I have installed an SSL certificate from Let's Encrypt with Certbot on my Apache server with Debian 8 following this tutorial from Let's Encrypt's own documentation: https://certbot.eff.org/#debianjessie-apache

$ certbot --apache

You need to specify the domains where you want to install the certificates for, but I only added the example.com domain. Now I want to add the www.example.com, but cannot find how to do this.

  • what commands have you run? and what have you tried? Aug 4, 2016 at 12:11
  • @burian.vlastimil I have installed certbot on my server and configured the domain during the proces of the $ certbot --apache command. So my example.com domain works perfect, but I know only need to add the certificate to the www.example.com domain.
    – Robbert
    Aug 4, 2016 at 12:19
  • I use the older version of lets encrypt but I believe you would need to delete the old cert and recreate it Aug 4, 2016 at 12:20
  • If I was in your position, supposing you have only one domain, I would purge certbot with all config and install it again and make sure there is nothing left before I install it again Aug 4, 2016 at 12:23

4 Answers 4


The existing answers are correct, but not everyone may be clear (I wasn't) about what is going on, especially after reading the official certbot docs on the subject.

First you'll want to list your existing certificates, just to be clear on what you have already:

sudo certbot certificates

You'll notice each certificate has a "name". Let's say you have a certificate with a name of example.com, and it has a certificate for the domain example.com as well. You can use the certonly option to just update the certificate, and use the --cert-name option to specify exactly which certificate you are updating. Don't forget to include your existing domain as well as the new domain you are adding.

sudo certbot certonly --cert-name example.com -d example.com,www.example.com

If you trust certbot to figure out the correct certificate (analogous to the "I'm feeling lucky" button Google used to have for searches), it appears you can skip the --cert-name and use --expand instead. This way certbot will find which certificate you are referring to by picking the one that has a subset (a proper subset—the docs say a "strict subset") of the domains you indicate.

sudo certbot certonly --expand -d example.com,www.example.com

In all of these, whether you need --webroot depends on your particular configuration.

  • This should be the accepted answer. Jul 25, 2021 at 19:30

UPDATE: You can now do this by passing the --expand flag (see docs):

--expand tells Certbot to update an existing certificate with a new certificate that contains all of the old domains and one or more additional new domains.

See this answer for an example.

In short: you can't.

The domains you specify during the initial config become integral parts of the final certificate that is then signed by Let's Encrypt. You can't retroactively change it by adding additional domains or even subdomains as this would undermine its validity.

Solution: start from scratch! (not really a big deal with certbot)

  • Thanks for your answer. In the mean time I have installed a completely new server installation because I removed the files from certbot, but was not able to reinstall it. Do you know how to uninstall it easily?
    – Robbert
    Aug 5, 2016 at 13:38

Use this command: certbot modifier --expand, just like the following:

sudo certbot-auto certonly --webroot -w /srv/www/htmlroot/ --expand -d domain1.com -d domain2.com -d www.domain1.com

I prefer the "standalone" server mode, because I have nginx.conf set to redirect port 80. And certbot needs port 80, so you may need to "stop" nginx (or apache) before you run this. Another bonus with standalone, you don't need to create a directory to get your certificate.

certbot certonly --standalone --expand -d example.com -d www.example.com

Seems like certbot is smart enough to automatically figure out which certificate you want to expand.

However, if you only specify -d www.example.com it might make a separate certificate for the "www" which is probably not what you want. Check with certbot certificates. If this happens, you could just start over fresh by deleting both the www and non-www certificates and then...

certbot certonly --standalone -d example.com -d www.example.com

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .