Certbot add www domain to existing domain certificate

Question

I have installed an SSL certificate from Let's Encrypt with Certbot on my Apache server with Debian 8 following this tutorial from Let's Encrypt's own documentation: https://certbot.eff.org/#debianjessie-apache

$ certbot --apache

You need to specify the domains where you want to install the certificates for, but I only added the example.com domain. Now I want to add the www.example.com, but cannot find how to do this.

Answer 1

The existing answers are correct, but not everyone may be clear (I wasn't) about what is going on, especially after reading the official certbot docs on the subject.

First you'll want to list your existing certificates, just to be clear on what you have already:

sudo certbot certificates

You'll notice each certificate has a "name". Let's say you have a certificate with a name of example.com, and it has a certificate for the domain example.com as well. You can use the certonly option to just update the certificate, and use the --cert-name option to specify exactly which certificate you are updating. Don't forget to include your existing domain as well as the new domain you are adding.

sudo certbot certonly --cert-name example.com -d example.com,www.example.com

If you trust certbot to figure out the correct certificate (analogous to the "I'm feeling lucky" button Google used to have for searches), it appears you can skip the --cert-name and use --expand instead. This way certbot will find which certificate you are referring to by picking the one that has a subset (a proper subset—the docs say a "strict subset") of the domains you indicate.

sudo certbot certonly --expand -d example.com,www.example.com

In all of these, whether you need --webroot depends on your particular configuration.

Answer 2

UPDATE: You can now do this by passing the --expand flag (see docs):

--expand tells Certbot to update an existing certificate with a new certificate that contains all of the old domains and one or more additional new domains.

See this answer for an example.

---

In short: you can't.

The domains you specify during the initial config become integral parts of the final certificate that is then signed by Let's Encrypt. You can't retroactively change it by adding additional domains or even subdomains as this would undermine its validity.

Solution: start from scratch! (not really a big deal with certbot)

Answer 3

Use this command: certbot modifier --expand, just like the following:

sudo certbot-auto certonly --webroot -w /srv/www/htmlroot/ --expand -d domain1.com -d domain2.com -d www.domain1.com

Answer 4

I prefer the "standalone" server mode, because I have nginx.conf set to redirect port 80. And certbot needs port 80, so you may need to "stop" nginx (or apache) before you run this. Another bonus with standalone, you don't need to create a directory to get your certificate.

certbot certonly --standalone --expand -d example.com -d www.example.com

Seems like certbot is smart enough to automatically figure out which certificate you want to expand.

However, if you only specify -d www.example.com it might make a separate certificate for the "www" which is probably not what you want. Check with certbot certificates. If this happens, you could just start over fresh by deleting both the www and non-www certificates and then...

certbot certonly --standalone -d example.com -d www.example.com