diff --git a/certbot-ci/certbot_integration_tests/.coveragerc b/certbot-ci/certbot_integration_tests/.coveragerc
index c83880b64..72f7c6adf 100644
--- a/certbot-ci/certbot_integration_tests/.coveragerc
+++ b/certbot-ci/certbot_integration_tests/.coveragerc
@@ -2,8 +2,8 @@
 # Avoid false warnings because certbot packages are not installed in the thread that executes
 # the coverage: indeed, certbot is launched as a CLI from a subprocess.
 disable_warnings = module-not-imported,no-data-collected
-omit = **/*_test.py,**/tests/*,**/dns_common*,**/certbot_nginx/parser_obj.py
+omit = **/*_test.py,**/tests/*,**/dns_common*,**/certbot_nginx/_internal/parser_obj.py
 
 [report]
 # Exclude unit tests in coverage during integration tests.
-omit = **/*_test.py,**/tests/*,**/dns_common*,**/certbot_nginx/parser_obj.py
+omit = **/*_test.py,**/tests/*,**/dns_common*,**/certbot_nginx/_internal/parser_obj.py
diff --git a/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py b/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py
index 3dcf834c0..5185b8a5d 100644
--- a/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py
+++ b/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py
@@ -8,8 +8,8 @@ import zope.interface
 from acme.magic_typing import Set  # pylint: disable=unused-import, no-name-in-module
 
 from certbot._internal import configuration
-from certbot_nginx import configurator
-from certbot_nginx import constants
+from certbot_nginx._internal import configurator
+from certbot_nginx._internal import constants
 from certbot_compatibility_test import errors
 from certbot_compatibility_test import interfaces
 from certbot_compatibility_test import util
diff --git a/certbot-compatibility-test/nginx/roundtrip.py b/certbot-compatibility-test/nginx/roundtrip.py
index 85d283c78..e2d518e00 100644
--- a/certbot-compatibility-test/nginx/roundtrip.py
+++ b/certbot-compatibility-test/nginx/roundtrip.py
@@ -3,7 +3,7 @@
 import os
 import sys
 
-from certbot_nginx import nginxparser
+from certbot_nginx._internal import nginxparser
 
 def roundtrip(stuff):
     success = True
diff --git a/certbot-nginx/MANIFEST.in b/certbot-nginx/MANIFEST.in
index fff59467b..39e956ced 100644
--- a/certbot-nginx/MANIFEST.in
+++ b/certbot-nginx/MANIFEST.in
@@ -1,4 +1,4 @@
 include LICENSE.txt
 include README.rst
 recursive-include certbot_nginx/tests/testdata *
-recursive-include certbot_nginx/tls_configs *.conf
+recursive-include certbot_nginx/_internal/tls_configs *.conf
diff --git a/certbot-nginx/certbot_nginx/_internal/__init__.py b/certbot-nginx/certbot_nginx/_internal/__init__.py
new file mode 100644
index 000000000..71d79b0c2
--- /dev/null
+++ b/certbot-nginx/certbot_nginx/_internal/__init__.py
@@ -0,0 +1 @@
+"""Certbot nginx plugin internal implementation."""
diff --git a/certbot-nginx/certbot_nginx/configurator.py b/certbot-nginx/certbot_nginx/_internal/configurator.py
similarity index 98%
rename from certbot-nginx/certbot_nginx/configurator.py
rename to certbot-nginx/certbot_nginx/_internal/configurator.py
index 6ec53430c..e212ba40d 100644
--- a/certbot-nginx/certbot_nginx/configurator.py
+++ b/certbot-nginx/certbot_nginx/_internal/configurator.py
@@ -24,12 +24,12 @@ from certbot import util
 from certbot.compat import os
 from certbot.plugins import common
 
-from certbot_nginx import constants
-from certbot_nginx import display_ops
-from certbot_nginx import http_01
-from certbot_nginx import nginxparser
-from certbot_nginx import obj  # pylint: disable=unused-import
-from certbot_nginx import parser
+from certbot_nginx._internal import constants
+from certbot_nginx._internal import display_ops
+from certbot_nginx._internal import http_01
+from certbot_nginx._internal import nginxparser
+from certbot_nginx._internal import obj  # pylint: disable=unused-import
+from certbot_nginx._internal import parser
 
 NAME_RANK = 0
 START_WILDCARD_RANK = 1
@@ -53,7 +53,7 @@ class NginxConfigurator(common.Installer):
     :type config: :class:`~certbot.interfaces.IConfig`
 
     :ivar parser: Handles low level parsing
-    :type parser: :class:`~certbot_nginx.parser`
+    :type parser: :class:`~certbot_nginx._internal.parser`
 
     :ivar str save_notes: Human-readable config change notes
 
@@ -154,7 +154,7 @@ class NginxConfigurator(common.Installer):
                 config_filename = "options-ssl-nginx-old.conf"
 
         return pkg_resources.resource_filename(
-            "certbot_nginx", os.path.join("tls_configs", config_filename))
+            "certbot_nginx", os.path.join("_internal", "tls_configs", config_filename))
 
     @property
     def mod_ssl_conf(self):
@@ -323,7 +323,7 @@ class NginxConfigurator(common.Installer):
             MisconfigurationError.
 
         :returns: ssl vhosts associated with name
-        :rtype: list of :class:`~certbot_nginx.obj.VirtualHost`
+        :rtype: list of :class:`~certbot_nginx._internal.obj.VirtualHost`
 
         """
         if util.is_wildcard_domain(target_name):
@@ -442,7 +442,7 @@ class NginxConfigurator(common.Installer):
         :param list matches: list of dicts containing the vhost, the matching name,
             and the numerical rank
         :returns: the most matching vhost
-        :rtype: :class:`~certbot_nginx.obj.VirtualHost`
+        :rtype: :class:`~certbot_nginx._internal.obj.VirtualHost`
 
         """
         if not matches:
@@ -529,7 +529,7 @@ class NginxConfigurator(common.Installer):
             MisconfigurationError.
 
         :returns: vhosts associated with name
-        :rtype: list of :class:`~certbot_nginx.obj.VirtualHost`
+        :rtype: list of :class:`~certbot_nginx._internal.obj.VirtualHost`
 
         """
         if util.is_wildcard_domain(target_name):
@@ -643,7 +643,7 @@ class NginxConfigurator(common.Installer):
         Make a server SSL by adding new listen and SSL directives.
 
         :param vhost: The vhost to add SSL to.
-        :type vhost: :class:`~certbot_nginx.obj.VirtualHost`
+        :type vhost: :class:`~certbot_nginx._internal.obj.VirtualHost`
 
         """
         https_port = self.config.https_port
@@ -771,9 +771,9 @@ class NginxConfigurator(common.Installer):
         :param vhost: The server block to break up into two.
         :param list only_directives: If this exists, only duplicate these directives
             when splitting the block.
-        :type vhost: :class:`~certbot_nginx.obj.VirtualHost`
+        :type vhost: :class:`~certbot_nginx._internal.obj.VirtualHost`
         :returns: tuple (http_vhost, https_vhost)
-        :rtype: tuple of type :class:`~certbot_nginx.obj.VirtualHost`
+        :rtype: tuple of type :class:`~certbot_nginx._internal.obj.VirtualHost`
         """
         http_vhost = self.parser.duplicate_vhost(vhost, only_directives=only_directives)
 
diff --git a/certbot-nginx/certbot_nginx/constants.py b/certbot-nginx/certbot_nginx/_internal/constants.py
similarity index 100%
rename from certbot-nginx/certbot_nginx/constants.py
rename to certbot-nginx/certbot_nginx/_internal/constants.py
diff --git a/certbot-nginx/certbot_nginx/display_ops.py b/certbot-nginx/certbot_nginx/_internal/display_ops.py
similarity index 100%
rename from certbot-nginx/certbot_nginx/display_ops.py
rename to certbot-nginx/certbot_nginx/_internal/display_ops.py
diff --git a/certbot-nginx/certbot_nginx/http_01.py b/certbot-nginx/certbot_nginx/_internal/http_01.py
similarity index 97%
rename from certbot-nginx/certbot_nginx/http_01.py
rename to certbot-nginx/certbot_nginx/_internal/http_01.py
index 4dcc5324f..7223548d9 100644
--- a/certbot-nginx/certbot_nginx/http_01.py
+++ b/certbot-nginx/certbot_nginx/_internal/http_01.py
@@ -9,8 +9,8 @@ from certbot import errors
 from certbot.compat import os
 from certbot.plugins import common
 
-from certbot_nginx import obj
-from certbot_nginx import nginxparser
+from certbot_nginx._internal import obj
+from certbot_nginx._internal import nginxparser
 
 
 logger = logging.getLogger(__name__)
@@ -110,7 +110,7 @@ class NginxHttp01(common.ChallengePerformer):
 
     def _default_listen_addresses(self):
         """Finds addresses for a challenge block to listen on.
-        :returns: list of :class:`certbot_nginx.obj.Addr` to apply
+        :returns: list of :class:`certbot_nginx._internal.obj.Addr` to apply
         :rtype: list
         """
         addresses = [] # type: List[obj.Addr]
diff --git a/certbot-nginx/certbot_nginx/nginxparser.py b/certbot-nginx/certbot_nginx/_internal/nginxparser.py
similarity index 100%
rename from certbot-nginx/certbot_nginx/nginxparser.py
rename to certbot-nginx/certbot_nginx/_internal/nginxparser.py
diff --git a/certbot-nginx/certbot_nginx/obj.py b/certbot-nginx/certbot_nginx/_internal/obj.py
similarity index 100%
rename from certbot-nginx/certbot_nginx/obj.py
rename to certbot-nginx/certbot_nginx/_internal/obj.py
diff --git a/certbot-nginx/certbot_nginx/parser.py b/certbot-nginx/certbot_nginx/_internal/parser.py
similarity index 97%
rename from certbot-nginx/certbot_nginx/parser.py
rename to certbot-nginx/certbot_nginx/_internal/parser.py
index d50606fc5..a0d375437 100644
--- a/certbot-nginx/certbot_nginx/parser.py
+++ b/certbot-nginx/certbot_nginx/_internal/parser.py
@@ -11,8 +11,8 @@ import six
 from certbot import errors
 from certbot.compat import os
 
-from certbot_nginx import obj
-from certbot_nginx import nginxparser
+from certbot_nginx._internal import obj
+from certbot_nginx._internal import nginxparser
 from acme.magic_typing import Union, Dict, Set, Any, List, Tuple # pylint: disable=unused-import, no-name-in-module
 
 logger = logging.getLogger(__name__)
@@ -129,7 +129,7 @@ class NginxParser(object):
         Technically this is a misnomer because Nginx does not have virtual
         hosts, it has 'server blocks'.
 
-        :returns: List of :class:`~certbot_nginx.obj.VirtualHost`
+        :returns: List of :class:`~certbot_nginx._internal.obj.VirtualHost`
             objects found in configuration
         :rtype: list
 
@@ -262,7 +262,7 @@ class NginxParser(object):
     def has_ssl_on_directive(self, vhost):
         """Does vhost have ssl on for all ports?
 
-        :param :class:`~certbot_nginx.obj.VirtualHost` vhost: The vhost in question
+        :param :class:`~certbot_nginx._internal.obj.VirtualHost` vhost: The vhost in question
 
         :returns: True if 'ssl on' directive is included
         :rtype: bool
@@ -288,7 +288,7 @@ class NginxParser(object):
         ..todo :: Doesn't match server blocks whose server_name directives are
             split across multiple conf files.
 
-        :param :class:`~certbot_nginx.obj.VirtualHost` vhost: The vhost
+        :param :class:`~certbot_nginx._internal.obj.VirtualHost` vhost: The vhost
             whose information we use to match on
         :param list directives: The directives to add
         :param bool insert_at_top: True if the directives need to be inserted at the top
@@ -310,7 +310,7 @@ class NginxParser(object):
         ..todo :: Doesn't match server blocks whose server_name directives are
             split across multiple conf files.
 
-        :param :class:`~certbot_nginx.obj.VirtualHost` vhost: The vhost
+        :param :class:`~certbot_nginx._internal.obj.VirtualHost` vhost: The vhost
             whose information we use to match on
         :param list directives: The directives to add
         :param bool insert_at_top: True if the directives need to be inserted at the top
@@ -323,7 +323,7 @@ class NginxParser(object):
     def remove_server_directives(self, vhost, directive_name, match_func=None):
         """Remove all directives of type directive_name.
 
-        :param :class:`~certbot_nginx.obj.VirtualHost` vhost: The vhost
+        :param :class:`~certbot_nginx._internal.obj.VirtualHost` vhost: The vhost
             to remove directives from
         :param string directive_name: The directive type to remove
         :param callable match_func: Function of the directive that returns true for directives
@@ -359,7 +359,7 @@ class NginxParser(object):
         only_directives=None):
         """Duplicate the vhost in the configuration files.
 
-        :param :class:`~certbot_nginx.obj.VirtualHost` vhost_template: The vhost
+        :param :class:`~certbot_nginx._internal.obj.VirtualHost` vhost_template: The vhost
             whose information we copy
         :param bool remove_singleton_listen_params: If we should remove parameters
             from listen directives in the block that can only be used once per address
@@ -367,7 +367,7 @@ class NginxParser(object):
             looks at first level of depth; does not expand includes.
 
         :returns: A vhost object for the newly created vhost
-        :rtype: :class:`~certbot_nginx.obj.VirtualHost`
+        :rtype: :class:`~certbot_nginx._internal.obj.VirtualHost`
         """
         # TODO: https://github.com/certbot/certbot/issues/5185
         # put it in the same file as the template, at the same level
diff --git a/certbot-nginx/certbot_nginx/parser_obj.py b/certbot-nginx/certbot_nginx/_internal/parser_obj.py
similarity index 100%
rename from certbot-nginx/certbot_nginx/parser_obj.py
rename to certbot-nginx/certbot_nginx/_internal/parser_obj.py
diff --git a/certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx-old.conf b/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx-old.conf
similarity index 100%
rename from certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx-old.conf
rename to certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx-old.conf
diff --git a/certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx-tls12-only.conf b/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx-tls12-only.conf
similarity index 100%
rename from certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx-tls12-only.conf
rename to certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx-tls12-only.conf
diff --git a/certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx-tls13-session-tix-on.conf b/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx-tls13-session-tix-on.conf
similarity index 100%
rename from certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx-tls13-session-tix-on.conf
rename to certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx-tls13-session-tix-on.conf
diff --git a/certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx.conf b/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf
similarity index 100%
rename from certbot-nginx/certbot_nginx/tls_configs/options-ssl-nginx.conf
rename to certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf
diff --git a/certbot-nginx/certbot_nginx/tests/configurator_test.py b/certbot-nginx/certbot_nginx/tests/configurator_test.py
index 6b3438d89..a7327166f 100644
--- a/certbot-nginx/certbot_nginx/tests/configurator_test.py
+++ b/certbot-nginx/certbot_nginx/tests/configurator_test.py
@@ -1,4 +1,4 @@
-"""Test for certbot_nginx.configurator."""
+"""Test for certbot_nginx._internal.configurator."""
 import unittest
 
 import OpenSSL
@@ -12,10 +12,10 @@ from certbot import errors
 from certbot.compat import os
 from certbot.tests import util as certbot_test_util
 
-from certbot_nginx import obj
-from certbot_nginx import parser
-from certbot_nginx.configurator import _redirect_block_for_domain
-from certbot_nginx.nginxparser import UnspacedList
+from certbot_nginx._internal import obj
+from certbot_nginx._internal import parser
+from certbot_nginx._internal.configurator import _redirect_block_for_domain
+from certbot_nginx._internal.nginxparser import UnspacedList
 from certbot_nginx.tests import util
 
 
@@ -29,7 +29,7 @@ class NginxConfiguratorTest(util.NginxTest):
         self.config = self.get_nginx_configurator(
             self.config_path, self.config_dir, self.work_dir, self.logs_dir)
 
-    @mock.patch("certbot_nginx.configurator.util.exe_exists")
+    @mock.patch("certbot_nginx._internal.configurator.util.exe_exists")
     def test_prepare_no_install(self, mock_exe_exists):
         mock_exe_exists.return_value = False
         self.assertRaises(
@@ -39,8 +39,8 @@ class NginxConfiguratorTest(util.NginxTest):
         self.assertEqual((1, 6, 2), self.config.version)
         self.assertEqual(11, len(self.config.parser.parsed))
 
-    @mock.patch("certbot_nginx.configurator.util.exe_exists")
-    @mock.patch("certbot_nginx.configurator.subprocess.Popen")
+    @mock.patch("certbot_nginx._internal.configurator.util.exe_exists")
+    @mock.patch("certbot_nginx._internal.configurator.subprocess.Popen")
     def test_prepare_initializes_version(self, mock_popen, mock_exe_exists):
         mock_popen().communicate.return_value = (
             "", "\n".join(["nginx version: nginx/1.6.2",
@@ -66,7 +66,7 @@ class NginxConfiguratorTest(util.NginxTest):
         self.config.config_test = mock.Mock()
         certbot_test_util.lock_and_call(self._test_prepare_locked, server_root)
 
-    @mock.patch("certbot_nginx.configurator.util.exe_exists")
+    @mock.patch("certbot_nginx._internal.configurator.util.exe_exists")
     def _test_prepare_locked(self, unused_exe_exists):
         try:
             self.config.prepare()
@@ -77,7 +77,7 @@ class NginxConfiguratorTest(util.NginxTest):
         else:  # pragma: no cover
             self.fail("Exception wasn't raised!")
 
-    @mock.patch("certbot_nginx.configurator.socket.gethostbyaddr")
+    @mock.patch("certbot_nginx._internal.configurator.socket.gethostbyaddr")
     def test_get_all_names(self, mock_gethostbyaddr):
         mock_gethostbyaddr.return_value = ('155.225.50.69.nephoscale.net', [], [])
         names = self.config.get_all_names()
@@ -217,7 +217,7 @@ class NginxConfiguratorTest(util.NginxTest):
             "example/chain.pem",
             None)
 
-    @mock.patch('certbot_nginx.parser.NginxParser.update_or_add_server_directives')
+    @mock.patch('certbot_nginx._internal.parser.NginxParser.update_or_add_server_directives')
     def test_deploy_cert_raise_on_add_error(self, mock_update_or_add_server_directives):
         mock_update_or_add_server_directives.side_effect = errors.MisconfigurationError()
         self.assertRaises(
@@ -315,9 +315,9 @@ class NginxConfiguratorTest(util.NginxTest):
                            ]],
                          parsed_migration_conf[0])
 
-    @mock.patch("certbot_nginx.configurator.http_01.NginxHttp01.perform")
-    @mock.patch("certbot_nginx.configurator.NginxConfigurator.restart")
-    @mock.patch("certbot_nginx.configurator.NginxConfigurator.revert_challenge_config")
+    @mock.patch("certbot_nginx._internal.configurator.http_01.NginxHttp01.perform")
+    @mock.patch("certbot_nginx._internal.configurator.NginxConfigurator.restart")
+    @mock.patch("certbot_nginx._internal.configurator.NginxConfigurator.revert_challenge_config")
     def test_perform_and_cleanup(self, mock_revert, mock_restart, mock_http_perform):
         # Only tests functionality specific to configurator.perform
         # Note: As more challenges are offered this will have to be expanded
@@ -343,7 +343,7 @@ class NginxConfiguratorTest(util.NginxTest):
         self.assertEqual(mock_revert.call_count, 1)
         self.assertEqual(mock_restart.call_count, 2)
 
-    @mock.patch("certbot_nginx.configurator.subprocess.Popen")
+    @mock.patch("certbot_nginx._internal.configurator.subprocess.Popen")
     def test_get_version(self, mock_popen):
         mock_popen().communicate.return_value = (
             "", "\n".join(["nginx version: nginx/1.4.2",
@@ -393,7 +393,7 @@ class NginxConfiguratorTest(util.NginxTest):
         mock_popen.side_effect = OSError("Can't find program")
         self.assertRaises(errors.PluginError, self.config.get_version)
 
-    @mock.patch("certbot_nginx.configurator.subprocess.Popen")
+    @mock.patch("certbot_nginx._internal.configurator.subprocess.Popen")
     def test_get_openssl_version(self, mock_popen):
         # pylint: disable=protected-access
         mock_popen().communicate.return_value = (
@@ -455,21 +455,21 @@ class NginxConfiguratorTest(util.NginxTest):
             """)
         self.assertEqual(self.config._get_openssl_version(), "")
 
-    @mock.patch("certbot_nginx.configurator.subprocess.Popen")
+    @mock.patch("certbot_nginx._internal.configurator.subprocess.Popen")
     def test_nginx_restart(self, mock_popen):
         mocked = mock_popen()
         mocked.communicate.return_value = ('', '')
         mocked.returncode = 0
         self.config.restart()
 
-    @mock.patch("certbot_nginx.configurator.subprocess.Popen")
+    @mock.patch("certbot_nginx._internal.configurator.subprocess.Popen")
     def test_nginx_restart_fail(self, mock_popen):
         mocked = mock_popen()
         mocked.communicate.return_value = ('', '')
         mocked.returncode = 1
         self.assertRaises(errors.MisconfigurationError, self.config.restart)
 
-    @mock.patch("certbot_nginx.configurator.subprocess.Popen")
+    @mock.patch("certbot_nginx._internal.configurator.subprocess.Popen")
     def test_no_nginx_start(self, mock_popen):
         mock_popen.side_effect = OSError("Can't find program")
         self.assertRaises(errors.MisconfigurationError, self.config.restart)
@@ -623,20 +623,20 @@ class NginxConfiguratorTest(util.NginxTest):
             "ensure-http-header", "Strict-Transport-Security")
 
 
-    @mock.patch('certbot_nginx.obj.VirtualHost.contains_list')
+    @mock.patch('certbot_nginx._internal.obj.VirtualHost.contains_list')
     def test_certbot_redirect_exists(self, mock_contains_list):
         # Test that we add no redirect statement if there is already a
         # redirect in the block that is managed by certbot
         # Has a certbot redirect
         mock_contains_list.return_value = True
-        with mock.patch("certbot_nginx.configurator.logger") as mock_logger:
+        with mock.patch("certbot_nginx._internal.configurator.logger") as mock_logger:
             self.config.enhance("www.example.com", "redirect")
             self.assertEqual(mock_logger.info.call_args[0][0],
                 "Traffic on port %s already redirecting to ssl in %s")
 
     def test_redirect_dont_enhance(self):
         # Test that we don't accidentally add redirect to ssl-only block
-        with mock.patch("certbot_nginx.configurator.logger") as mock_logger:
+        with mock.patch("certbot_nginx._internal.configurator.logger") as mock_logger:
             self.config.enhance("geese.com", "redirect")
         self.assertEqual(mock_logger.info.call_args[0][0],
                 'No matching insecure server blocks listening on port %s found.')
@@ -827,7 +827,7 @@ class NginxConfiguratorTest(util.NginxTest):
         self.assertTrue(util.contains_at_depth(generated_conf, expected, 2))
 
     @mock.patch('certbot.reverter.logger')
-    @mock.patch('certbot_nginx.parser.NginxParser.load')
+    @mock.patch('certbot_nginx._internal.parser.NginxParser.load')
     def test_parser_reload_after_config_changes(self, mock_parser_load, unused_mock_logger):
         self.config.recovery_routine()
         self.config.revert_challenge_config()
@@ -836,7 +836,7 @@ class NginxConfiguratorTest(util.NginxTest):
 
     def test_choose_vhosts_wildcard(self):
         # pylint: disable=protected-access
-        mock_path = "certbot_nginx.display_ops.select_vhost_multiple"
+        mock_path = "certbot_nginx._internal.display_ops.select_vhost_multiple"
         with mock.patch(mock_path) as mock_select_vhs:
             vhost = [x for x in self.config.parser.get_vhosts()
               if 'summer.com' in x.names][0]
@@ -852,7 +852,7 @@ class NginxConfiguratorTest(util.NginxTest):
 
     def test_choose_vhosts_wildcard_redirect(self):
         # pylint: disable=protected-access
-        mock_path = "certbot_nginx.display_ops.select_vhost_multiple"
+        mock_path = "certbot_nginx._internal.display_ops.select_vhost_multiple"
         with mock.patch(mock_path) as mock_select_vhs:
             vhost = [x for x in self.config.parser.get_vhosts()
               if 'summer.com' in x.names][0]
@@ -873,7 +873,7 @@ class NginxConfiguratorTest(util.NginxTest):
             if 'geese.com' in x.names][0]
         mock_choose_vhosts.return_value = [vhost]
         self.config._choose_vhosts_wildcard = mock_choose_vhosts
-        mock_d = "certbot_nginx.configurator.NginxConfigurator._deploy_cert"
+        mock_d = "certbot_nginx._internal.configurator.NginxConfigurator._deploy_cert"
         with mock.patch(mock_d) as mock_dep:
             self.config.deploy_cert("*.com", "/tmp/path",
                                     "/tmp/path", "/tmp/path", "/tmp/path")
@@ -881,7 +881,7 @@ class NginxConfiguratorTest(util.NginxTest):
             self.assertEqual(len(mock_dep.call_args_list), 1)
             self.assertEqual(vhost, mock_dep.call_args_list[0][0][0])
 
-    @mock.patch("certbot_nginx.display_ops.select_vhost_multiple")
+    @mock.patch("certbot_nginx._internal.display_ops.select_vhost_multiple")
     def test_deploy_cert_wildcard_no_vhosts(self, mock_dialog):
         # pylint: disable=protected-access
         mock_dialog.return_value = []
@@ -890,7 +890,7 @@ class NginxConfiguratorTest(util.NginxTest):
                           "*.wild.cat", "/tmp/path", "/tmp/path",
                            "/tmp/path", "/tmp/path")
 
-    @mock.patch("certbot_nginx.display_ops.select_vhost_multiple")
+    @mock.patch("certbot_nginx._internal.display_ops.select_vhost_multiple")
     def test_enhance_wildcard_ocsp_after_install(self, mock_dialog):
         # pylint: disable=protected-access
         vhost = [x for x in self.config.parser.get_vhosts()
@@ -899,7 +899,7 @@ class NginxConfiguratorTest(util.NginxTest):
         self.config.enhance("*.com", "staple-ocsp", "example/chain.pem")
         self.assertFalse(mock_dialog.called)
 
-    @mock.patch("certbot_nginx.display_ops.select_vhost_multiple")
+    @mock.patch("certbot_nginx._internal.display_ops.select_vhost_multiple")
     def test_enhance_wildcard_redirect_or_ocsp_no_install(self, mock_dialog):
         vhost = [x for x in self.config.parser.get_vhosts()
             if 'summer.com' in x.names][0]
@@ -907,7 +907,7 @@ class NginxConfiguratorTest(util.NginxTest):
         self.config.enhance("*.com", "staple-ocsp", "example/chain.pem")
         self.assertTrue(mock_dialog.called)
 
-    @mock.patch("certbot_nginx.display_ops.select_vhost_multiple")
+    @mock.patch("certbot_nginx._internal.display_ops.select_vhost_multiple")
     def test_enhance_wildcard_double_redirect(self, mock_dialog):
       # pylint: disable=protected-access
         vhost = [x for x in self.config.parser.get_vhosts()
@@ -918,7 +918,7 @@ class NginxConfiguratorTest(util.NginxTest):
 
     def test_choose_vhosts_wildcard_no_ssl_filter_port(self):
         # pylint: disable=protected-access
-        mock_path = "certbot_nginx.display_ops.select_vhost_multiple"
+        mock_path = "certbot_nginx._internal.display_ops.select_vhost_multiple"
         with mock.patch(mock_path) as mock_select_vhs:
             mock_select_vhs.return_value = []
             self.config._choose_vhosts_wildcard("*.com",
@@ -974,14 +974,14 @@ class InstallSslOptionsConfTest(util.NginxTest):
         return _hash
 
     def test_prev_file_updates_to_current(self):
-        from certbot_nginx.constants import ALL_SSL_OPTIONS_HASHES
+        from certbot_nginx._internal.constants import ALL_SSL_OPTIONS_HASHES
         with mock.patch('certbot.crypto_util.sha256sum',
                 new=self._mock_hash_except_ssl_conf_src(ALL_SSL_OPTIONS_HASHES[0])):
             self._call()
         self._assert_current_file()
 
     def test_prev_file_updates_to_current_old_nginx(self):
-        from certbot_nginx.constants import ALL_SSL_OPTIONS_HASHES
+        from certbot_nginx._internal.constants import ALL_SSL_OPTIONS_HASHES
         self.config.version = (1, 5, 8)
         with mock.patch('certbot.crypto_util.sha256sum',
                 new=self._mock_hash_except_ssl_conf_src(ALL_SSL_OPTIONS_HASHES[0])):
@@ -1018,7 +1018,7 @@ class InstallSslOptionsConfTest(util.NginxTest):
             self.assertFalse(mock_logger.warning.called)
 
     def test_current_file_hash_in_all_hashes(self):
-        from certbot_nginx.constants import ALL_SSL_OPTIONS_HASHES
+        from certbot_nginx._internal.constants import ALL_SSL_OPTIONS_HASHES
         self.assertTrue(self._current_ssl_options_hash() in ALL_SSL_OPTIONS_HASHES,
             "Constants.ALL_SSL_OPTIONS_HASHES must be appended"
             " with the sha256 hash of self.config.mod_ssl_conf when it is updated.")
@@ -1030,10 +1030,11 @@ class InstallSslOptionsConfTest(util.NginxTest):
         file has been manually edited by the user, and will refuse to update it.
         This test ensures that all necessary hashes are present.
         """
-        from certbot_nginx.constants import ALL_SSL_OPTIONS_HASHES
+        from certbot_nginx._internal.constants import ALL_SSL_OPTIONS_HASHES
         import pkg_resources
         all_files = [
-            pkg_resources.resource_filename("certbot_nginx", os.path.join("tls_configs", x))
+            pkg_resources.resource_filename("certbot_nginx",
+                os.path.join("_internal", "tls_configs", x))
             for x in ("options-ssl-nginx.conf",
                       "options-ssl-nginx-old.conf",
                       "options-ssl-nginx-tls12-only.conf")
@@ -1070,10 +1071,10 @@ class InstallSslOptionsConfTest(util.NginxTest):
 
 
 class DetermineDefaultServerRootTest(certbot_test_util.ConfigTestCase):
-    """Tests for certbot_nginx.configurator._determine_default_server_root."""
+    """Tests for certbot_nginx._internal.configurator._determine_default_server_root."""
 
     def _call(self):
-        from certbot_nginx.configurator import _determine_default_server_root
+        from certbot_nginx._internal.configurator import _determine_default_server_root
         return _determine_default_server_root()
 
     @mock.patch.dict(os.environ, {"CERTBOT_DOCS": "1"})
diff --git a/certbot-nginx/certbot_nginx/tests/display_ops_test.py b/certbot-nginx/certbot_nginx/tests/display_ops_test.py
index d36765767..a03c5d265 100644
--- a/certbot-nginx/certbot_nginx/tests/display_ops_test.py
+++ b/certbot-nginx/certbot_nginx/tests/display_ops_test.py
@@ -5,14 +5,14 @@ from certbot.display import util as display_util
 
 from certbot.tests import util as certbot_util
 
-from certbot_nginx import parser
+from certbot_nginx._internal import parser
 
-from certbot_nginx.display_ops import select_vhost_multiple
+from certbot_nginx._internal.display_ops import select_vhost_multiple
 from certbot_nginx.tests import util
 
 
 class SelectVhostMultiTest(util.NginxTest):
-    """Tests for certbot_nginx.display_ops.select_vhost_multiple."""
+    """Tests for certbot_nginx._internal.display_ops.select_vhost_multiple."""
 
     def setUp(self):
         super(SelectVhostMultiTest, self).setUp()
diff --git a/certbot-nginx/certbot_nginx/tests/http_01_test.py b/certbot-nginx/certbot_nginx/tests/http_01_test.py
index 8e0450f6a..0335aab01 100644
--- a/certbot-nginx/certbot_nginx/tests/http_01_test.py
+++ b/certbot-nginx/certbot_nginx/tests/http_01_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot_nginx.http_01"""
+"""Tests for certbot_nginx._internal.http_01"""
 import unittest
 
 import josepy as jose
@@ -12,7 +12,7 @@ from certbot import achallenges
 from certbot.tests import acme_util
 from certbot.tests import util as test_util
 
-from certbot_nginx.obj import Addr
+from certbot_nginx._internal.obj import Addr
 from certbot_nginx.tests import util
 
 AUTH_KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key.pem"))
@@ -53,14 +53,14 @@ class HttpPerformTest(util.NginxTest):
         config = self.get_nginx_configurator(
             self.config_path, self.config_dir, self.work_dir, self.logs_dir)
 
-        from certbot_nginx import http_01
+        from certbot_nginx._internal import http_01
         self.http01 = http_01.NginxHttp01(config)
 
     def test_perform0(self):
         responses = self.http01.perform()
         self.assertEqual([], responses)
 
-    @mock.patch("certbot_nginx.configurator.NginxConfigurator.save")
+    @mock.patch("certbot_nginx._internal.configurator.NginxConfigurator.save")
     def test_perform1(self, mock_save):
         self.http01.add_chall(self.achalls[0])
         response = self.achalls[0].response(self.account_key)
@@ -106,7 +106,7 @@ class HttpPerformTest(util.NginxTest):
             #     self.assertEqual(vhost.addrs, set(v_addr2_print))
             # self.assertEqual(vhost.names, set([response.z_domain.decode('ascii')]))
 
-    @mock.patch("certbot_nginx.configurator.NginxConfigurator.ipv6_info")
+    @mock.patch("certbot_nginx._internal.configurator.NginxConfigurator.ipv6_info")
     def test_default_listen_addresses_no_memoization(self, ipv6_info):
         # pylint: disable=protected-access
         ipv6_info.return_value = (True, True)
@@ -116,7 +116,7 @@ class HttpPerformTest(util.NginxTest):
         self.http01._default_listen_addresses()
         self.assertEqual(ipv6_info.call_count, 2)
 
-    @mock.patch("certbot_nginx.configurator.NginxConfigurator.ipv6_info")
+    @mock.patch("certbot_nginx._internal.configurator.NginxConfigurator.ipv6_info")
     def test_default_listen_addresses_t_t(self, ipv6_info):
         # pylint: disable=protected-access
         ipv6_info.return_value = (True, True)
@@ -125,7 +125,7 @@ class HttpPerformTest(util.NginxTest):
         http_ipv6_addr = Addr.fromstring("[::]:80")
         self.assertEqual(addrs, [http_addr, http_ipv6_addr])
 
-    @mock.patch("certbot_nginx.configurator.NginxConfigurator.ipv6_info")
+    @mock.patch("certbot_nginx._internal.configurator.NginxConfigurator.ipv6_info")
     def test_default_listen_addresses_t_f(self, ipv6_info):
         # pylint: disable=protected-access
         ipv6_info.return_value = (True, False)
@@ -134,7 +134,7 @@ class HttpPerformTest(util.NginxTest):
         http_ipv6_addr = Addr.fromstring("[::]:80 ipv6only=on")
         self.assertEqual(addrs, [http_addr, http_ipv6_addr])
 
-    @mock.patch("certbot_nginx.configurator.NginxConfigurator.ipv6_info")
+    @mock.patch("certbot_nginx._internal.configurator.NginxConfigurator.ipv6_info")
     def test_default_listen_addresses_f_f(self, ipv6_info):
         # pylint: disable=protected-access
         ipv6_info.return_value = (False, False)
diff --git a/certbot-nginx/certbot_nginx/tests/nginxparser_test.py b/certbot-nginx/certbot_nginx/tests/nginxparser_test.py
index 7fc4576c3..74671a0ec 100644
--- a/certbot-nginx/certbot_nginx/tests/nginxparser_test.py
+++ b/certbot-nginx/certbot_nginx/tests/nginxparser_test.py
@@ -1,4 +1,4 @@
-"""Test for certbot_nginx.nginxparser."""
+"""Test for certbot_nginx._internal.nginxparser."""
 import copy
 import operator
 import tempfile
@@ -6,7 +6,7 @@ import unittest
 
 from pyparsing import ParseException
 
-from certbot_nginx.nginxparser import (
+from certbot_nginx._internal.nginxparser import (
     RawNginxParser, loads, load, dumps, dump, UnspacedList)
 from certbot_nginx.tests import util
 
diff --git a/certbot-nginx/certbot_nginx/tests/obj_test.py b/certbot-nginx/certbot_nginx/tests/obj_test.py
index 9e5853c4a..351b33e82 100644
--- a/certbot-nginx/certbot_nginx/tests/obj_test.py
+++ b/certbot-nginx/certbot_nginx/tests/obj_test.py
@@ -1,4 +1,4 @@
-"""Test the helper objects in certbot_nginx.obj."""
+"""Test the helper objects in certbot_nginx._internal.obj."""
 import unittest
 import itertools
 
@@ -6,7 +6,7 @@ import itertools
 class AddrTest(unittest.TestCase):
     """Test the Addr class."""
     def setUp(self):
-        from certbot_nginx.obj import Addr
+        from certbot_nginx._internal.obj import Addr
         self.addr1 = Addr.fromstring("192.168.1.1")
         self.addr2 = Addr.fromstring("192.168.1.1:* ssl")
         self.addr3 = Addr.fromstring("192.168.1.1:80")
@@ -71,14 +71,14 @@ class AddrTest(unittest.TestCase):
         self.assertEqual(self.addr6.to_string(include_default=False), "80")
 
     def test_eq(self):
-        from certbot_nginx.obj import Addr
+        from certbot_nginx._internal.obj import Addr
         new_addr1 = Addr.fromstring("192.168.1.1 spdy")
         self.assertEqual(self.addr1, new_addr1)
         self.assertNotEqual(self.addr1, self.addr2)
         self.assertFalse(self.addr1 == 3333)
 
     def test_equivalent_any_addresses(self):
-        from certbot_nginx.obj import Addr
+        from certbot_nginx._internal.obj import Addr
         any_addresses = ("0.0.0.0:80 default_server ssl",
                          "80 default_server ssl",
                          "*:80 default_server ssl",
@@ -97,7 +97,7 @@ class AddrTest(unittest.TestCase):
                 Addr.fromstring(any_address))
 
     def test_set_inclusion(self):
-        from certbot_nginx.obj import Addr
+        from certbot_nginx._internal.obj import Addr
         set_a = set([self.addr1, self.addr2])
         addr1b = Addr.fromstring("192.168.1.1")
         addr2b = Addr.fromstring("192.168.1.1:* ssl")
@@ -109,8 +109,8 @@ class AddrTest(unittest.TestCase):
 class VirtualHostTest(unittest.TestCase):
     """Test the VirtualHost class."""
     def setUp(self):
-        from certbot_nginx.obj import VirtualHost
-        from certbot_nginx.obj import Addr
+        from certbot_nginx._internal.obj import VirtualHost
+        from certbot_nginx._internal.obj import Addr
         raw1 = [
             ['listen', '69.50.225.155:9000'],
             [['if', '($scheme', '!=', '"https") '],
@@ -159,8 +159,8 @@ class VirtualHostTest(unittest.TestCase):
             set(['localhost']), raw_has_hsts, [])
 
     def test_eq(self):
-        from certbot_nginx.obj import Addr
-        from certbot_nginx.obj import VirtualHost
+        from certbot_nginx._internal.obj import Addr
+        from certbot_nginx._internal.obj import VirtualHost
         vhost1b = VirtualHost(
             "filep",
             set([Addr.fromstring("localhost blah")]), False, False,
@@ -183,9 +183,9 @@ class VirtualHostTest(unittest.TestCase):
         self.assertFalse(self.vhost1.has_header('Bogus-Header'))
 
     def test_contains_list(self):
-        from certbot_nginx.obj import VirtualHost
-        from certbot_nginx.obj import Addr
-        from certbot_nginx.configurator import _test_block_from_block
+        from certbot_nginx._internal.obj import VirtualHost
+        from certbot_nginx._internal.obj import Addr
+        from certbot_nginx._internal.configurator import _test_block_from_block
         test_block = [
             ['\n    ', 'return', ' ', '301', ' ', 'https://$host$request_uri'],
             ['\n']
diff --git a/certbot-nginx/certbot_nginx/tests/parser_obj_test.py b/certbot-nginx/certbot_nginx/tests/parser_obj_test.py
index 2217be54f..084b17303 100644
--- a/certbot-nginx/certbot_nginx/tests/parser_obj_test.py
+++ b/certbot-nginx/certbot_nginx/tests/parser_obj_test.py
@@ -3,18 +3,18 @@
 import unittest
 import mock
 
-from certbot_nginx.parser_obj import parse_raw
-from certbot_nginx.parser_obj import COMMENT_BLOCK
+from certbot_nginx._internal.parser_obj import parse_raw
+from certbot_nginx._internal.parser_obj import COMMENT_BLOCK
 
 class CommentHelpersTest(unittest.TestCase):
     def test_is_comment(self):
-        from certbot_nginx.parser_obj import _is_comment
+        from certbot_nginx._internal.parser_obj import _is_comment
         self.assertTrue(_is_comment(parse_raw(['#'])))
         self.assertTrue(_is_comment(parse_raw(['#', ' literally anything else'])))
         self.assertFalse(_is_comment(parse_raw(['not', 'even', 'a', 'comment'])))
 
     def test_is_certbot_comment(self):
-        from certbot_nginx.parser_obj import _is_certbot_comment
+        from certbot_nginx._internal.parser_obj import _is_certbot_comment
         self.assertTrue(_is_certbot_comment(
             parse_raw(COMMENT_BLOCK)))
         self.assertFalse(_is_certbot_comment(
@@ -25,7 +25,7 @@ class CommentHelpersTest(unittest.TestCase):
             parse_raw(['not', 'even', 'a', 'comment'])))
 
     def test_certbot_comment(self):
-        from certbot_nginx.parser_obj import _certbot_comment, _is_certbot_comment
+        from certbot_nginx._internal.parser_obj import _certbot_comment, _is_certbot_comment
         comment = _certbot_comment(None)
         self.assertTrue(_is_certbot_comment(comment))
         self.assertEqual(comment.dump(), COMMENT_BLOCK)
@@ -35,7 +35,7 @@ class CommentHelpersTest(unittest.TestCase):
 
 class ParsingHooksTest(unittest.TestCase):
     def test_is_sentence(self):
-        from certbot_nginx.parser_obj import Sentence
+        from certbot_nginx._internal.parser_obj import Sentence
         self.assertFalse(Sentence.should_parse([]))
         self.assertTrue(Sentence.should_parse(['']))
         self.assertTrue(Sentence.should_parse(['word']))
@@ -44,7 +44,7 @@ class ParsingHooksTest(unittest.TestCase):
         self.assertFalse(Sentence.should_parse(['word', []]))
 
     def test_is_block(self):
-        from certbot_nginx.parser_obj import Block
+        from certbot_nginx._internal.parser_obj import Block
         self.assertFalse(Block.should_parse([]))
         self.assertFalse(Block.should_parse(['']))
         self.assertFalse(Block.should_parse(['two', 'words']))
@@ -71,7 +71,7 @@ class ParsingHooksTest(unittest.TestCase):
         fake_parser1.not_called()
         fake_parser2.called_once()
 
-    @mock.patch("certbot_nginx.parser_obj.Parsable.parsing_hooks")
+    @mock.patch("certbot_nginx._internal.parser_obj.Parsable.parsing_hooks")
     def test_parse_raw_no_match(self, parsing_hooks):
         from certbot import errors
         fake_parser1 = mock.Mock()
@@ -91,7 +91,7 @@ class ParsingHooksTest(unittest.TestCase):
 
 class SentenceTest(unittest.TestCase):
     def setUp(self):
-        from certbot_nginx.parser_obj import Sentence
+        from certbot_nginx._internal.parser_obj import Sentence
         self.sentence = Sentence(None)
 
     def test_parse_bad_sentence_raises_error(self):
@@ -137,7 +137,7 @@ class SentenceTest(unittest.TestCase):
 
 class BlockTest(unittest.TestCase):
     def setUp(self):
-        from certbot_nginx.parser_obj import Block
+        from certbot_nginx._internal.parser_obj import Block
         self.bloc = Block(None)
         self.name = ['server', 'name']
         self.contents = [['thing', '1'], ['thing', '2'], ['another', 'one']]
@@ -153,7 +153,7 @@ class BlockTest(unittest.TestCase):
 
     def test_iterate_match(self):
         # can match on contents while expanded
-        from certbot_nginx.parser_obj import Block, Sentence
+        from certbot_nginx._internal.parser_obj import Block, Sentence
         expected = [['thing', '1'], ['thing', '2']]
         for i, elem in enumerate(self.bloc.iterate(expanded=True,
             match=lambda x: isinstance(x, Sentence) and 'thing' in x.words)):
@@ -192,7 +192,7 @@ class BlockTest(unittest.TestCase):
 
 class StatementsTest(unittest.TestCase):
     def setUp(self):
-        from certbot_nginx.parser_obj import Statements
+        from certbot_nginx._internal.parser_obj import Statements
         self.statements = Statements(None)
         self.raw = [
             ['sentence', 'one'],
diff --git a/certbot-nginx/certbot_nginx/tests/parser_test.py b/certbot-nginx/certbot_nginx/tests/parser_test.py
index 323830013..a65247dca 100644
--- a/certbot-nginx/certbot_nginx/tests/parser_test.py
+++ b/certbot-nginx/certbot_nginx/tests/parser_test.py
@@ -1,4 +1,4 @@
-"""Tests for certbot_nginx.parser."""
+"""Tests for certbot_nginx._internal.parser."""
 import glob
 import re
 import shutil
@@ -9,9 +9,9 @@ from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-
 from certbot import errors
 from certbot.compat import os
 
-from certbot_nginx import nginxparser
-from certbot_nginx import obj
-from certbot_nginx import parser
+from certbot_nginx._internal import nginxparser
+from certbot_nginx._internal import obj
+from certbot_nginx._internal import parser
 from certbot_nginx.tests import util
 
 
@@ -253,7 +253,7 @@ class NginxParserTest(util.NginxTest):
                                       [['foo', 'bar'], ['ssl_certificate',
                                                         '/etc/ssl/cert2.pem']])
         nparser.add_server_directives(mock_vhost, [['foo', 'bar']])
-        from certbot_nginx.parser import COMMENT
+        from certbot_nginx._internal.parser import COMMENT
         self.assertEqual(nparser.parsed[example_com],
             [[['server'], [['listen', '69.50.225.155:9000'],
                            ['listen', '127.0.0.1'],
@@ -288,7 +288,7 @@ class NginxParserTest(util.NginxTest):
         nparser.add_server_directives(mock_vhost,
                                       [['\n  ', 'include', ' ',
                                       nparser.abs_path('comment_in_file.conf')]])
-        from certbot_nginx.parser import COMMENT
+        from certbot_nginx._internal.parser import COMMENT
         self.assertEqual(nparser.parsed[example_com],
             [[['server'], [['listen', '69.50.225.155:9000'],
                            ['listen', '127.0.0.1'],
@@ -308,7 +308,7 @@ class NginxParserTest(util.NginxTest):
         mock_vhost = obj.VirtualHost(filep, None, None, None, target, None, [0])
         nparser.update_or_add_server_directives(
             mock_vhost, [['server_name', 'foobar.com']])
-        from certbot_nginx.parser import COMMENT
+        from certbot_nginx._internal.parser import COMMENT
         self.assertEqual(
             nparser.parsed[filep],
             [[['server'], [['listen', '69.50.225.155:9000'],
@@ -367,7 +367,7 @@ class NginxParserTest(util.NginxTest):
             ["\n", "a", " ", "b", "\n"],
             ["c", " ", "d"],
             ["\n", "e", " ", "f"]])
-        from certbot_nginx.parser import comment_directive, COMMENT_BLOCK
+        from certbot_nginx._internal.parser import comment_directive, COMMENT_BLOCK
         comment_directive(block, 1)
         comment_directive(block, 0)
         self.assertEqual(block.spaced, [
@@ -391,7 +391,7 @@ class NginxParserTest(util.NginxTest):
                 ssl_prefer_server_ciphers on;
             }""")
         block = server_block[0][1]
-        from certbot_nginx.parser import _comment_out_directive
+        from certbot_nginx._internal.parser import _comment_out_directive
         _comment_out_directive(block, 4, "blah1")
         _comment_out_directive(block, 5, "blah2")
         _comment_out_directive(block, 6, "blah3")
diff --git a/certbot-nginx/certbot_nginx/tests/util.py b/certbot-nginx/certbot_nginx/tests/util.py
index 8be285050..b238e6232 100644
--- a/certbot-nginx/certbot_nginx/tests/util.py
+++ b/certbot-nginx/certbot_nginx/tests/util.py
@@ -13,8 +13,8 @@ from certbot.compat import os
 from certbot.plugins import common
 from certbot.tests import util as test_util
 
-from certbot_nginx import configurator
-from certbot_nginx import nginxparser
+from certbot_nginx._internal import configurator
+from certbot_nginx._internal import nginxparser
 
 
 class NginxTest(test_util.ConfigTestCase):
@@ -64,9 +64,9 @@ class NginxTest(test_util.ConfigTestCase):
         self.configuration.http01_port = 80
         self.configuration.https_port = 5001
 
-        with mock.patch("certbot_nginx.configurator.NginxConfigurator."
+        with mock.patch("certbot_nginx._internal.configurator.NginxConfigurator."
                         "config_test"):
-            with mock.patch("certbot_nginx.configurator.util."
+            with mock.patch("certbot_nginx._internal.configurator.util."
                             "exe_exists") as mock_exe_exists:
                 mock_exe_exists.return_value = True
                 config = configurator.NginxConfigurator(
diff --git a/certbot-nginx/setup.py b/certbot-nginx/setup.py
index 671fcef9c..f7ee46a6a 100644
--- a/certbot-nginx/setup.py
+++ b/certbot-nginx/setup.py
@@ -71,7 +71,7 @@ setup(
     install_requires=install_requires,
     entry_points={
         'certbot.plugins': [
-            'nginx = certbot_nginx.configurator:NginxConfigurator',
+            'nginx = certbot_nginx._internal.configurator:NginxConfigurator',
         ],
     },
     test_suite='certbot_nginx',