-            with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_clnt:
+            with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_clnt:
                 mock_clnt().external_account_required.side_effect = self._false_mock
-                with mock.patch("certbot.account.report_new_account"):
+                with mock.patch("certbot._internal.account.report_new_account"):
                     self.config.email = None
                     self.config.register_unsafely_without_email = True
                     self.config.dry_run = False
@@ -149,14 +150,14 @@ class RegisterTest(test_util.ConfigTestCase):
                     mock_logger.info.assert_called_once_with(mock.ANY)
                     self.assertTrue(mock_handle.called)
 
-    @mock.patch("certbot.account.report_new_account")
-    @mock.patch("certbot.client.display_ops.get_email")
+    @mock.patch("certbot._internal.account.report_new_account")
+    @mock.patch("certbot._internal.client.display_ops.get_email")
     def test_dry_run_no_staging_account(self, _rep, mock_get_email):
         """Tests dry-run for no staging account, expect account created with no email"""
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().external_account_required.side_effect = self._false_mock
             with mock.patch("certbot.eff.handle_subscription"):
-                with mock.patch("certbot.account.report_new_account"):
+                with mock.patch("certbot._internal.account.report_new_account"):
                     self.config.dry_run = True
                     self._call()
                     # check Certbot did not ask the user to provide an email
@@ -165,13 +166,13 @@ class RegisterTest(test_util.ConfigTestCase):
                     self.assertFalse(mock_client().new_account_and_tos.call_args[0][0].contact)
 
     def test_with_eab_arguments(self):
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().client.directory.__getitem__ = mock.Mock(
                 side_effect=self._new_acct_dir_mock
             )
             mock_client().external_account_required.side_effect = self._false_mock
             with mock.patch("certbot.eff.handle_subscription"):
-                target = "certbot.client.messages.ExternalAccountBinding.from_data"
+                target = "certbot._internal.client.messages.ExternalAccountBinding.from_data"
                 with mock.patch(target) as mock_eab_from_data:
                     self.config.eab_kid = "test-kid"
                     self.config.eab_hmac_key = "J2OAqW4MHXsrHVa_PVg0Y-L_R4SYw0_aL1le6mfblbE"
@@ -180,10 +181,10 @@ class RegisterTest(test_util.ConfigTestCase):
                     self.assertTrue(mock_eab_from_data.called)
 
     def test_without_eab_arguments(self):
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().external_account_required.side_effect = self._false_mock
             with mock.patch("certbot.eff.handle_subscription"):
-                target = "certbot.client.messages.ExternalAccountBinding.from_data"
+                target = "certbot._internal.client.messages.ExternalAccountBinding.from_data"
                 with mock.patch(target) as mock_eab_from_data:
                     self.config.eab_kid = None
                     self.config.eab_hmac_key = None
@@ -192,11 +193,11 @@ class RegisterTest(test_util.ConfigTestCase):
                     self.assertFalse(mock_eab_from_data.called)
 
     def test_external_account_required_without_eab_arguments(self):
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().client.net.key.public_key = mock.Mock(side_effect=self._public_key_mock)
             mock_client().external_account_required.side_effect = self._true_mock
             with mock.patch("certbot.eff.handle_subscription"):
-                with mock.patch("certbot.client.messages.ExternalAccountBinding.from_data"):
+                with mock.patch("certbot._internal.client.messages.ExternalAccountBinding.from_data"):
                     self.config.eab_kid = None
                     self.config.eab_hmac_key = None
 
@@ -206,7 +207,7 @@ class RegisterTest(test_util.ConfigTestCase):
         from acme import messages
         msg = "Test"
         mx_err = messages.Error(detail=msg, typ="malformed", title="title")
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as mock_client:
             mock_client().client.directory.__getitem__ = mock.Mock(
                 side_effect=self._new_acct_dir_mock
             )
@@ -218,7 +219,7 @@ class RegisterTest(test_util.ConfigTestCase):
 
 
 class ClientTestCommon(test_util.ConfigTestCase):
-    """Common base class for certbot.client.Client tests."""
+    """Common base class for certbot._internal.client.Client tests."""
 
     def setUp(self):
         super(ClientTestCommon, self).setUp()
@@ -227,8 +228,8 @@ class ClientTestCommon(test_util.ConfigTestCase):
 
         self.account = mock.MagicMock(**{"key.pem": KEY})
 
-        from certbot.client import Client
-        with mock.patch("certbot.client.acme_client.BackwardsCompatibleClientV2") as acme:
+        from certbot._internal.client import Client
+        with mock.patch("certbot._internal.client.acme_client.BackwardsCompatibleClientV2") as acme:
             self.acme_client = acme
             self.acme = acme.return_value = mock.MagicMock()
             self.client = Client(
@@ -237,7 +238,7 @@ class ClientTestCommon(test_util.ConfigTestCase):
 
 
 class ClientTest(ClientTestCommon):
-    """Tests for certbot.client.Client."""
+    """Tests for certbot._internal.client.Client."""
 
     def setUp(self):
         super(ClientTest, self).setUp()
@@ -272,8 +273,8 @@ class ClientTest(ClientTestCommon):
         self.acme.finalize_order.assert_called_once_with(
             self.eg_order, mock.ANY)
 
-    @mock.patch("certbot.client.crypto_util")
-    @mock.patch("certbot.client.logger")
+    @mock.patch("certbot._internal.client.crypto_util")
+    @mock.patch("certbot._internal.client.logger")
     @test_util.patch_get_utility()
     def test_obtain_certificate_from_csr(self, unused_mock_get_utility,
                                          mock_logger, mock_crypto_util):
@@ -308,7 +309,7 @@ class ClientTest(ClientTestCommon):
             test_csr)
         mock_logger.warning.assert_called_once_with(mock.ANY)
 
-    @mock.patch("certbot.client.crypto_util")
+    @mock.patch("certbot._internal.client.crypto_util")
     def test_obtain_certificate(self, mock_crypto_util):
         csr = util.CSR(form="pem", file=None, data=CSR_SAN)
         mock_crypto_util.init_save_csr.return_value = csr
@@ -324,7 +325,7 @@ class ClientTest(ClientTestCommon):
         mock_crypto_util.cert_and_chain_from_fullchain.assert_called_once_with(
             self.eg_order.fullchain_pem)
 
-    @mock.patch("certbot.client.crypto_util")
+    @mock.patch("certbot._internal.client.crypto_util")
     @mock.patch("certbot.compat.os.remove")
     def test_obtain_certificate_partial_success(self, mock_remove, mock_crypto_util):
         csr = util.CSR(form="pem", file=mock.sentinel.csr_file, data=CSR_SAN)
@@ -342,8 +343,8 @@ class ClientTest(ClientTestCommon):
         self.assertEqual(mock_remove.call_count, 2)
         self.assertEqual(mock_crypto_util.cert_and_chain_from_fullchain.call_count, 1)
 
-    @mock.patch("certbot.client.crypto_util")
-    @mock.patch("certbot.client.acme_crypto_util")
+    @mock.patch("certbot._internal.client.crypto_util")
+    @mock.patch("certbot._internal.client.acme_crypto_util")
     def test_obtain_certificate_dry_run(self, mock_acme_crypto, mock_crypto):
         csr = util.CSR(form="pem", file=None, data=CSR_SAN)
         mock_acme_crypto.make_csr.return_value = CSR_SAN
@@ -361,9 +362,9 @@ class ClientTest(ClientTestCommon):
         mock_crypto.init_save_csr.assert_not_called()
         self.assertEqual(mock_crypto.cert_and_chain_from_fullchain.call_count, 1)
 
-    @mock.patch("certbot.client.logger")
-    @mock.patch("certbot.client.crypto_util")
-    @mock.patch("certbot.client.acme_crypto_util")
+    @mock.patch("certbot._internal.client.logger")
+    @mock.patch("certbot._internal.client.crypto_util")
+    @mock.patch("certbot._internal.client.acme_crypto_util")
     def test_obtain_certificate_dry_run_authz_deactivations_failed(self, mock_acme_crypto,
                                                                    mock_crypto, mock_log):
         from acme import messages
@@ -440,8 +441,8 @@ class ClientTest(ClientTestCommon):
             (mock.sentinel.cert, mock.sentinel.chain, key, csr))
         self._check_obtain_certificate(auth_count)
 
-    @mock.patch('certbot.client.Client.obtain_certificate')
-    @mock.patch('certbot.storage.RenewableCert.new_lineage')
+    @mock.patch('certbot._internal.client.Client.obtain_certificate')
+    @mock.patch('certbot._internal.storage.RenewableCert.new_lineage')
     def test_obtain_and_enroll_certificate(self,
                                            mock_storage, mock_obtain_certificate):
         domains = ["*.example.com", "example.com"]
@@ -563,7 +564,7 @@ class ClientTest(ClientTestCommon):
 
 
 class EnhanceConfigTest(ClientTestCommon):
-    """Tests for certbot.client.Client.enhance_config."""
+    """Tests for certbot._internal.client.Client.enhance_config."""
 
     def setUp(self):
         super(EnhanceConfigTest, self).setUp()
@@ -578,20 +579,20 @@ class EnhanceConfigTest(ClientTestCommon):
         self.assertRaises(
             errors.Error, self.client.enhance_config, [self.domain], None)
 
-    @mock.patch("certbot.client.enhancements")
+    @mock.patch("certbot._internal.client.enhancements")
     def test_unsupported(self, mock_enhancements):
         self.client.installer = mock.MagicMock()
         self.client.installer.supported_enhancements.return_value = []
 
         self.config.redirect = None
         self.config.hsts = True
-        with mock.patch("certbot.client.logger") as mock_logger:
+        with mock.patch("certbot._internal.client.logger") as mock_logger:
             self.client.enhance_config([self.domain], None)
         self.assertEqual(mock_logger.warning.call_count, 1)
         self.client.installer.enhance.assert_not_called()
         mock_enhancements.ask.assert_not_called()
 
-    @mock.patch("certbot.client.logger")
+    @mock.patch("certbot._internal.client.logger")
     def test_already_exists_header(self, mock_log):
         self.config.hsts = True
         self._test_with_already_existing()
@@ -599,7 +600,7 @@ class EnhanceConfigTest(ClientTestCommon):
         self.assertEqual(mock_log.warning.call_args[0][1],
                           'Strict-Transport-Security')
 
-    @mock.patch("certbot.client.logger")
+    @mock.patch("certbot._internal.client.logger")
     def test_already_exists_redirect(self, mock_log):
         self.config.redirect = True
         self._test_with_already_existing()
@@ -607,14 +608,14 @@ class EnhanceConfigTest(ClientTestCommon):
         self.assertEqual(mock_log.warning.call_args[0][1],
                           'redirect')
 
-    @mock.patch("certbot.client.logger")
+    @mock.patch("certbot._internal.client.logger")
     def test_config_set_no_warning_redirect(self, mock_log):
         self.config.redirect = False
         self._test_with_already_existing()
         self.assertFalse(mock_log.warning.called)
 
-    @mock.patch("certbot.client.enhancements.ask")
-    @mock.patch("certbot.client.logger")
+    @mock.patch("certbot._internal.client.enhancements.ask")
+    @mock.patch("certbot._internal.client.logger")
     def test_warn_redirect(self, mock_log, mock_ask):
         self.config.redirect = None
         mock_ask.return_value = False
@@ -671,7 +672,7 @@ class EnhanceConfigTest(ClientTestCommon):
         self.client.installer = installer
         self._test_error_with_rollback()
 
-    @mock.patch("certbot.client.enhancements.ask")
+    @mock.patch("certbot._internal.client.enhancements.ask")
     def test_ask(self, mock_ask):
         self.config.redirect = None
         mock_ask.return_value = True
@@ -706,15 +707,15 @@ class EnhanceConfigTest(ClientTestCommon):
 
 
 class RollbackTest(unittest.TestCase):
-    """Tests for certbot.client.rollback."""
+    """Tests for certbot._internal.client.rollback."""
 
     def setUp(self):
         self.m_install = mock.MagicMock()
 
     @classmethod
     def _call(cls, checkpoints, side_effect):
-        from certbot.client import rollback
-        with mock.patch("certbot.client.plugin_selection.pick_installer") as mpi:
+        from certbot._internal.client import rollback
+        with mock.patch("certbot._internal.client.plugin_selection.pick_installer") as mpi:
             mpi.side_effect = side_effect
             rollback(None, checkpoints, {}, mock.MagicMock())
 
diff --git a/certbot/tests/compat/filesystem_test.py b/certbot/tests/compat/filesystem_test.py
index 364993018..7a8b89974 100644
--- a/certbot/tests/compat/filesystem_test.py
+++ b/certbot/tests/compat/filesystem_test.py
@@ -16,7 +16,7 @@ except ImportError:
     POSIX_MODE = True
 
 import certbot.tests.util as test_util
-from certbot import lock
+from certbot._internal import lock
 from certbot import util
 from certbot.compat import os
 from certbot.compat import filesystem
diff --git a/certbot/tests/display/ops_test.py b/certbot/tests/display/ops_test.py
index 0a80836c0..26d4eade2 100644
--- a/certbot/tests/display/ops_test.py
+++ b/certbot/tests/display/ops_test.py
@@ -10,7 +10,7 @@ import zope.component
 from acme import messages
 
 import certbot.tests.util as test_util
-from certbot import account
+from certbot._internal import account
 from certbot import errors
 from certbot.compat import os
 from certbot.compat import filesystem
diff --git a/certbot/tests/error_handler_test.py b/certbot/tests/error_handler_test.py
index cc805a9e6..3803b70e3 100644
--- a/certbot/tests/error_handler_test.py
+++ b/certbot/tests/error_handler_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.error_handler."""
+"""Tests for certbot._internal.error_handler."""
 import contextlib
 import signal
 import sys
@@ -40,10 +40,10 @@ def send_signal(signum):
 
 
 class ErrorHandlerTest(unittest.TestCase):
-    """Tests for certbot.error_handler.ErrorHandler."""
+    """Tests for certbot._internal.error_handler.ErrorHandler."""
 
     def setUp(self):
-        from certbot import error_handler
+        from certbot._internal import error_handler
 
         self.init_func = mock.MagicMock()
         self.init_args = set((42,))
@@ -132,10 +132,10 @@ class ErrorHandlerTest(unittest.TestCase):
 
 
 class ExitHandlerTest(ErrorHandlerTest):
-    """Tests for certbot.error_handler.ExitHandler."""
+    """Tests for certbot._internal.error_handler.ExitHandler."""
 
     def setUp(self):
-        from certbot import error_handler
+        from certbot._internal import error_handler
         super(ExitHandlerTest, self).setUp()
         self.handler = error_handler.ExitHandler(self.init_func,
                                                  *self.init_args,
diff --git a/certbot/tests/lock_test.py b/certbot/tests/lock_test.py
index cd1f9ea86..dae643269 100644
--- a/certbot/tests/lock_test.py
+++ b/certbot/tests/lock_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.lock."""
+"""Tests for certbot._internal.lock."""
 import functools
 import multiprocessing
 import unittest
@@ -17,10 +17,10 @@ from certbot.tests import util as test_util
 
 
 class LockDirTest(test_util.TempDirTestCase):
-    """Tests for certbot.lock.lock_dir."""
+    """Tests for certbot._internal.lock.lock_dir."""
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.lock import lock_dir
+        from certbot._internal.lock import lock_dir
         return lock_dir(*args, **kwargs)
 
     def test_it(self):
@@ -31,10 +31,10 @@ class LockDirTest(test_util.TempDirTestCase):
 
 
 class LockFileTest(test_util.TempDirTestCase):
-    """Tests for certbot.lock.LockFile."""
+    """Tests for certbot._internal.lock.LockFile."""
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.lock import LockFile
+        from certbot._internal.lock import LockFile
         return LockFile(*args, **kwargs)
 
     def setUp(self):
@@ -93,7 +93,7 @@ class LockFileTest(test_util.TempDirTestCase):
                 os.remove(path)
             return stat(path)
 
-        with mock.patch('certbot.lock.filesystem.os.stat') as mock_stat:
+        with mock.patch('certbot._internal.lock.filesystem.os.stat') as mock_stat:
             mock_stat.side_effect = delete_and_stat
             self._call(self.lock_path)
         self.assertFalse(should_delete)
@@ -105,9 +105,9 @@ class LockFileTest(test_util.TempDirTestCase):
 
     def test_unexpected_lockf_or_locking_err(self):
         if POSIX_MODE:
-            mocked_function = 'certbot.lock.fcntl.lockf'
+            mocked_function = 'certbot._internal.lock.fcntl.lockf'
         else:
-            mocked_function = 'certbot.lock.msvcrt.locking'
+            mocked_function = 'certbot._internal.lock.msvcrt.locking'
         msg = 'hi there'
         with mock.patch(mocked_function) as mock_lock:
             mock_lock.side_effect = IOError(msg)
@@ -120,9 +120,9 @@ class LockFileTest(test_util.TempDirTestCase):
 
     def test_unexpected_os_err(self):
         if POSIX_MODE:
-            mock_function = 'certbot.lock.filesystem.os.stat'
+            mock_function = 'certbot._internal.lock.filesystem.os.stat'
         else:
-            mock_function = 'certbot.lock.msvcrt.locking'
+            mock_function = 'certbot._internal.lock.msvcrt.locking'
         # The only expected errno are ENOENT and EACCES in lock module.
         msg = 'hi there'
         with mock.patch(mock_function) as mock_os:
diff --git a/certbot/tests/log_test.py b/certbot/tests/log_test.py
index 807c7ecaa..a4812cb54 100644
--- a/certbot/tests/log_test.py
+++ b/certbot/tests/log_test.py
@@ -135,7 +135,7 @@ class SetupLogFileHandlerTest(test_util.ConfigTestCase):
         super(SetupLogFileHandlerTest, self).setUp()
         self.config.max_log_backups = 42
 
-    @mock.patch('certbot.main.logging.handlers.RotatingFileHandler')
+    @mock.patch('certbot._internal.main.logging.handlers.RotatingFileHandler')
     def test_failure(self, mock_handler):
         mock_handler.side_effect = IOError
 
diff --git a/certbot/tests/main_test.py b/certbot/tests/main_test.py
index 05266835f..d5d96eec7 100644
--- a/certbot/tests/main_test.py
+++ b/certbot/tests/main_test.py
@@ -1,5 +1,5 @@
 # coding=utf-8
-"""Tests for certbot.main."""
+"""Tests for certbot._internal.main."""
 # pylint: disable=too-many-lines
 from __future__ import print_function
 
@@ -21,15 +21,15 @@ from six.moves import reload_module  # pylint: disable=import-error
 from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
 
 import certbot.tests.util as test_util
-from certbot import account
+from certbot._internal import account
 from certbot import cli
 from certbot import configuration
 from certbot import constants
 from certbot import crypto_util
 from certbot import errors
 from certbot import interfaces  # pylint: disable=unused-import
-from certbot import main
-from certbot import updater
+from certbot._internal import main
+from certbot._internal import updater
 from certbot import util
 from certbot.compat import os
 from certbot.compat import filesystem
@@ -48,7 +48,7 @@ SS_CERT_PATH = test_util.vector_path('cert_2048.pem')
 
 
 class TestHandleIdenticalCerts(unittest.TestCase):
-    """Test for certbot.main._handle_identical_cert_request"""
+    """Test for certbot._internal.main._handle_identical_cert_request"""
     def test_handle_identical_cert_request_pending(self):
         mock_lineage = mock.Mock()
         mock_lineage.ensure_deployed.return_value = False
@@ -58,19 +58,19 @@ class TestHandleIdenticalCerts(unittest.TestCase):
 
 
 class RunTest(test_util.ConfigTestCase):
-    """Tests for certbot.main.run."""
+    """Tests for certbot._internal.main.run."""
 
     def setUp(self):
         super(RunTest, self).setUp()
         self.domain = 'example.org'
         self.patches = [
-            mock.patch('certbot.main._get_and_save_cert'),
-            mock.patch('certbot.main.display_ops.success_installation'),
-            mock.patch('certbot.main.display_ops.success_renewal'),
-            mock.patch('certbot.main._init_le_client'),
-            mock.patch('certbot.main._suggest_donation_if_appropriate'),
-            mock.patch('certbot.main._report_new_cert'),
-            mock.patch('certbot.main._find_cert')]
+            mock.patch('certbot._internal.main._get_and_save_cert'),
+            mock.patch('certbot._internal.main.display_ops.success_installation'),
+            mock.patch('certbot._internal.main.display_ops.success_renewal'),
+            mock.patch('certbot._internal.main._init_le_client'),
+            mock.patch('certbot._internal.main._suggest_donation_if_appropriate'),
+            mock.patch('certbot._internal.main._report_new_cert'),
+            mock.patch('certbot._internal.main._find_cert')]
 
         self.mock_auth = self.patches[0].start()
         self.mock_success_installation = self.patches[1].start()
@@ -90,7 +90,7 @@ class RunTest(test_util.ConfigTestCase):
         config = configuration.NamespaceConfig(
             cli.prepare_and_parse_args(plugins, args))
 
-        from certbot.main import run
+        from certbot._internal.main import run
         run(config, plugins)
 
     def test_newcert_success(self):
@@ -111,7 +111,7 @@ class RunTest(test_util.ConfigTestCase):
         self._call()
         self.mock_success_renewal.assert_called_once_with([self.domain])
 
-    @mock.patch('certbot.main.plug_sel.choose_configurator_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.choose_configurator_plugins')
     def test_run_enhancement_not_supported(self, mock_choose):
         mock_choose.return_value = (null.Installer(self.config, "null"), None)
         plugins = disco.PluginsRegistry.find_all()
@@ -122,7 +122,7 @@ class RunTest(test_util.ConfigTestCase):
 
 
 class CertonlyTest(unittest.TestCase):
-    """Tests for certbot.main.certonly."""
+    """Tests for certbot._internal.main.certonly."""
 
     def setUp(self):
         self.get_utility_patch = test_util.patch_get_utility()
@@ -136,15 +136,15 @@ class CertonlyTest(unittest.TestCase):
         config = configuration.NamespaceConfig(
             cli.prepare_and_parse_args(plugins, args))
 
-        with mock.patch('certbot.main._init_le_client') as mock_init:
-            with mock.patch('certbot.main._suggest_donation_if_appropriate'):
+        with mock.patch('certbot._internal.main._init_le_client') as mock_init:
+            with mock.patch('certbot._internal.main._suggest_donation_if_appropriate'):
                 main.certonly(config, plugins)
 
         return mock_init()  # returns the client
 
-    @mock.patch('certbot.main._find_cert')
-    @mock.patch('certbot.main._get_and_save_cert')
-    @mock.patch('certbot.main._report_new_cert')
+    @mock.patch('certbot._internal.main._find_cert')
+    @mock.patch('certbot._internal.main._get_and_save_cert')
+    @mock.patch('certbot._internal.main._report_new_cert')
     def test_no_reinstall_text_pause(self, unused_report, mock_auth,
         mock_find_cert):
         mock_notification = self.mock_get_utility().notification
@@ -156,10 +156,10 @@ class CertonlyTest(unittest.TestCase):
     def _assert_no_pause(self, message, pause=True):  # pylint: disable=unused-argument
         self.assertFalse(pause)
 
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.cert_manager.domains_for_certname')
-    @mock.patch('certbot.renewal.renew_cert')
-    @mock.patch('certbot.main._report_new_cert')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.cert_manager.domains_for_certname')
+    @mock.patch('certbot._internal.renewal.renew_cert')
+    @mock.patch('certbot._internal.main._report_new_cert')
     def test_find_lineage_for_domains_and_certname(self, mock_report_cert,
         mock_renew_cert, mock_domains, mock_lineage):
         domains = ['example.com', 'test.org']
@@ -185,10 +185,10 @@ class CertonlyTest(unittest.TestCase):
         self.assertRaises(errors.ConfigurationError, self._call,
             ('certonly --webroot -d example.com -d test.com --cert-name example.com').split())
 
-    @mock.patch('certbot.cert_manager.domains_for_certname')
+    @mock.patch('certbot._internal.cert_manager.domains_for_certname')
     @mock.patch('certbot.display.ops.choose_names')
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.main._report_new_cert')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.main._report_new_cert')
     def test_find_lineage_for_domains_new_certname(self, mock_report_cert,
         mock_lineage, mock_choose_names, mock_domains_for_certname):
         mock_lineage.return_value = None
@@ -206,7 +206,7 @@ class CertonlyTest(unittest.TestCase):
         self.assertTrue(mock_choose_names.called)
 
 class FindDomainsOrCertnameTest(unittest.TestCase):
-    """Tests for certbot.main._find_domains_or_certname."""
+    """Tests for certbot._internal.main._find_domains_or_certname."""
 
     @mock.patch('certbot.display.ops.choose_names')
     def test_display_ops(self, mock_choose_names):
@@ -223,7 +223,7 @@ class FindDomainsOrCertnameTest(unittest.TestCase):
         # pylint: disable=protected-access
         self.assertRaises(errors.Error, main._find_domains_or_certname, mock_config, None)
 
-    @mock.patch('certbot.cert_manager.domains_for_certname')
+    @mock.patch('certbot._internal.cert_manager.domains_for_certname')
     def test_grab_domains(self, mock_domains):
         mock_config = mock.Mock(domains=None, certname="one.com")
         mock_domains.return_value = ["one.com", "two.com"]
@@ -233,7 +233,7 @@ class FindDomainsOrCertnameTest(unittest.TestCase):
 
 
 class RevokeTest(test_util.TempDirTestCase):
-    """Tests for certbot.main.revoke."""
+    """Tests for certbot._internal.main.revoke."""
 
     def setUp(self):
         super(RevokeTest, self).setUp()
@@ -246,16 +246,16 @@ class RevokeTest(test_util.TempDirTestCase):
 
         self.patches = [
             mock.patch('acme.client.BackwardsCompatibleClientV2'),
-            mock.patch('certbot.client.Client'),
-            mock.patch('certbot.main._determine_account'),
-            mock.patch('certbot.main.display_ops.success_revocation')
+            mock.patch('certbot._internal.client.Client'),
+            mock.patch('certbot._internal.main._determine_account'),
+            mock.patch('certbot._internal.main.display_ops.success_revocation')
         ]
         self.mock_acme_client = self.patches[0].start()
         self.patches[1].start()
         self.mock_determine_account = self.patches[2].start()
         self.mock_success_revoke = self.patches[3].start()
 
-        from certbot.account import Account
+        from certbot._internal.account import Account
 
         self.regr = mock.MagicMock()
         self.meta = Account.Meta(
@@ -280,11 +280,11 @@ class RevokeTest(test_util.TempDirTestCase):
         config = configuration.NamespaceConfig(
             cli.prepare_and_parse_args(plugins, args))
 
-        from certbot.main import revoke
+        from certbot._internal.main import revoke
         revoke(config, plugins)
 
-    @mock.patch('certbot.main._delete_if_appropriate')
-    @mock.patch('certbot.main.client.acme_client')
+    @mock.patch('certbot._internal.main._delete_if_appropriate')
+    @mock.patch('certbot._internal.main.client.acme_client')
     def test_revoke_with_reason(self, mock_acme_client,
             mock_delete_if_appropriate):
         mock_delete_if_appropriate.return_value = False
@@ -300,8 +300,8 @@ class RevokeTest(test_util.TempDirTestCase):
             expected.append(mock.call(mock.ANY, code))
         self.assertEqual(expected, mock_revoke.call_args_list)
 
-    @mock.patch('certbot.main._delete_if_appropriate')
-    @mock.patch('certbot.storage.cert_path_for_cert_name')
+    @mock.patch('certbot._internal.main._delete_if_appropriate')
+    @mock.patch('certbot._internal.storage.cert_path_for_cert_name')
     def test_revoke_by_certname(self, mock_cert_path_for_cert_name,
             mock_delete_if_appropriate):
         args = 'revoke --cert-name=example.com'.split()
@@ -310,7 +310,7 @@ class RevokeTest(test_util.TempDirTestCase):
         self._call(args)
         self.mock_success_revoke.assert_called_once_with(self.tmp_cert_path)
 
-    @mock.patch('certbot.main._delete_if_appropriate')
+    @mock.patch('certbot._internal.main._delete_if_appropriate')
     def test_revocation_success(self, mock_delete_if_appropriate):
         self._call()
         mock_delete_if_appropriate.return_value = False
@@ -322,8 +322,8 @@ class RevokeTest(test_util.TempDirTestCase):
         self.assertRaises(acme_errors.ClientError, self._call)
         self.mock_success_revoke.assert_not_called()
 
-    @mock.patch('certbot.main._delete_if_appropriate')
-    @mock.patch('certbot.cert_manager.delete')
+    @mock.patch('certbot._internal.main._delete_if_appropriate')
+    @mock.patch('certbot._internal.cert_manager.delete')
     @test_util.patch_get_utility()
     def test_revocation_with_prompt(self, mock_get_utility,
             mock_delete, mock_delete_if_appropriate):
@@ -333,14 +333,14 @@ class RevokeTest(test_util.TempDirTestCase):
         self.assertFalse(mock_delete.called)
 
 class DeleteIfAppropriateTest(test_util.ConfigTestCase):
-    """Tests for certbot.main._delete_if_appropriate """
+    """Tests for certbot._internal.main._delete_if_appropriate """
 
     def _call(self, mock_config):
-        from certbot.main import _delete_if_appropriate
+        from certbot._internal.main import _delete_if_appropriate
         _delete_if_appropriate(mock_config)
 
     def _test_delete_opt_out_common(self, mock_get_utility):
-        with mock.patch('certbot.cert_manager.delete') as mock_delete:
+        with mock.patch('certbot._internal.cert_manager.delete') as mock_delete:
             self._call(self.config)
         mock_delete.assert_not_called()
         self.assertTrue(mock_get_utility().add_message.called)
@@ -357,11 +357,11 @@ class DeleteIfAppropriateTest(test_util.ConfigTestCase):
         self._test_delete_opt_out_common(mock_get_utility)
 
     # pylint: disable=too-many-arguments
-    @mock.patch('certbot.storage.renewal_file_for_certname')
-    @mock.patch('certbot.cert_manager.delete')
-    @mock.patch('certbot.cert_manager.match_and_check_overlaps')
-    @mock.patch('certbot.storage.full_archive_path')
-    @mock.patch('certbot.cert_manager.cert_path_to_lineage')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.cert_manager.delete')
+    @mock.patch('certbot._internal.cert_manager.match_and_check_overlaps')
+    @mock.patch('certbot._internal.storage.full_archive_path')
+    @mock.patch('certbot._internal.cert_manager.cert_path_to_lineage')
     @test_util.patch_get_utility()
     def test_overlapping_archive_dirs(self, mock_get_utility,
             mock_cert_path_to_lineage, mock_archive,
@@ -377,11 +377,11 @@ class DeleteIfAppropriateTest(test_util.ConfigTestCase):
         mock_delete.assert_not_called()
 
     # pylint: disable=too-many-arguments
-    @mock.patch('certbot.storage.renewal_file_for_certname')
-    @mock.patch('certbot.cert_manager.match_and_check_overlaps')
-    @mock.patch('certbot.storage.full_archive_path')
-    @mock.patch('certbot.cert_manager.delete')
-    @mock.patch('certbot.cert_manager.cert_path_to_lineage')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.cert_manager.match_and_check_overlaps')
+    @mock.patch('certbot._internal.storage.full_archive_path')
+    @mock.patch('certbot._internal.cert_manager.delete')
+    @mock.patch('certbot._internal.cert_manager.cert_path_to_lineage')
     @test_util.patch_get_utility()
     def test_cert_path_only(self, mock_get_utility,
             mock_cert_path_to_lineage, mock_delete, mock_archive,
@@ -396,11 +396,11 @@ class DeleteIfAppropriateTest(test_util.ConfigTestCase):
         self.assertEqual(mock_delete.call_count, 1)
 
     # pylint: disable=too-many-arguments
-    @mock.patch('certbot.storage.renewal_file_for_certname')
-    @mock.patch('certbot.cert_manager.match_and_check_overlaps')
-    @mock.patch('certbot.storage.full_archive_path')
-    @mock.patch('certbot.cert_manager.cert_path_to_lineage')
-    @mock.patch('certbot.cert_manager.delete')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.cert_manager.match_and_check_overlaps')
+    @mock.patch('certbot._internal.storage.full_archive_path')
+    @mock.patch('certbot._internal.cert_manager.cert_path_to_lineage')
+    @mock.patch('certbot._internal.cert_manager.delete')
     @test_util.patch_get_utility()
     def test_noninteractive_deletion(self, mock_get_utility, mock_delete,
             mock_cert_path_to_lineage, mock_full_archive_dir,
@@ -417,11 +417,11 @@ class DeleteIfAppropriateTest(test_util.ConfigTestCase):
         self.assertEqual(mock_delete.call_count, 1)
 
     # pylint: disable=too-many-arguments
-    @mock.patch('certbot.storage.renewal_file_for_certname')
-    @mock.patch('certbot.cert_manager.match_and_check_overlaps')
-    @mock.patch('certbot.storage.full_archive_path')
-    @mock.patch('certbot.cert_manager.cert_path_to_lineage')
-    @mock.patch('certbot.cert_manager.delete')
+    @mock.patch('certbot._internal.storage.renewal_file_for_certname')
+    @mock.patch('certbot._internal.cert_manager.match_and_check_overlaps')
+    @mock.patch('certbot._internal.storage.full_archive_path')
+    @mock.patch('certbot._internal.cert_manager.cert_path_to_lineage')
+    @mock.patch('certbot._internal.cert_manager.delete')
     @test_util.patch_get_utility()
     def test_opt_in_deletion(self, mock_get_utility, mock_delete,
             mock_cert_path_to_lineage, mock_full_archive_dir,
@@ -440,7 +440,7 @@ class DeleteIfAppropriateTest(test_util.ConfigTestCase):
 
 
 class DetermineAccountTest(test_util.ConfigTestCase):
-    """Tests for certbot.main._determine_account."""
+    """Tests for certbot._internal.main._determine_account."""
 
     def setUp(self):
         super(DetermineAccountTest, self).setUp()
@@ -455,8 +455,8 @@ class DetermineAccountTest(test_util.ConfigTestCase):
 
     def _call(self):
         # pylint: disable=protected-access
-        from certbot.main import _determine_account
-        with mock.patch('certbot.main.account.AccountFileStorage') as mock_storage:
+        from certbot._internal.main import _determine_account
+        with mock.patch('certbot._internal.main.account.AccountFileStorage') as mock_storage:
             mock_storage.return_value = self.account_storage
             return _determine_account(self.config)
 
@@ -473,7 +473,7 @@ class DetermineAccountTest(test_util.ConfigTestCase):
         self.assertEqual(self.accs[0].id, self.config.account)
         self.assertTrue(self.config.email is None)
 
-    @mock.patch('certbot.client.display_ops.choose_account')
+    @mock.patch('certbot._internal.client.display_ops.choose_account')
     def test_multiple_accounts(self, mock_choose_accounts):
         for acc in self.accs:
             self.account_storage.save(acc, self.mock_client)
@@ -484,11 +484,11 @@ class DetermineAccountTest(test_util.ConfigTestCase):
         self.assertEqual(self.accs[1].id, self.config.account)
         self.assertTrue(self.config.email is None)
 
-    @mock.patch('certbot.client.display_ops.get_email')
+    @mock.patch('certbot._internal.client.display_ops.get_email')
     def test_no_accounts_no_email(self, mock_get_email):
         mock_get_email.return_value = 'foo@bar.baz'
 
-        with mock.patch('certbot.main.client') as client:
+        with mock.patch('certbot._internal.main.client') as client:
             client.register.return_value = (
                 self.accs[0], mock.sentinel.acme)
             self.assertEqual((self.accs[0], mock.sentinel.acme), self._call())
@@ -500,7 +500,7 @@ class DetermineAccountTest(test_util.ConfigTestCase):
 
     def test_no_accounts_email(self):
         self.config.email = 'other email'
-        with mock.patch('certbot.main.client') as client:
+        with mock.patch('certbot._internal.main.client') as client:
             client.register.return_value = (self.accs[1], mock.sentinel.acme)
             self._call()
         self.assertEqual(self.accs[1].id, self.config.account)
@@ -543,11 +543,11 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
 
             with mock.patch("certbot.compat.os.path.isfile") as mock_if:
                 mock_if.side_effect = mock_isfile
-                with mock.patch('certbot.main.client') as client:
+                with mock.patch('certbot._internal.main.client') as client:
                     ret, stdout, stderr = self._call_no_clientmock(args, stdout)
                     return ret, stdout, stderr, client
         else:
-            with mock.patch('certbot.main.client') as client:
+            with mock.patch('certbot._internal.main.client') as client:
                 ret, stdout, stderr = self._call_no_clientmock(args, stdout)
                 return ret, stdout, stderr, client
 
@@ -556,22 +556,22 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         args = self.standard_args + args
 
         toy_stdout = stdout if stdout else six.StringIO()
-        with mock.patch('certbot.main.sys.stdout', new=toy_stdout):
-            with mock.patch('certbot.main.sys.stderr') as stderr:
+        with mock.patch('certbot._internal.main.sys.stdout', new=toy_stdout):
+            with mock.patch('certbot._internal.main.sys.stderr') as stderr:
                 with mock.patch("certbot.util.atexit"):
                     ret = main.main(args[:])  # NOTE: parser can alter its args!
         return ret, toy_stdout, stderr
 
     def test_no_flags(self):
-        with mock.patch('certbot.main.run') as mock_run:
+        with mock.patch('certbot._internal.main.run') as mock_run:
             self._call([])
             self.assertEqual(1, mock_run.call_count)
 
     def test_version_string_program_name(self):
         toy_out = six.StringIO()
         toy_err = six.StringIO()
-        with mock.patch('certbot.main.sys.stdout', new=toy_out):
-            with mock.patch('certbot.main.sys.stderr', new=toy_err):
+        with mock.patch('certbot._internal.main.sys.stdout', new=toy_out):
+            with mock.patch('certbot._internal.main.sys.stderr', new=toy_err):
                 try:
                     main.main(["--version"])
                 except SystemExit:
@@ -584,7 +584,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         "Ensure that a particular error raises a missing cli flag error containing message"
         exc = None
         try:
-            with mock.patch('certbot.main.sys.stderr'):
+            with mock.patch('certbot._internal.main.sys.stderr'):
                 main.main(self.standard_args + args[:])  # NOTE: parser can alter its args!
         except errors.MissingCommandlineFlag as exc_:
             exc = exc_
@@ -599,11 +599,11 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         self._cli_missing_flag(args, "register before running")
 
     @mock.patch('certbot.log.post_arg_parse_setup')
-    @mock.patch('certbot.main._report_new_cert')
-    @mock.patch('certbot.main.client.acme_client.Client')
-    @mock.patch('certbot.main._determine_account')
-    @mock.patch('certbot.main.client.Client.obtain_and_enroll_certificate')
-    @mock.patch('certbot.main._get_and_save_cert')
+    @mock.patch('certbot._internal.main._report_new_cert')
+    @mock.patch('certbot._internal.main.client.acme_client.Client')
+    @mock.patch('certbot._internal.main._determine_account')
+    @mock.patch('certbot._internal.main.client.Client.obtain_and_enroll_certificate')
+    @mock.patch('certbot._internal.main._get_and_save_cert')
     def test_user_agent(self, gsc, _obt, det, _client, _, __):
         # Normally the client is totally mocked out, but here we need more
         # arguments to automate it...
@@ -612,7 +612,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         det.return_value = mock.MagicMock(), None
         gsc.return_value = mock.MagicMock()
 
-        with mock.patch('certbot.main.client.acme_client.ClientNetwork') as acme_net:
+        with mock.patch('certbot._internal.main.client.acme_client.ClientNetwork') as acme_net:
             self._call_no_clientmock(args)
             os_ver = util.get_os_info_ua()
             ua = acme_net.call_args[1]["user_agent"]
@@ -622,30 +622,30 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             if "linux" in plat.lower():
                 self.assertTrue(util.get_os_info_ua() in ua)
 
-        with mock.patch('certbot.main.client.acme_client.ClientNetwork') as acme_net:
+        with mock.patch('certbot._internal.main.client.acme_client.ClientNetwork') as acme_net:
             ua = "bandersnatch"
             args += ["--user-agent", ua]
             self._call_no_clientmock(args)
             acme_net.assert_called_once_with(mock.ANY, account=mock.ANY, verify_ssl=True,
                 user_agent=ua)
 
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
     def test_installer_selection(self, mock_pick_installer, _rec):
         self._call(['install', '--domains', 'foo.bar', '--cert-path', 'cert',
                     '--key-path', 'privkey', '--chain-path', 'chain'], mockisfile=True)
         self.assertEqual(mock_pick_installer.call_count, 1)
 
-    @mock.patch('certbot.main._install_cert')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main._install_cert')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
     def test_installer_certname(self, _inst, _rec, mock_install):
         mock_lineage = mock.MagicMock(cert_path=test_util.temp_join('cert'),
                                       chain_path=test_util.temp_join('chain'),
                                       fullchain_path=test_util.temp_join('chain'),
                                       key_path=test_util.temp_join('privkey'))
 
-        with mock.patch("certbot.cert_manager.lineage_for_certname") as mock_getlin:
+        with mock.patch("certbot._internal.cert_manager.lineage_for_certname") as mock_getlin:
             mock_getlin.return_value = mock_lineage
             self._call(['install', '--cert-name', 'whatever'], mockisfile=True)
             call_config = mock_install.call_args[0][0]
@@ -654,15 +654,15 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             self.assertEqual(call_config.key_path, test_util.temp_join('privkey'))
 
     @mock.patch('certbot.log.post_arg_parse_setup')
-    @mock.patch('certbot.main._install_cert')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main._install_cert')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
     def test_installer_param_override(self, _inst, _rec, mock_install, _):
         mock_lineage = mock.MagicMock(cert_path=test_util.temp_join('cert'),
                                       chain_path=test_util.temp_join('chain'),
                                       fullchain_path=test_util.temp_join('chain'),
                                       key_path=test_util.temp_join('privkey'))
-        with mock.patch("certbot.cert_manager.lineage_for_certname") as mock_getlin:
+        with mock.patch("certbot._internal.cert_manager.lineage_for_certname") as mock_getlin:
             mock_getlin.return_value = mock_lineage
             self._call(['install', '--cert-name', 'whatever',
                         '--key-path', test_util.temp_join('overriding_privkey')], mockisfile=True)
@@ -681,31 +681,31 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             self.assertEqual(call_config.fullchain_path, test_util.temp_join('chain'))
             self.assertEqual(call_config.key_path, test_util.temp_join('privkey'))
 
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
     def test_installer_param_error(self, _inst, _rec):
         self.assertRaises(errors.ConfigurationError,
                           self._call,
                           ['install', '--cert-name', 'notfound',
                            '--key-path', 'invalid'])
 
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
-    @mock.patch('certbot.cert_manager.get_certnames')
-    @mock.patch('certbot.main._install_cert')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.cert_manager.get_certnames')
+    @mock.patch('certbot._internal.main._install_cert')
     def test_installer_select_cert(self, mock_inst, mock_getcert, _inst, _rec):
         mock_lineage = mock.MagicMock(cert_path=test_util.temp_join('cert'),
                                       chain_path=test_util.temp_join('chain'),
                                       fullchain_path=test_util.temp_join('chain'),
                                       key_path=test_util.temp_join('privkey'))
-        with mock.patch("certbot.cert_manager.lineage_for_certname") as mock_getlin:
+        with mock.patch("certbot._internal.cert_manager.lineage_for_certname") as mock_getlin:
             mock_getlin.return_value = mock_lineage
             self._call(['install'], mockisfile=True)
         self.assertTrue(mock_getcert.called)
         self.assertTrue(mock_inst.called)
 
     @mock.patch('certbot.log.post_arg_parse_setup')
-    @mock.patch('certbot.main._report_new_cert')
+    @mock.patch('certbot._internal.main._report_new_cert')
     @mock.patch('certbot.util.exe_exists')
     def test_configurator_selection(self, mock_exe_exists, _, __):
         mock_exe_exists.return_value = True
@@ -733,14 +733,14 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
 
         self._cli_missing_flag(["--standalone"], "With the standalone plugin, you probably")
 
-        with mock.patch("certbot.main._init_le_client") as mock_init:
-            with mock.patch("certbot.main._get_and_save_cert") as mock_gsc:
+        with mock.patch("certbot._internal.main._init_le_client") as mock_init:
+            with mock.patch("certbot._internal.main._get_and_save_cert") as mock_gsc:
                 mock_gsc.return_value = mock.MagicMock()
                 self._call(["certonly", "--manual", "-d", "foo.bar"])
                 unused_config, auth, unused_installer = mock_init.call_args[0]
                 self.assertTrue(isinstance(auth, manual.Authenticator))
 
-        with mock.patch('certbot.main.certonly') as mock_certonly:
+        with mock.patch('certbot._internal.main.certonly') as mock_certonly:
             self._call(["auth", "--standalone"])
             self.assertEqual(1, mock_certonly.call_count)
 
@@ -753,17 +753,17 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         client.rollback.assert_called_once_with(
             mock.ANY, 123, mock.ANY, mock.ANY)
 
-    @mock.patch('certbot.cert_manager.update_live_symlinks')
+    @mock.patch('certbot._internal.cert_manager.update_live_symlinks')
     def test_update_symlinks(self, mock_cert_manager):
         self._call_no_clientmock(['update_symlinks'])
         self.assertEqual(1, mock_cert_manager.call_count)
 
-    @mock.patch('certbot.cert_manager.certificates')
+    @mock.patch('certbot._internal.cert_manager.certificates')
     def test_certificates(self, mock_cert_manager):
         self._call_no_clientmock(['certificates'])
         self.assertEqual(1, mock_cert_manager.call_count)
 
-    @mock.patch('certbot.cert_manager.delete')
+    @mock.patch('certbot._internal.cert_manager.delete')
     def test_delete(self, mock_cert_manager):
         self._call_no_clientmock(['delete'])
         self.assertEqual(1, mock_cert_manager.call_count)
@@ -776,8 +776,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
                   for r in six.moves.range(len(flags)))):
             self._call(['plugins'] + list(args))
 
-    @mock.patch('certbot.main.plugins_disco')
-    @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics')
+    @mock.patch('certbot._internal.main.plugins_disco')
+    @mock.patch('certbot._internal.main.cli.HelpfulArgumentParser.determine_help_topics')
     def test_plugins_no_args(self, _det, mock_disco):
         ifaces = []  # type: List[interfaces.IPlugin]
         plugins = mock_disco.PluginsRegistry.find_all()
@@ -791,8 +791,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         filtered = plugins.visible().ifaces()
         self.assertEqual(stdout.getvalue().strip(), str(filtered))
 
-    @mock.patch('certbot.main.plugins_disco')
-    @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics')
+    @mock.patch('certbot._internal.main.plugins_disco')
+    @mock.patch('certbot._internal.main.cli.HelpfulArgumentParser.determine_help_topics')
     def test_plugins_no_args_unprivileged(self, _det, mock_disco):
         ifaces = []  # type: List[interfaces.IPlugin]
         plugins = mock_disco.PluginsRegistry.find_all()
@@ -813,8 +813,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         filtered = plugins.visible().ifaces()
         self.assertEqual(stdout.getvalue().strip(), str(filtered))
 
-    @mock.patch('certbot.main.plugins_disco')
-    @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics')
+    @mock.patch('certbot._internal.main.plugins_disco')
+    @mock.patch('certbot._internal.main.cli.HelpfulArgumentParser.determine_help_topics')
     def test_plugins_init(self, _det, mock_disco):
         ifaces = []  # type: List[interfaces.IPlugin]
         plugins = mock_disco.PluginsRegistry.find_all()
@@ -831,8 +831,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         verified = filtered.verify()
         self.assertEqual(stdout.getvalue().strip(), str(verified))
 
-    @mock.patch('certbot.main.plugins_disco')
-    @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics')
+    @mock.patch('certbot._internal.main.plugins_disco')
+    @mock.patch('certbot._internal.main.cli.HelpfulArgumentParser.determine_help_topics')
     def test_plugins_prepare(self, _det, mock_disco):
         ifaces = []  # type: List[interfaces.IPlugin]
         plugins = mock_disco.PluginsRegistry.find_all()
@@ -858,7 +858,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         chain = 'chain'
         fullchain = 'fullchain'
 
-        with mock.patch('certbot.main.certonly') as mock_certonly:
+        with mock.patch('certbot._internal.main.certonly') as mock_certonly:
             self._call(['certonly', '--cert-path', cert, '--key-path', 'key',
                         '--chain-path', 'chain',
                         '--fullchain-path', 'fullchain'])
@@ -916,9 +916,10 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             'certonly -d example.org --csr {0}'.format(CSR).split())
 
     def _certonly_new_request_common(self, mock_client, args=None):
-        with mock.patch('certbot.main._find_lineage_for_domains_and_certname') as mock_renewal:
+        with mock.patch('certbot._internal.main._find_lineage_for_domains_and_certname') \
+            as mock_renewal:
             mock_renewal.return_value = ("newcert", None)
-            with mock.patch('certbot.main._init_le_client') as mock_init:
+            with mock.patch('certbot._internal.main._init_le_client') as mock_init:
                 mock_init.return_value = mock_client
                 if args is None:
                     args = []
@@ -990,18 +991,19 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             stdout.write(message)
 
         try:
-            with mock.patch('certbot.cert_manager.find_duplicative_certs') as mock_fdc:
+            with mock.patch('certbot._internal.cert_manager.find_duplicative_certs') as mock_fdc:
                 mock_fdc.return_value = (mock_lineage, None)
-                with mock.patch('certbot.main._init_le_client') as mock_init:
+                with mock.patch('certbot._internal.main._init_le_client') as mock_init:
                     mock_init.return_value = mock_client
                     with test_util.patch_get_utility() as mock_get_utility:
                         if not quiet_mode:
                             mock_get_utility().notification.side_effect = write_msg
-                        with mock.patch('certbot.main.renewal.OpenSSL') as mock_ssl:
+                        with mock.patch('certbot._internal.main.renewal.OpenSSL') as mock_ssl:
                             mock_latest = mock.MagicMock()
                             mock_latest.get_issuer.return_value = "Fake fake"
                             mock_ssl.crypto.load_certificate.return_value = mock_latest
-                            with mock.patch('certbot.main.renewal.crypto_util') as mock_crypto_util:
+                            with mock.patch('certbot._internal.main.renewal.crypto_util') \
+                                as mock_crypto_util:
                                 mock_crypto_util.notAfter.return_value = expiry_date
                                 if not args:
                                     args = ['-d', 'isnot.org', '-a', 'standalone', 'certonly']
@@ -1083,7 +1085,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         args = ["renew", "--dry-run", "--reuse-key"]
         self._test_renewal_common(True, [], args=args, should_renew=True, reuse_key=True)
 
-    @mock.patch('certbot.storage.RenewableCert.save_successor')
+    @mock.patch('certbot._internal.storage.RenewableCert.save_successor')
     def test_reuse_key_no_dry_run(self, unused_save_successor):
         test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
         args = ["renew", "--reuse-key"]
@@ -1109,7 +1111,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         self._test_renewal_common(True, [], args=args, should_renew=True)
         self.assertEqual(self.mock_sleep.call_count, 0)
 
-    @mock.patch('certbot.renewal.should_renew')
+    @mock.patch('certbot._internal.renewal.should_renew')
     def test_renew_skips_recent_certs(self, should_renew):
         should_renew.return_value = False
         test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
@@ -1175,7 +1177,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
     def _test_renew_common(self, renewalparams=None, names=None,
                            assert_oc_called=None, **kwargs):
         self._make_dummy_renewal_config()
-        with mock.patch('certbot.storage.RenewableCert') as mock_rc:
+        with mock.patch('certbot._internal.storage.RenewableCert') as mock_rc:
             mock_lineage = mock.MagicMock()
             mock_lineage.fullchain = "somepath/fullchain.pem"
             if renewalparams is not None:
@@ -1183,7 +1185,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             if names is not None:
                 mock_lineage.names.return_value = names
             mock_rc.return_value = mock_lineage
-            with mock.patch('certbot.main.renew_cert') as mock_renew_cert:
+            with mock.patch('certbot._internal.main.renew_cert') as mock_renew_cert:
                 kwargs.setdefault('args', ['renew'])
                 self._test_renewal_common(True, None, should_renew=False, **kwargs)
 
@@ -1241,19 +1243,19 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
 
     def test_renew_reconstitute_error(self):
         # pylint: disable=protected-access
-        with mock.patch('certbot.main.renewal._reconstitute') as mock_reconstitute:
+        with mock.patch('certbot._internal.main.renewal._reconstitute') as mock_reconstitute:
             mock_reconstitute.side_effect = Exception
             self._test_renew_common(assert_oc_called=False, error_expected=True)
 
     def test_renew_obtain_cert_error(self):
         self._make_dummy_renewal_config()
-        with mock.patch('certbot.storage.RenewableCert') as mock_rc:
+        with mock.patch('certbot._internal.storage.RenewableCert') as mock_rc:
             mock_lineage = mock.MagicMock()
             mock_lineage.fullchain = "somewhere/fullchain.pem"
             mock_rc.return_value = mock_lineage
             mock_lineage.configuration = {
                 'renewalparams': {'authenticator': 'webroot'}}
-            with mock.patch('certbot.main.renew_cert') as mock_renew_cert:
+            with mock.patch('certbot._internal.main.renew_cert') as mock_renew_cert:
                 mock_renew_cert.side_effect = Exception
                 self._test_renewal_common(True, None, error_expected=True,
                                           args=['renew'], should_renew=False)
@@ -1273,8 +1275,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         self.assertTrue('No hooks were run.' in stdout.getvalue())
 
     @test_util.patch_get_utility()
-    @mock.patch('certbot.main._find_lineage_for_domains_and_certname')
-    @mock.patch('certbot.main._init_le_client')
+    @mock.patch('certbot._internal.main._find_lineage_for_domains_and_certname')
+    @mock.patch('certbot._internal.main._init_le_client')
     def test_certonly_reinstall(self, mock_init, mock_renewal, mock_get_utility):
         mock_renewal.return_value = ('reinstall', mock.MagicMock())
         mock_init.return_value = mock_client = mock.MagicMock()
@@ -1296,7 +1298,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             self.config.config_dir,
             'live/example.com/fullchain.pem'))
         mock_client.save_certificate.return_value = cert_path, None, full_path
-        with mock.patch('certbot.main._init_le_client') as mock_init:
+        with mock.patch('certbot._internal.main._init_le_client') as mock_init:
             mock_init.return_value = mock_client
             with test_util.patch_get_utility() as mock_get_utility:
                 chain_path = os.path.normpath(os.path.join(
@@ -1307,7 +1309,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
                             CSR, cert_path, chain_path, full_path).split()
                 if extra_args:
                     args += extra_args
-                with mock.patch('certbot.main.crypto_util'):
+                with mock.patch('certbot._internal.main.crypto_util'):
                     self._call(args)
 
         if '--dry-run' in args:
@@ -1332,8 +1334,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
         self.assertTrue(
             'dry run' in mock_get_utility().add_message.call_args[0][0])
 
-    @mock.patch('certbot.main._delete_if_appropriate')
-    @mock.patch('certbot.main.client.acme_client')
+    @mock.patch('certbot._internal.main._delete_if_appropriate')
+    @mock.patch('certbot._internal.main.client.acme_client')
     def test_revoke_with_key(self, mock_acme_client,
             mock_delete_if_appropriate):
         mock_delete_if_appropriate.return_value = False
@@ -1356,8 +1358,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             ['--cert-path', CERT, '--key-path', KEY,
                                  '--server', server, 'revoke'])
 
-    @mock.patch('certbot.main._delete_if_appropriate')
-    @mock.patch('certbot.main._determine_account')
+    @mock.patch('certbot._internal.main._delete_if_appropriate')
+    @mock.patch('certbot._internal.main._determine_account')
     def test_revoke_without_key(self, mock_determine_account,
             mock_delete_if_appropriate):
         mock_delete_if_appropriate.return_value = False
@@ -1372,7 +1374,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
 
     @mock.patch('certbot.log.post_arg_parse_setup')
     def test_register(self, _):
-        with mock.patch('certbot.main.client') as mocked_client:
+        with mock.patch('certbot._internal.main.client') as mocked_client:
             acc = mock.MagicMock()
             acc.id = "imaginary_account"
             mocked_client.register.return_value = (acc, "worked")
@@ -1380,7 +1382,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
             # TODO: It would be more correct to explicitly check that
             #       _determine_account() gets called in the above case,
             #       but coverage statistics should also show that it did.
-            with mock.patch('certbot.main.account') as mocked_account:
+            with mock.patch('certbot._internal.main.account') as mocked_account:
                 mocked_storage = mock.MagicMock()
                 mocked_account.AccountFileStorage.return_value = mocked_storage
                 mocked_storage.find_all.return_value = ["an account"]
@@ -1388,8 +1390,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
                 self.assertTrue("There is an existing account" in x[0])
 
     def test_update_account_no_existing_accounts(self):
-        # with mock.patch('certbot.main.client') as mocked_client:
-        with mock.patch('certbot.main.account') as mocked_account:
+        # with mock.patch('certbot._internal.main.client') as mocked_client:
+        with mock.patch('certbot._internal.main.account') as mocked_account:
             mocked_storage = mock.MagicMock()
             mocked_account.AccountFileStorage.return_value = mocked_storage
             mocked_storage.find_all.return_value = []
@@ -1401,8 +1403,8 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
     # TODO: When `certbot register --update-registration` is fully deprecated,
     # delete the following test
     def test_update_registration_no_existing_accounts_deprecated(self):
-        # with mock.patch('certbot.main.client') as mocked_client:
-        with mock.patch('certbot.main.account') as mocked_account:
+        # with mock.patch('certbot._internal.main.client') as mocked_client:
+        with mock.patch('certbot._internal.main.account') as mocked_account:
             mocked_storage = mock.MagicMock()
             mocked_account.AccountFileStorage.return_value = mocked_storage
             mocked_storage.find_all.return_value = []
@@ -1416,7 +1418,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
     def test_update_registration_unsafely_deprecated(self):
         # This test will become obsolete when register --update-registration
         # supports removing an e-mail address from the account
-        with mock.patch('certbot.main.account') as mocked_account:
+        with mock.patch('certbot._internal.main.account') as mocked_account:
             mocked_storage = mock.MagicMock()
             mocked_account.AccountFileStorage.return_value = mocked_storage
             mocked_storage.find_all.return_value = ["an account"]
@@ -1425,15 +1427,15 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
                 "--register-unsafely-without-email".split())
             self.assertTrue("--register-unsafely-without-email" in x[0])
 
-    @mock.patch('certbot.main.display_ops.get_email')
+    @mock.patch('certbot._internal.main.display_ops.get_email')
     @test_util.patch_get_utility()
     def test_update_account_with_email(self, mock_utility, mock_email):
         email = "user@example.com"
         mock_email.return_value = email
         with mock.patch('certbot.eff.handle_subscription') as mock_handle:
-            with mock.patch('certbot.main._determine_account') as mocked_det:
-                with mock.patch('certbot.main.account') as mocked_account:
-                    with mock.patch('certbot.main.client') as mocked_client:
+            with mock.patch('certbot._internal.main._determine_account') as mocked_det:
+                with mock.patch('certbot._internal.main.account') as mocked_account:
+                    with mock.patch('certbot._internal.main.client') as mocked_client:
                         mocked_storage = mock.MagicMock()
                         mocked_account.AccountFileStorage.return_value = mocked_storage
                         mocked_storage.find_all.return_value = ["an account"]
@@ -1457,15 +1459,15 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
 
     # TODO: When `certbot register --update-registration` is fully deprecated,
     # delete the following test
-    @mock.patch('certbot.main.display_ops.get_email')
+    @mock.patch('certbot._internal.main.display_ops.get_email')
     @test_util.patch_get_utility()
     def test_update_registration_with_email_deprecated(self, mock_utility, mock_email):
         email = "user@example.com"
         mock_email.return_value = email
         with mock.patch('certbot.eff.handle_subscription') as mock_handle:
-            with mock.patch('certbot.main._determine_account') as mocked_det:
-                with mock.patch('certbot.main.account') as mocked_account:
-                    with mock.patch('certbot.main.client') as mocked_client:
+            with mock.patch('certbot._internal.main._determine_account') as mocked_det:
+                with mock.patch('certbot._internal.main.account') as mocked_account:
+                    with mock.patch('certbot._internal.main.client') as mocked_client:
                         mocked_storage = mock.MagicMock()
                         mocked_account.AccountFileStorage.return_value = mocked_storage
                         mocked_storage.find_all.return_value = ["an account"]
@@ -1492,7 +1494,7 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
                         self.assertTrue(mock_handle.called)
 
     @mock.patch('certbot.plugins.selection.choose_configurator_plugins')
-    @mock.patch('certbot.updater._run_updaters')
+    @mock.patch('certbot._internal.updater._run_updaters')
     def test_plugin_selection_error(self, mock_run, mock_choose):
         mock_choose.side_effect = errors.PluginSelectionError
         self.assertRaises(errors.PluginSelectionError, main.renew_cert,
@@ -1508,9 +1510,9 @@ class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-met
 class UnregisterTest(unittest.TestCase):
     def setUp(self):
         self.patchers = {
-            '_determine_account': mock.patch('certbot.main._determine_account'),
-            'account': mock.patch('certbot.main.account'),
-            'client': mock.patch('certbot.main.client'),
+            '_determine_account': mock.patch('certbot._internal.main._determine_account'),
+            'account': mock.patch('certbot._internal.main.account'),
+            'client': mock.patch('certbot._internal.main.client'),
             'get_utility': test_util.patch_get_utility()}
         self.mocks = dict((k, v.start()) for k, v in self.patchers.items())
 
@@ -1568,9 +1570,9 @@ class UnregisterTest(unittest.TestCase):
 
 
 class MakeOrVerifyNeededDirs(test_util.ConfigTestCase):
-    """Tests for certbot.main.make_or_verify_needed_dirs."""
+    """Tests for certbot._internal.main.make_or_verify_needed_dirs."""
 
-    @mock.patch("certbot.main.util")
+    @mock.patch("certbot._internal.main.util")
     def test_it(self, mock_util):
         main.make_or_verify_needed_dirs(self.config)
         for core_dir in (self.config.config_dir, self.config.work_dir,):
@@ -1589,7 +1591,7 @@ class MakeOrVerifyNeededDirs(test_util.ConfigTestCase):
 
 
 class EnhanceTest(test_util.ConfigTestCase):
-    """Tests for certbot.main.enhance."""
+    """Tests for certbot._internal.main.enhance."""
 
     def setUp(self):
         super(EnhanceTest, self).setUp()
@@ -1605,53 +1607,53 @@ class EnhanceTest(test_util.ConfigTestCase):
         config = configuration.NamespaceConfig(
             cli.prepare_and_parse_args(plugins, args))
 
-        with mock.patch('certbot.cert_manager.get_certnames') as mock_certs:
+        with mock.patch('certbot._internal.cert_manager.get_certnames') as mock_certs:
             mock_certs.return_value = ['example.com']
-            with mock.patch('certbot.cert_manager.domains_for_certname') as mock_dom:
+            with mock.patch('certbot._internal.cert_manager.domains_for_certname') as mock_dom:
                 mock_dom.return_value = ['example.com']
-                with mock.patch('certbot.main._init_le_client') as mock_init:
+                with mock.patch('certbot._internal.main._init_le_client') as mock_init:
                     mock_client = mock.MagicMock()
                     mock_client.config = config
                     mock_init.return_value = mock_client
                     main.enhance(config, plugins)
                     return mock_client # returns the client
 
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main._find_domains_or_certname')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main._find_domains_or_certname')
     def test_selection_question(self, mock_find, mock_choose, mock_lineage, _rec):
         mock_lineage.return_value = mock.MagicMock(chain_path="/tmp/nonexistent")
         mock_choose.return_value = ['example.com']
         mock_find.return_value = (None, None)
-        with mock.patch('certbot.main.plug_sel.pick_installer') as mock_pick:
+        with mock.patch('certbot._internal.main.plug_sel.pick_installer') as mock_pick:
             self._call(['enhance', '--redirect'])
             self.assertTrue(mock_pick.called)
             # Check that the message includes "enhancements"
             self.assertTrue("enhancements" in mock_pick.call_args[0][3])
 
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main._find_domains_or_certname')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main._find_domains_or_certname')
     def test_selection_auth_warning(self, mock_find, mock_choose, mock_lineage, _rec):
         mock_lineage.return_value = mock.MagicMock(chain_path="/tmp/nonexistent")
         mock_choose.return_value = ["example.com"]
         mock_find.return_value = (None, None)
-        with mock.patch('certbot.main.plug_sel.pick_installer'):
-            with mock.patch('certbot.main.plug_sel.logger.warning') as mock_log:
+        with mock.patch('certbot._internal.main.plug_sel.pick_installer'):
+            with mock.patch('certbot._internal.main.plug_sel.logger.warning') as mock_log:
                 mock_client = self._call(['enhance', '-a', 'webroot', '--redirect'])
                 self.assertTrue(mock_log.called)
                 self.assertTrue("make sense" in mock_log.call_args[0][0])
                 self.assertTrue(mock_client.enhance_config.called)
 
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
     def test_enhance_config_call(self, _rec, mock_choose, mock_lineage):
         mock_lineage.return_value = mock.MagicMock(chain_path="/tmp/nonexistent")
         mock_choose.return_value = ["example.com"]
-        with mock.patch('certbot.main.plug_sel.pick_installer'):
+        with mock.patch('certbot._internal.main.plug_sel.pick_installer'):
             mock_client = self._call(['enhance', '--redirect', '--hsts'])
             req_enh = ["redirect", "hsts"]
             not_req_enh = ["uir"]
@@ -1663,24 +1665,24 @@ class EnhanceTest(test_util.ConfigTestCase):
             self.assertTrue(
                 "example.com" in mock_client.enhance_config.call_args[0][0])
 
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
     def test_enhance_noninteractive(self, _rec, mock_choose, mock_lineage):
         mock_lineage.return_value = mock.MagicMock(
             chain_path="/tmp/nonexistent")
         mock_choose.return_value = ["example.com"]
-        with mock.patch('certbot.main.plug_sel.pick_installer'):
+        with mock.patch('certbot._internal.main.plug_sel.pick_installer'):
             mock_client = self._call(['enhance', '--redirect',
                                       '--hsts', '--non-interactive'])
             self.assertTrue(mock_client.enhance_config.called)
             self.assertFalse(mock_choose.called)
 
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
     def test_user_abort_domains(self, _rec, mock_choose):
         mock_choose.return_value = []
-        with mock.patch('certbot.main.plug_sel.pick_installer'):
+        with mock.patch('certbot._internal.main.plug_sel.pick_installer'):
             self.assertRaises(errors.Error,
                               self._call,
                               ['enhance', '--redirect', '--hsts'])
@@ -1689,9 +1691,9 @@ class EnhanceTest(test_util.ConfigTestCase):
         self.assertRaises(errors.MisconfigurationError,
                           self._call, ['enhance', '-a', 'null'])
 
-    @mock.patch('certbot.main.plug_sel.choose_configurator_plugins')
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.choose_configurator_plugins')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
     def test_plugin_selection_error(self, _rec, mock_choose, mock_pick):
         mock_choose.return_value = ["example.com"]
         mock_pick.return_value = (None, None)
@@ -1699,10 +1701,10 @@ class EnhanceTest(test_util.ConfigTestCase):
         mock_client = self._call(['enhance', '--hsts'])
         self.assertFalse(mock_client.enhance_config.called)
 
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
     @test_util.patch_get_utility()
     def test_enhancement_enable(self, _, _rec, mock_inst, mock_choose, mock_lineage):
         mock_inst.return_value = self.mockinstaller
@@ -1713,10 +1715,10 @@ class EnhanceTest(test_util.ConfigTestCase):
         self.assertEqual(self.mockinstaller.enable_autohsts.call_args[0][1],
                           ["example.com", "another.tld"])
 
-    @mock.patch('certbot.cert_manager.lineage_for_certname')
-    @mock.patch('certbot.main.display_ops.choose_values')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.cert_manager.lineage_for_certname')
+    @mock.patch('certbot._internal.main.display_ops.choose_values')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
     @test_util.patch_get_utility()
     def test_enhancement_enable_not_supported(self, _, _rec, mock_inst, mock_choose, mock_lineage):
         mock_inst.return_value = null.Installer(self.config, "null")
@@ -1733,14 +1735,14 @@ class EnhanceTest(test_util.ConfigTestCase):
 
 
 class InstallTest(test_util.ConfigTestCase):
-    """Tests for certbot.main.install."""
+    """Tests for certbot._internal.main.install."""
 
     def setUp(self):
         super(InstallTest, self).setUp()
         self.mockinstaller = mock.MagicMock(spec=enhancements.AutoHSTSEnhancement)
 
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
     def test_install_enhancement_not_supported(self, mock_inst, _rec):
         mock_inst.return_value = null.Installer(self.config, "null")
         plugins = disco.PluginsRegistry.find_all()
@@ -1750,8 +1752,8 @@ class InstallTest(test_util.ConfigTestCase):
                           main.install,
                           self.config, plugins)
 
-    @mock.patch('certbot.main.plug_sel.record_chosen_plugins')
-    @mock.patch('certbot.main.plug_sel.pick_installer')
+    @mock.patch('certbot._internal.main.plug_sel.record_chosen_plugins')
+    @mock.patch('certbot._internal.main.plug_sel.pick_installer')
     def test_install_enhancement_no_certname(self, mock_inst, _rec):
         mock_inst.return_value = self.mockinstaller
         plugins = disco.PluginsRegistry.find_all()
diff --git a/certbot/tests/notify_test.py b/certbot/tests/notify_test.py
index d2af5b001..d6f7d2239 100644
--- a/certbot/tests/notify_test.py
+++ b/certbot/tests/notify_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.notify."""
+"""Tests for certbot._internal.notify."""
 import socket
 import unittest
 
@@ -8,9 +8,9 @@ import mock
 class NotifyTests(unittest.TestCase):
     """Tests for the notifier."""
 
-    @mock.patch("certbot.notify.smtplib.LMTP")
+    @mock.patch("certbot._internal.notify.smtplib.LMTP")
     def test_smtp_success(self, mock_lmtp):
-        from certbot.notify import notify
+        from certbot._internal.notify import notify
         lmtp_obj = mock.MagicMock()
         mock_lmtp.return_value = lmtp_obj
         self.assertTrue(notify("Goose", "auntrhody@example.com",
@@ -18,10 +18,10 @@ class NotifyTests(unittest.TestCase):
         self.assertEqual(lmtp_obj.connect.call_count, 1)
         self.assertEqual(lmtp_obj.sendmail.call_count, 1)
 
-    @mock.patch("certbot.notify.smtplib.LMTP")
-    @mock.patch("certbot.notify.subprocess.Popen")
+    @mock.patch("certbot._internal.notify.smtplib.LMTP")
+    @mock.patch("certbot._internal.notify.subprocess.Popen")
     def test_smtp_failure(self, mock_popen, mock_lmtp):
-        from certbot.notify import notify
+        from certbot._internal.notify import notify
         lmtp_obj = mock.MagicMock()
         mock_lmtp.return_value = lmtp_obj
         lmtp_obj.sendmail.side_effect = socket.error(17)
@@ -32,10 +32,10 @@ class NotifyTests(unittest.TestCase):
         self.assertEqual(lmtp_obj.sendmail.call_count, 1)
         self.assertEqual(proc.communicate.call_count, 1)
 
-    @mock.patch("certbot.notify.smtplib.LMTP")
-    @mock.patch("certbot.notify.subprocess.Popen")
+    @mock.patch("certbot._internal.notify.smtplib.LMTP")
+    @mock.patch("certbot._internal.notify.subprocess.Popen")
     def test_everything_fails(self, mock_popen, mock_lmtp):
-        from certbot.notify import notify
+        from certbot._internal.notify import notify
         lmtp_obj = mock.MagicMock()
         mock_lmtp.return_value = lmtp_obj
         lmtp_obj.sendmail.side_effect = socket.error(17)
diff --git a/certbot/tests/ocsp_test.py b/certbot/tests/ocsp_test.py
index 680e2c2bb..500d5960b 100644
--- a/certbot/tests/ocsp_test.py
+++ b/certbot/tests/ocsp_test.py
@@ -32,8 +32,8 @@ class OCSPTestOpenSSL(unittest.TestCase):
     """
 
     def setUp(self):
-        from certbot import ocsp
-        with mock.patch('certbot.ocsp.Popen') as mock_popen:
+        from certbot._internal import ocsp
+        with mock.patch('certbot._internal.ocsp.Popen') as mock_popen:
             with mock.patch('certbot.util.exe_exists') as mock_exists:
                 mock_communicate = mock.MagicMock()
                 mock_communicate.communicate.return_value = (None, out)
@@ -44,8 +44,8 @@ class OCSPTestOpenSSL(unittest.TestCase):
     def tearDown(self):
         pass
 
-    @mock.patch('certbot.ocsp.logger.info')
-    @mock.patch('certbot.ocsp.Popen')
+    @mock.patch('certbot._internal.ocsp.logger.info')
+    @mock.patch('certbot._internal.ocsp.Popen')
     @mock.patch('certbot.util.exe_exists')
     def test_init(self, mock_exists, mock_popen, mock_log):
         mock_communicate = mock.MagicMock()
@@ -53,7 +53,7 @@ class OCSPTestOpenSSL(unittest.TestCase):
         mock_popen.return_value = mock_communicate
         mock_exists.return_value = True
 
-        from certbot import ocsp
+        from certbot._internal import ocsp
         checker = ocsp.RevocationChecker(enforce_openssl_binary_usage=True)
         self.assertEqual(mock_popen.call_count, 1)
         self.assertEqual(checker.host_args("x"), ["Host=x"])
@@ -70,7 +70,7 @@ class OCSPTestOpenSSL(unittest.TestCase):
         self.assertEqual(mock_log.call_count, 1)
         self.assertEqual(checker.broken, True)
 
-    @mock.patch('certbot.ocsp._determine_ocsp_server')
+    @mock.patch('certbot._internal.ocsp._determine_ocsp_server')
     @mock.patch('certbot.util.run_script')
     def test_ocsp_revoked(self, mock_run, mock_determine):
         now = pytz.UTC.fromutc(datetime.utcnow())
@@ -104,16 +104,16 @@ class OCSPTestOpenSSL(unittest.TestCase):
     def test_determine_ocsp_server(self):
         cert_path = test_util.vector_path('ocsp_certificate.pem')
 
-        from certbot import ocsp
+        from certbot._internal import ocsp
         result = ocsp._determine_ocsp_server(cert_path)
         self.assertEqual(('http://ocsp.test4.buypass.com', 'ocsp.test4.buypass.com'), result)
 
-    @mock.patch('certbot.ocsp.logger')
+    @mock.patch('certbot._internal.ocsp.logger')
     @mock.patch('certbot.util.run_script')
     def test_translate_ocsp(self, mock_run, mock_log):
         # pylint: disable=protected-access
         mock_run.return_value = openssl_confused
-        from certbot import ocsp
+        from certbot._internal import ocsp
         self.assertEqual(ocsp._translate_ocsp_query(*openssl_happy), False)
         self.assertEqual(ocsp._translate_ocsp_query(*openssl_confused), False)
         self.assertEqual(mock_log.debug.call_count, 1)
@@ -141,7 +141,7 @@ class OSCPTestCryptography(unittest.TestCase):
     """
 
     def setUp(self):
-        from certbot import ocsp
+        from certbot._internal import ocsp
         self.checker = ocsp.RevocationChecker()
         self.cert_path = test_util.vector_path('ocsp_certificate.pem')
         self.chain_path = test_util.vector_path('ocsp_issuer_certificate.pem')
@@ -151,8 +151,8 @@ class OSCPTestCryptography(unittest.TestCase):
         now = pytz.UTC.fromutc(datetime.utcnow())
         self.cert_obj.target_expiry = now + timedelta(hours=2)
 
-    @mock.patch('certbot.ocsp._determine_ocsp_server')
-    @mock.patch('certbot.ocsp._check_ocsp_cryptography')
+    @mock.patch('certbot._internal.ocsp._determine_ocsp_server')
+    @mock.patch('certbot._internal.ocsp._check_ocsp_cryptography')
     def test_ensure_cryptography_toggled(self, mock_revoke, mock_determine):
         mock_determine.return_value = ('http://example.com', 'example.com')
         self.checker.ocsp_revoked(self.cert_obj)
@@ -259,7 +259,7 @@ class OSCPTestCryptography(unittest.TestCase):
         with _ocsp_mock(ocsp_lib.OCSPCertStatus.REVOKED, ocsp_lib.OCSPResponseStatus.SUCCESSFUL):
             # This mock is necessary to avoid the first call contained in _determine_ocsp_server
             # of the method cryptography.x509.Extensions.get_extension_for_class.
-            with mock.patch('certbot.ocsp._determine_ocsp_server') as mock_server:
+            with mock.patch('certbot._internal.ocsp._determine_ocsp_server') as mock_server:
                 mock_server.return_value = ('https://example.com', 'example.com')
                 with mock.patch('cryptography.x509.Extensions.get_extension_for_class',
                                 side_effect=x509.ExtensionNotFound(
@@ -271,12 +271,13 @@ class OSCPTestCryptography(unittest.TestCase):
 @contextlib.contextmanager
 def _ocsp_mock(certificate_status, response_status,
                http_status_code=200, check_signature_side_effect=None):
-    with mock.patch('certbot.ocsp.ocsp.load_der_ocsp_response') as mock_response:
+    with mock.patch('certbot._internal.ocsp.ocsp.load_der_ocsp_response') as mock_response:
         mock_response.return_value = _construct_mock_ocsp_response(
             certificate_status, response_status)
-        with mock.patch('certbot.ocsp.requests.post') as mock_post:
+        with mock.patch('certbot._internal.ocsp.requests.post') as mock_post:
             mock_post.return_value = mock.Mock(status_code=http_status_code)
-            with mock.patch('certbot.ocsp.crypto_util.verify_signed_payload') as mock_check:
+            with mock.patch('certbot._internal.ocsp.crypto_util.verify_signed_payload') \
+                as mock_check:
                 if check_signature_side_effect:
                     mock_check.side_effect = check_signature_side_effect
                 yield {
diff --git a/certbot/tests/renewal_test.py b/certbot/tests/renewal_test.py
index dca16c16c..162146d7e 100644
--- a/certbot/tests/renewal_test.py
+++ b/certbot/tests/renewal_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.renewal"""
+"""Tests for certbot._internal.renewal"""
 import unittest
 import mock
 
@@ -6,7 +6,7 @@ from acme import challenges
 
 from certbot import configuration
 from certbot import errors
-from certbot import storage
+from certbot._internal import storage
 
 import certbot.tests.util as test_util
 
@@ -24,15 +24,15 @@ class RenewalTest(test_util.ConfigTestCase):
         lineage = storage.RenewableCert(rc_path, config)
         renewalparams = lineage.configuration['renewalparams']
         # pylint: disable=protected-access
-        from certbot import renewal
+        from certbot._internal import renewal
         renewal._restore_webroot_config(config, renewalparams)
         self.assertEqual(config.webroot_path, ['/var/www/'])
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_webroot_params_conservation(self, mock_set_by_cli):
         # For more details about why this test is important, see:
         # certbot.plugins.webroot_test::WebrootActionTest::test_webroot_map_partial_without_perform
-        from certbot import renewal
+        from certbot._internal import renewal
         mock_set_by_cli.return_value = False
 
         renewalparams = {
@@ -53,26 +53,26 @@ class RenewalTest(test_util.ConfigTestCase):
 
 
 class RestoreRequiredConfigElementsTest(test_util.ConfigTestCase):
-    """Tests for certbot.renewal.restore_required_config_elements."""
+    """Tests for certbot._internal.renewal.restore_required_config_elements."""
     @classmethod
     def _call(cls, *args, **kwargs):
-        from certbot.renewal import restore_required_config_elements
+        from certbot._internal.renewal import restore_required_config_elements
         return restore_required_config_elements(*args, **kwargs)
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_allow_subset_of_names_success(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         self._call(self.config, {'allow_subset_of_names': 'True'})
         self.assertTrue(self.config.allow_subset_of_names is True)
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_allow_subset_of_names_failure(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         renewalparams = {'allow_subset_of_names': 'maybe'}
         self.assertRaises(
             errors.Error, self._call, self.config, renewalparams)
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_pref_challs_list(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         renewalparams = {'pref_challs': 'http-01, dns'.split(',')}
@@ -80,7 +80,7 @@ class RestoreRequiredConfigElementsTest(test_util.ConfigTestCase):
         expected = [challenges.HTTP01.typ, challenges.DNS01.typ]
         self.assertEqual(self.config.pref_challs, expected)
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_pref_challs_str(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         renewalparams = {'pref_challs': 'dns'}
@@ -88,19 +88,19 @@ class RestoreRequiredConfigElementsTest(test_util.ConfigTestCase):
         expected = [challenges.DNS01.typ]
         self.assertEqual(self.config.pref_challs, expected)
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_pref_challs_failure(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         renewalparams = {'pref_challs': 'finding-a-shrubbery'}
         self.assertRaises(errors.Error, self._call, self.config, renewalparams)
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_must_staple_success(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         self._call(self.config, {'must_staple': 'True'})
         self.assertTrue(self.config.must_staple is True)
 
-    @mock.patch('certbot.renewal.cli.set_by_cli')
+    @mock.patch('certbot._internal.renewal.cli.set_by_cli')
     def test_must_staple_failure(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
         renewalparams = {'must_staple': 'maybe'}
diff --git a/certbot/tests/renewupdater_test.py b/certbot/tests/renewupdater_test.py
index 5fe188c42..9ac55a48d 100644
--- a/certbot/tests/renewupdater_test.py
+++ b/certbot/tests/renewupdater_test.py
@@ -3,8 +3,8 @@ import unittest
 import mock
 
 from certbot import interfaces
-from certbot import main
-from certbot import updater
+from certbot._internal import main
+from certbot._internal import updater
 
 from certbot.plugins import enhancements
 
@@ -21,7 +21,7 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
         self.renew_deployer = mock.MagicMock(spec=interfaces.RenewDeployer)
         self.mockinstaller = mock.MagicMock(spec=enhancements.AutoHSTSEnhancement)
 
-    @mock.patch('certbot.main._get_and_save_cert')
+    @mock.patch('certbot._internal.main._get_and_save_cert')
     @mock.patch('certbot.plugins.selection.choose_configurator_plugins')
     @mock.patch('certbot.plugins.selection.get_unprepared_installer')
     @test_util.patch_get_utility()
@@ -32,7 +32,7 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
         # Generic Updater
         mock_select.return_value = (mock_generic_updater, None)
         mock_geti.return_value = mock_generic_updater
-        with mock.patch('certbot.main._init_le_client'):
+        with mock.patch('certbot._internal.main._init_le_client'):
             main.renew_cert(self.config, None, mock.MagicMock())
         self.assertTrue(mock_generic_updater.restart.called)
 
@@ -48,7 +48,7 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
         updater.run_renewal_deployer(self.config, lineage, mock_deployer)
         self.assertTrue(mock_deployer.renew_deploy.called_with(lineage))
 
-    @mock.patch("certbot.updater.logger.debug")
+    @mock.patch("certbot._internal.updater.logger.debug")
     def test_updater_skip_dry_run(self, mock_log):
         self.config.dry_run = True
         updater.run_generic_updaters(self.config, None, None)
@@ -56,7 +56,7 @@ class RenewUpdaterTest(test_util.ConfigTestCase):
         self.assertEqual(mock_log.call_args[0][0],
                           "Skipping updaters in dry-run mode.")
 
-    @mock.patch("certbot.updater.logger.debug")
+    @mock.patch("certbot._internal.updater.logger.debug")
     def test_deployer_skip_dry_run(self, mock_log):
         self.config.dry_run = True
         updater.run_renewal_deployer(self.config, None, None)
diff --git a/certbot/tests/reporter_test.py b/certbot/tests/reporter_test.py
index b43522364..a30aaeb8c 100644
--- a/certbot/tests/reporter_test.py
+++ b/certbot/tests/reporter_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.reporter."""
+"""Tests for certbot._internal.reporter."""
 import sys
 import unittest
 import mock
@@ -7,9 +7,9 @@ import six
 
 
 class ReporterTest(unittest.TestCase):
-    """Tests for certbot.reporter.Reporter."""
+    """Tests for certbot._internal.reporter.Reporter."""
     def setUp(self):
-        from certbot import reporter
+        from certbot._internal import reporter
         self.reporter = reporter.Reporter(mock.MagicMock(quiet=False))
 
         self.old_stdout = sys.stdout  # type: ignore
diff --git a/certbot/tests/storage_test.py b/certbot/tests/storage_test.py
index 2bc45873c..183d9a020 100644
--- a/certbot/tests/storage_test.py
+++ b/certbot/tests/storage_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot.storage."""
+"""Tests for certbot._internal.storage."""
 # pylint disable=protected-access
 import datetime
 import shutil
@@ -15,7 +15,7 @@ import certbot.tests.util as test_util
 from certbot import errors
 from certbot.compat import os
 from certbot.compat import filesystem
-from certbot.storage import ALL_FOUR
+from certbot._internal.storage import ALL_FOUR
 
 CERT = test_util.load_cert('cert_512.pem')
 
@@ -34,13 +34,13 @@ def fill_with_sample_data(rc_object):
 
 
 class RelevantValuesTest(unittest.TestCase):
-    """Tests for certbot.storage.relevant_values."""
+    """Tests for certbot._internal.storage.relevant_values."""
 
     def setUp(self):
         self.values = {"server": "example.org"}
 
     def _call(self, *args, **kwargs):
-        from certbot.storage import relevant_values
+        from certbot._internal.storage import relevant_values
         return relevant_values(*args, **kwargs)
 
     @mock.patch("certbot.cli.option_was_set")
@@ -84,7 +84,7 @@ class BaseRenewableCertTest(test_util.ConfigTestCase):
     """
 
     def setUp(self):
-        from certbot import storage
+        from certbot._internal import storage
 
         super(BaseRenewableCertTest, self).setUp()
 
@@ -117,7 +117,7 @@ class BaseRenewableCertTest(test_util.ConfigTestCase):
 
         self.defaults = configobj.ConfigObj()
 
-        with mock.patch("certbot.storage.RenewableCert._check_symlinks") as check:
+        with mock.patch("certbot._internal.storage.RenewableCert._check_symlinks") as check:
             check.return_value = True
             self.test_rc = storage.RenewableCert(config_file.filename, self.config)
 
@@ -141,7 +141,7 @@ class BaseRenewableCertTest(test_util.ConfigTestCase):
 
 class RenewableCertTests(BaseRenewableCertTest):
     # pylint: disable=too-many-public-methods
-    """Tests for certbot.storage."""
+    """Tests for certbot._internal.storage."""
 
     def test_initialization(self):
         self.assertEqual(self.test_rc.lineagename, "example.org")
@@ -155,7 +155,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         the renewal configuration file doesn't end in ".conf"
 
         """
-        from certbot import storage
+        from certbot._internal import storage
         broken = os.path.join(self.config.config_dir, "broken.conf")
         with open(broken, "w") as f:
             f.write("[No closing bracket for you!")
@@ -168,7 +168,7 @@ class RenewableCertTests(BaseRenewableCertTest):
     def test_renewal_incomplete_config(self):
         """Test that the RenewableCert constructor will complain if
         the renewal configuration file is missing a required file element."""
-        from certbot import storage
+        from certbot._internal import storage
         config = configobj.ConfigObj()
         config["cert"] = "imaginary_cert.pem"
         # Here the required privkey is missing.
@@ -180,23 +180,23 @@ class RenewableCertTests(BaseRenewableCertTest):
                           config.filename, self.config)
 
     def test_no_renewal_version(self):
-        from certbot import storage
+        from certbot._internal import storage
 
         self._write_out_ex_kinds()
         self.assertTrue("version" not in self.config_file)
 
-        with mock.patch("certbot.storage.logger") as mock_logger:
+        with mock.patch("certbot._internal.storage.logger") as mock_logger:
             storage.RenewableCert(self.config_file.filename, self.config)
         self.assertFalse(mock_logger.warning.called)
 
     def test_renewal_newer_version(self):
-        from certbot import storage
+        from certbot._internal import storage
 
         self._write_out_ex_kinds()
         self.config_file["version"] = "99.99.99"
         self.config_file.write()
 
-        with mock.patch("certbot.storage.logger") as mock_logger:
+        with mock.patch("certbot._internal.storage.logger") as mock_logger:
             storage.RenewableCert(self.config_file.filename, self.config)
         self.assertTrue(mock_logger.info.called)
         self.assertTrue("version" in mock_logger.info.call_args[0][0])
@@ -295,7 +295,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertEqual(self.test_rc.latest_common_version(), 17)
         self.assertEqual(self.test_rc.next_free_version(), 18)
 
-    @mock.patch("certbot.storage.logger")
+    @mock.patch("certbot._internal.storage.logger")
     def test_ensure_deployed(self, mock_logger):
         mock_update = self.test_rc.update_all_links_to = mock.Mock()
         mock_has_pending = self.test_rc.has_pending_deployment = mock.Mock()
@@ -361,7 +361,7 @@ class RenewableCertTests(BaseRenewableCertTest):
                 real_unlink(path)
 
         self._write_out_ex_kinds()
-        with mock.patch("certbot.storage.os.unlink") as mock_unlink:
+        with mock.patch("certbot._internal.storage.os.unlink") as mock_unlink:
             mock_unlink.side_effect = unlink_or_raise
             self.assertRaises(ValueError, self.test_rc.update_all_links_to, 12)
 
@@ -377,7 +377,7 @@ class RenewableCertTests(BaseRenewableCertTest):
                 real_unlink(path)
 
         self._write_out_ex_kinds()
-        with mock.patch("certbot.storage.os.unlink") as mock_unlink:
+        with mock.patch("certbot._internal.storage.os.unlink") as mock_unlink:
             mock_unlink.side_effect = unlink_or_raise
             self.assertRaises(ValueError, self.test_rc.update_all_links_to, 12)
 
@@ -423,8 +423,8 @@ class RenewableCertTests(BaseRenewableCertTest):
         os.unlink(self.test_rc.cert)
         self.assertRaises(errors.CertStorageError, self.test_rc.names)
 
-    @mock.patch("certbot.storage.cli")
-    @mock.patch("certbot.storage.datetime")
+    @mock.patch("certbot._internal.storage.cli")
+    @mock.patch("certbot._internal.storage.datetime")
     def test_time_interval_judgments(self, mock_datetime, mock_cli):
         """Test should_autorenew() on the basis of expiry time windows."""
         test_cert = test_util.load_vector("cert_512.pem")
@@ -478,8 +478,8 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.test_rc.configuration["renewalparams"]["autorenew"] = "False"
         self.assertFalse(self.test_rc.autorenewal_is_enabled())
 
-    @mock.patch("certbot.storage.cli")
-    @mock.patch("certbot.storage.RenewableCert.ocsp_revoked")
+    @mock.patch("certbot._internal.storage.cli")
+    @mock.patch("certbot._internal.storage.RenewableCert.ocsp_revoked")
     def test_should_autorenew(self, mock_ocsp, mock_cli):
         """Test should_autorenew on the basis of reasons other than
         expiry time window."""
@@ -496,7 +496,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertTrue(self.test_rc.should_autorenew())
         mock_ocsp.return_value = False
 
-    @mock.patch("certbot.storage.relevant_values")
+    @mock.patch("certbot._internal.storage.relevant_values")
     def test_save_successor(self, mock_rv):
         # Mock relevant_values() to claim that all values are relevant here
         # (to avoid instantiating parser)
@@ -560,7 +560,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertFalse(os.path.exists(temp_config_file))
 
     @test_util.skip_on_windows('Group/everybody permissions are not maintained on Windows.')
-    @mock.patch("certbot.storage.relevant_values")
+    @mock.patch("certbot._internal.storage.relevant_values")
     def test_save_successor_maintains_group_mode(self, mock_rv):
         # Mock relevant_values() to claim that all values are relevant here
         # (to avoid instantiating parser)
@@ -581,8 +581,8 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.test_rc.save_successor(3, b"newcert", b"new_privkey", b"new chain", self.config)
         self.assertTrue(filesystem.check_mode(self.test_rc.version("privkey", 4), 0o600))
 
-    @mock.patch("certbot.storage.relevant_values")
-    @mock.patch("certbot.storage.filesystem.copy_ownership_and_apply_mode")
+    @mock.patch("certbot._internal.storage.relevant_values")
+    @mock.patch("certbot._internal.storage.filesystem.copy_ownership_and_apply_mode")
     def test_save_successor_maintains_gid(self, mock_ownership, mock_rv):
         # Mock relevant_values() to claim that all values are relevant here
         # (to avoid instantiating parser)
@@ -595,14 +595,14 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.test_rc.save_successor(2, b"newcert", b"new_privkey", b"new chain", self.config)
         self.assertTrue(mock_ownership.called)
 
-    @mock.patch("certbot.storage.relevant_values")
+    @mock.patch("certbot._internal.storage.relevant_values")
     def test_new_lineage(self, mock_rv):
         """Test for new_lineage() class method."""
         # Mock relevant_values to say everything is relevant here (so we
         # don't have to mock the parser to help it decide!)
         mock_rv.side_effect = lambda x: x
 
-        from certbot import storage
+        from certbot._internal import storage
         result = storage.RenewableCert.new_lineage(
             "the-lineage.com", b"cert", b"privkey", b"chain", self.config)
         # This consistency check tests most relevant properties about the
@@ -642,14 +642,14 @@ class RenewableCertTests(BaseRenewableCertTest):
         # TODO: Conceivably we could test that the renewal parameters actually
         #       got saved
 
-    @mock.patch("certbot.storage.relevant_values")
+    @mock.patch("certbot._internal.storage.relevant_values")
     def test_new_lineage_nonexistent_dirs(self, mock_rv):
         """Test that directories can be created if they don't exist."""
         # Mock relevant_values to say everything is relevant here (so we
         # don't have to mock the parser to help it decide!)
         mock_rv.side_effect = lambda x: x
 
-        from certbot import storage
+        from certbot._internal import storage
         shutil.rmtree(self.config.renewal_configs_dir)
         shutil.rmtree(self.config.default_archive_dir)
         shutil.rmtree(self.config.live_dir)
@@ -664,9 +664,9 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertTrue(os.path.exists(os.path.join(
             self.config.default_archive_dir, "the-lineage.com", "privkey1.pem")))
 
-    @mock.patch("certbot.storage.util.unique_lineage_name")
+    @mock.patch("certbot._internal.storage.util.unique_lineage_name")
     def test_invalid_config_filename(self, mock_uln):
-        from certbot import storage
+        from certbot._internal import storage
         mock_uln.return_value = "this_does_not_end_with_dot_conf", "yikes"
         self.assertRaises(errors.CertStorageError,
                           storage.RenewableCert.new_lineage, "example.com",
@@ -696,7 +696,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertFalse(self.test_rc.ocsp_revoked())
 
     def test_add_time_interval(self):
-        from certbot import storage
+        from certbot._internal import storage
 
         # this month has 30 days, and the next year is a leap year
         time_1 = pytz.UTC.fromutc(datetime.datetime(2003, 11, 20, 11, 59, 21))
@@ -751,7 +751,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertEqual(self.test_rc.is_test_cert, False)
 
     def test_missing_cert(self):
-        from certbot import storage
+        from certbot._internal import storage
         self.assertRaises(errors.CertStorageError,
                           storage.RenewableCert,
                           self.config_file.filename, self.config)
@@ -776,7 +776,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         archive_dir = "the_archive"
         relevant_data = {"useful": "new_value"}
 
-        from certbot import storage
+        from certbot._internal import storage
         storage.write_renewal_config(temp, temp2, archive_dir, target, relevant_data)
 
         with open(temp2, "r") as f:
@@ -794,7 +794,7 @@ class RenewableCertTests(BaseRenewableCertTest):
                          stat.S_IMODE(os.lstat(temp2).st_mode))
 
     def test_update_symlinks(self):
-        from certbot import storage
+        from certbot._internal import storage
         archive_dir_path = os.path.join(self.config.config_dir, "archive", "example.org")
         for kind in ALL_FOUR:
             live_path = self.config_file[kind]
@@ -809,7 +809,7 @@ class RenewableCertTests(BaseRenewableCertTest):
             update_symlinks=True)
 
 class DeleteFilesTest(BaseRenewableCertTest):
-    """Tests for certbot.storage.delete_files"""
+    """Tests for certbot._internal.storage.delete_files"""
     def setUp(self):
         super(DeleteFilesTest, self).setUp()
 
@@ -827,8 +827,8 @@ class DeleteFilesTest(BaseRenewableCertTest):
             self.config.config_dir, "archive", "example.org")))
 
     def _call(self):
-        from certbot import storage
-        with mock.patch("certbot.storage.logger"):
+        from certbot._internal import storage
+        with mock.patch("certbot._internal.storage.logger"):
             storage.delete_files(self.config, "example.org")
 
     def test_delete_all_files(self):
@@ -899,7 +899,7 @@ class DeleteFilesTest(BaseRenewableCertTest):
         self.assertFalse(os.path.exists(archive_dir))
 
 class CertPathForCertNameTest(BaseRenewableCertTest):
-    """Test for certbot.storage.cert_path_for_cert_name"""
+    """Test for certbot._internal.storage.cert_path_for_cert_name"""
     def setUp(self):
         super(CertPathForCertNameTest, self).setUp()
         self.config_file.write()
@@ -909,7 +909,7 @@ class CertPathForCertNameTest(BaseRenewableCertTest):
         self.config.cert_path = (self.fullchain, '')
 
     def _call(self, cli_config, certname):
-        from certbot.storage import cert_path_for_cert_name
+        from certbot._internal.storage import cert_path_for_cert_name
         return cert_path_for_cert_name(cli_config, certname)
 
     def test_simple_cert_name(self):
diff --git a/certbot/tests/util.py b/certbot/tests/util.py
index dfd752511..38779f564 100644
--- a/certbot/tests/util.py
+++ b/certbot/tests/util.py
@@ -22,8 +22,8 @@ from cryptography.hazmat.primitives import serialization
 from certbot import configuration
 from certbot import constants
 from certbot import interfaces
-from certbot import lock
-from certbot import storage
+from certbot._internal import lock
+from certbot._internal import storage
 from certbot import util
 from certbot.compat import os
 from certbot.compat import filesystem
diff --git a/certbot/util.py b/certbot/util.py
index f435753ef..fdcc57d27 100644
--- a/certbot/util.py
+++ b/certbot/util.py
@@ -21,7 +21,7 @@ from acme.magic_typing import Tuple, Union  # pylint: disable=unused-import, no-
 
 from certbot import constants
 from certbot import errors
-from certbot import lock
+from certbot._internal import lock
 from certbot.compat import os
 from certbot.compat import filesystem
 
diff --git a/docs/api/account.rst b/docs/api/account.rst
deleted file mode 100644
index fd90230ea..000000000
--- a/docs/api/account.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.account`
---------------------------
-
-.. automodule:: certbot.account
-   :members:
diff --git a/docs/api/auth_handler.rst b/docs/api/auth_handler.rst
deleted file mode 100644
index 8819bb1bd..000000000
--- a/docs/api/auth_handler.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.auth_handler`
--------------------------------
-
-.. automodule:: certbot.auth_handler
-   :members:
diff --git a/docs/api/cert_manager.rst b/docs/api/cert_manager.rst
deleted file mode 100644
index c8c86f8b9..000000000
--- a/docs/api/cert_manager.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.cert_manager`
--------------------------------
-
-.. automodule:: certbot.cert_manager
-   :members:
diff --git a/docs/api/client.rst b/docs/api/client.rst
deleted file mode 100644
index 00a443cd9..000000000
--- a/docs/api/client.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.client`
--------------------------
-
-.. automodule:: certbot.client
-   :members:
diff --git a/docs/api/error_handler.rst b/docs/api/error_handler.rst
deleted file mode 100644
index f1306177d..000000000
--- a/docs/api/error_handler.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.error_handler`
---------------------------------
-
-.. automodule:: certbot.error_handler
-   :members:
diff --git a/docs/api/lock.rst b/docs/api/lock.rst
deleted file mode 100644
index 6dcbf9589..000000000
--- a/docs/api/lock.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.lock`
------------------------
-
-.. automodule:: certbot.lock
-   :members:
diff --git a/docs/api/main.rst b/docs/api/main.rst
deleted file mode 100644
index a555bab01..000000000
--- a/docs/api/main.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.main`
------------------------
-
-.. automodule:: certbot.main
-   :members:
diff --git a/docs/api/notify.rst b/docs/api/notify.rst
deleted file mode 100644
index fa042b2d2..000000000
--- a/docs/api/notify.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.notify`
--------------------------
-
-.. automodule:: certbot.notify
-   :members:
diff --git a/docs/api/ocsp.rst b/docs/api/ocsp.rst
deleted file mode 100644
index 7044f4052..000000000
--- a/docs/api/ocsp.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.ocsp`
------------------------
-
-.. automodule:: certbot.ocsp
-   :members:
diff --git a/docs/api/renewal.rst b/docs/api/renewal.rst
deleted file mode 100644
index 58557351f..000000000
--- a/docs/api/renewal.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.renewal`
---------------------------
-
-.. automodule:: certbot.renewal
-   :members:
diff --git a/docs/api/reporter.rst b/docs/api/reporter.rst
deleted file mode 100644
index ad71dbb69..000000000
--- a/docs/api/reporter.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.reporter`
----------------------------
-
-.. automodule:: certbot.reporter
-   :members:
diff --git a/docs/api/storage.rst b/docs/api/storage.rst
deleted file mode 100644
index 34e3a45c0..000000000
--- a/docs/api/storage.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-:mod:`certbot.storage`
---------------------------
-
-.. automodule:: certbot.storage
-   :members:
diff --git a/setup.py b/setup.py
index 8b45fd80c..3ae2fe282 100644
--- a/setup.py
+++ b/setup.py
@@ -165,7 +165,7 @@ setup(
 
     entry_points={
         'console_scripts': [
-            'certbot = certbot.main:main',
+            'certbot = certbot._internal.main:main',
         ],
         'certbot.plugins': [
             'manual = certbot.plugins.manual:Authenticator',
diff --git a/tests/lock_test.py b/tests/lock_test.py
index b65442c30..c3eebe3d2 100644
--- a/tests/lock_test.py
+++ b/tests/lock_test.py
@@ -19,7 +19,7 @@ from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization, hashes  # type: ignore
 from cryptography.hazmat.primitives.asymmetric import rsa
 
-from certbot import lock
+from certbot._internal import lock
 from certbot import util
 from certbot.compat import filesystem
 
diff --git a/windows-installer/construct.py b/windows-installer/construct.py
index cdf309f13..089296439 100644
--- a/windows-installer/construct.py
+++ b/windows-installer/construct.py
@@ -147,7 +147,7 @@ files=run.bat
       renew-down.ps1
 
 [Command certbot]
-entry_point=certbot.main:main
+entry_point=certbot._internal.main:main
 extra_preamble=pywin32_paths.py
 '''.format(certbot_version=certbot_version,
            installer_suffix='win_amd64' if PYTHON_BITNESS == 64 else 'win32',