-0001 cert directories?

Also, it's best to use certbot delete to remove certificates.

If you're trying to clean up from a partial manual deletion, you'll want to delete all of the associated files and directories in /etc/letsencrypt/renewal, /etc/letsencrypt/live, and /etc/letsencrypt/archive, like /etc/letsencrypt/renewal/example.com-0001.conf, /etc/letsencrypt/live/example.com-0001, and /etc/letsencrypt/archive/example.com-0001. Hopefully there are no cross-references between certificates with different names (which could somehow happen with older versions of Certbot when things were incompletely manually deleted, but which I don't think can happen nowadays).

As @rg305 mentioned, the -0001 certs happen when you have partially overlapping certificates but don't explicitly request one or more names from the old certificate, and also don't specify replacing the old certificate with --cert-name. Without --cert-name, Certbot is never willing to replace a certificate with a newer version that contains even one name fewer, so it instead creates the -0001 certificate in order to allow the old certificate to continue to exist.

3 Likes