diff --git a/REFERENCE.md b/REFERENCE.md
index c7acece6..727f6f89 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -9,7 +9,6 @@
 #### Public Classes
 
 * [`letsencrypt`](#letsencrypt): Install and configure Certbot, the LetsEncrypt client
-* [`letsencrypt::install`](#letsencrypt--install): Installs the Let's Encrypt client.
 * [`letsencrypt::plugin::dns_cloudflare`](#letsencrypt--plugin--dns_cloudflare): Installs and configures the dns-cloudflare plugin
 * [`letsencrypt::plugin::dns_rfc2136`](#letsencrypt--plugin--dns_rfc2136): Installs and configures the dns-rfc2136 plugin
 * [`letsencrypt::plugin::dns_route53`](#letsencrypt--plugin--dns_route53): Installs and configures the dns-route53 plugin
@@ -19,6 +18,7 @@
 #### Private Classes
 
 * `letsencrypt::config`: Configures the Let's Encrypt client.
+* `letsencrypt::install`: Installs the Let's Encrypt client.
 * `letsencrypt::scripts`: Deploy helper scripts scripts
 
 ### Defined types
@@ -328,42 +328,6 @@ certificate. Two environmental variables are supplied by certbot:
 
 Default value: `[]`
 
-### <a name="letsencrypt--install"></a>`letsencrypt::install`
-
-Installs the Let's Encrypt client.
-
-#### Parameters
-
-The following parameters are available in the `letsencrypt::install` class:
-
-* [`configure_epel`](#-letsencrypt--install--configure_epel)
-* [`package_ensure`](#-letsencrypt--install--package_ensure)
-* [`package_name`](#-letsencrypt--install--package_name)
-
-##### <a name="-letsencrypt--install--configure_epel"></a>`configure_epel`
-
-Data type: `Boolean`
-
-A feature flag to include the 'epel' class and depend on it for package installation.
-
-Default value: `$letsencrypt::configure_epel`
-
-##### <a name="-letsencrypt--install--package_ensure"></a>`package_ensure`
-
-Data type: `String`
-
-The value passed to `ensure` when installing the client package.
-
-Default value: `$letsencrypt::package_ensure`
-
-##### <a name="-letsencrypt--install--package_name"></a>`package_name`
-
-Data type: `String`
-
-Name of package to use when installing the client package.
-
-Default value: `$letsencrypt::package_name`
-
 ### <a name="letsencrypt--plugin--dns_cloudflare"></a>`letsencrypt::plugin::dns_cloudflare`
 
 This class installs and configures the Let's Encrypt dns-cloudflare plugin.
diff --git a/manifests/install.pp b/manifests/install.pp
index af1b47c3..a3efb5dc 100644
--- a/manifests/install.pp
+++ b/manifests/install.pp
@@ -4,11 +4,15 @@
 # @param package_ensure The value passed to `ensure` when installing the client package.
 # @param package_name Name of package to use when installing the client package.
 #
+# @api private
+#
 class letsencrypt::install (
-  Boolean $configure_epel                = $letsencrypt::configure_epel,
-  String $package_name                   = $letsencrypt::package_name,
-  String $package_ensure                 = $letsencrypt::package_ensure,
+  Boolean $configure_epel = $letsencrypt::configure_epel,
+  String $package_name = $letsencrypt::package_name,
+  String $package_ensure = $letsencrypt::package_ensure,
 ) {
+  assert_private()
+
   package { 'letsencrypt':
     ensure => $package_ensure,
     name   => $package_name,
diff --git a/spec/classes/letsencrypt_install_spec.rb b/spec/classes/letsencrypt_install_spec.rb
deleted file mode 100644
index 3a39dd90..00000000
--- a/spec/classes/letsencrypt_install_spec.rb
+++ /dev/null
@@ -1,50 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-describe 'letsencrypt::install' do
-  on_supported_os.each do |os, facts|
-    let(:params) { default_params.merge(additional_params) }
-    let(:default_params) do
-      {
-        configure_epel: false,
-        package_ensure: 'installed',
-        package_name: 'letsencrypt'
-      }
-    end
-    let(:additional_params) { {} }
-
-    context "on #{os} based operating systems" do
-      let :facts do
-        facts
-      end
-
-      it { is_expected.to compile.with_all_deps }
-
-      it 'contains the correct resources' do
-        is_expected.to contain_package('letsencrypt').with_ensure('installed')
-      end
-
-      describe 'with package_ensure => 0.3.0-1.el7' do
-        let(:additional_params) { { package_ensure: '0.3.0-1.el7' } }
-
-        it { is_expected.to compile.with_all_deps }
-        it { is_expected.to contain_package('letsencrypt').with_ensure('0.3.0-1.el7') }
-      end
-
-      case facts[:osfamily]
-      when 'RedHat'
-        describe 'with configure_epel => true' do
-          let(:additional_params) { { configure_epel: true } }
-
-          it { is_expected.to compile.with_all_deps }
-
-          it 'contains the correct resources' do
-            is_expected.to contain_class('epel')
-            is_expected.to contain_package('letsencrypt').that_requires('Class[epel]')
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/spec/classes/letsencrypt_spec.rb b/spec/classes/letsencrypt_spec.rb
index a81fc0fe..5a970bd0 100644
--- a/spec/classes/letsencrypt_spec.rb
+++ b/spec/classes/letsencrypt_spec.rb
@@ -58,7 +58,7 @@
               end
               is_expected.to contain_class('letsencrypt::install').with(package_name: 'certbot')
               is_expected.to contain_class('letsencrypt').with(package_command: 'certbot')
-              is_expected.to contain_package('letsencrypt').with(name: 'certbot')
+              is_expected.to contain_package('letsencrypt').with(name: 'certbot').with_ensure('installed')
               is_expected.to contain_file('/etc/letsencrypt').with(ensure: 'directory')
             elsif facts[:osfamily] == 'Debian'
               is_expected.to contain_class('letsencrypt::install').with(package_name: 'certbot')
@@ -66,17 +66,17 @@
             elsif facts[:operatingsystem] == 'Gentoo'
               is_expected.to contain_class('letsencrypt::install').with(package_name: 'app-crypt/certbot')
               is_expected.to contain_class('letsencrypt').with(package_command: 'certbot')
-              is_expected.to contain_package('letsencrypt').with(name: 'app-crypt/certbot')
+              is_expected.to contain_package('letsencrypt').with(name: 'app-crypt/certbot').with_ensure('installed')
               is_expected.to contain_file('/etc/letsencrypt').with(ensure: 'directory')
             elsif facts[:operatingsystem] == 'OpenBSD'
               is_expected.to contain_class('letsencrypt::install').with(package_name: 'certbot')
               is_expected.to contain_class('letsencrypt').with(package_command: 'certbot')
-              is_expected.to contain_package('letsencrypt').with(name: 'certbot')
+              is_expected.to contain_package('letsencrypt').with(name: 'certbot').with_ensure('installed')
               is_expected.to contain_file('/etc/letsencrypt').with(ensure: 'directory')
             elsif facts[:operatingsystem] == 'FreeBSD'
               is_expected.to contain_class('letsencrypt::install').with(package_name: 'py39-certbot')
               is_expected.to contain_class('letsencrypt').with(package_command: 'certbot')
-              is_expected.to contain_package('letsencrypt').with(name: 'py39-certbot')
+              is_expected.to contain_package('letsencrypt').with(name: 'py39-certbot').with_ensure('installed')
               is_expected.to contain_file('/usr/local/etc/letsencrypt').with(ensure: 'directory')
             else
               is_expected.to contain_class('letsencrypt::install')