The existing answers are correct, but not everyone may be clear (I wasn't) about what is going on, especially after reading the official certbot docs on the subject.
First you'll want to list your existing certificates, just to be clear on what you have already:
sudo certbot certificates
You'll notice each certificate has a "name". Let's say you have a certificate with a name of
example.com, and it has a certificate for the domain
example.com as well. You can use the
certonly option to just update the certificate, and use the
--cert-name option to specify exactly which certificate you are updating. Don't forget to include your existing domain as well as the new domain you are adding.
sudo certbot certonly --cert-name example.com -d example.com,www.example.com
If you trust certbot to figure out the correct certificate (analogous to the "I'm feeling lucky" button Google used to have for searches), it appears you can skip the
--cert-name and use
--expand instead. This way certbot will find which certificate you are referring to by picking the one that has a subset (a proper subset—the docs say a "strict subset") of the domains you indicate.
sudo certbot certonly --expand -d example.com,www.example.com
In all of these, whether you need
--webroot depends on your particular configuration.