# 2 Let's Encrypt certificates found **URL:** \ **Category:** Uncategorized\ **Created:** [January 4, 2016, 1:09pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223 "2016-01-04T13:09:13Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![tiferrei](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tiferrei/32/3502_2.png) [@tiferrei](https://community.letsencrypt.org/u/tiferrei)\ **Post date:** [January 4, 2016, 1:09pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/1 "2016-01-04T13:09:13Z")
Is it normal for my`/etc/letsencrypt/live/` directory to have two certificates? One dir and certificate for `"example".com` and another for `"example".com-0001`? PS: I am only running one website. ---
**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\ **Post date:** [January 4, 2016, 1:48pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/2 "2016-01-04T13:48:40Z")
Have you run things more than once, with slightly different requests ? ( I’d guess one without the www and one with the www on your domain name ) ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [January 4, 2016, 1:53pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/3 "2016-01-04T13:53:19Z")
Hello @tiferrei, It’s normal if you have removed one or more domains that were available in your first cert when generated the last cert, or if you added some domain and didn’t use `--renew-by-default` or `--expand` switches… or if you used `--duplicate` switch. Do you remember the exact commands that you used to create both certificates?. Also, if you want to know the domains included in certs you can use these commands (change domain.tld by your actual domain) and check the output after **X509v3 Subject Alternative Name:** and you will see your domains in this format `DNS:domain.tld, DNS:www.domain.tld, DNS:foo.domain.tld` **Check domain.tld dir** `openssl x509 -in /etc/letsencrypt/live/domain.tld/cert.pem -noout -text` **Check domain.tld-0001 dir** `openssl x509 -in /etc/letsencrypt/live/domain.tld-0001/cert.pem -noout -text` Below commands do the same but will list your domains directly: **Check domain.tld dir listing domains** `openssl x509 -in /etc/letsencrypt/live/domain.tld/cert.pem -noout -text | awk '/X509v3 Subject Alternative Name/ {getline;gsub(/ /, "", $0); print}' | tr -d "DNS:" | tr "," "\n"` **Check domain.tld-0001 dir listing domains** `openssl x509 -in /etc/letsencrypt/live/domain.tld-0001/cert.pem -noout -text | awk '/X509v3 Subject Alternative Name/ {getline;gsub(/ /, "", $0); print}' | tr -d "DNS:" | tr "," "\n"` Cheers, sahsanu ---
**Author:** ![tiferrei](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tiferrei/32/3502_2.png) [@tiferrei](https://community.letsencrypt.org/u/tiferrei)\ **Post date:** [January 4, 2016, 3:22pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/4 "2016-01-04T15:22:16Z")
I quite possibly ran the command more than once, as it wasn’t working the first time I tried, this will probably help: [https://community.letsencrypt.org/t/lets-encrypt-auto-setup-not-showing-domain/?source\_topic\_id=8223](https://community.letsencrypt.org/t/lets-encrypt-auto-setup-not-showing-domain/?source_topic_id=8223) PS: The CN is the same but the [example.com](http://example.com) has the DNS for both the www and the one without the www, while the 0001 one only has the DNS for the non www. ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [January 4, 2016, 3:45pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/5 "2016-01-04T15:45:45Z")
> [@tiferrei](#): > > PS: The CN is the same but the [example.com](http://example.com) has the DNS for both the www and the one without the www, while the 0001 one only has the DNS for the non www. So that is the answer, you created a second cert removing www domain so Let's Encrypt created a new cert. There is no problem at all, you can ignore -0001 cert, when you renew the cert, remember to add the same domains as your first cert (with and without www) and Let's Encrypt will renew the right cert. Cheers, sahsanu ---
**Author:** ![tiferrei](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tiferrei/32/3502_2.png) [@tiferrei](https://community.letsencrypt.org/u/tiferrei)\ **Post date:** [January 4, 2016, 3:48pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/6 "2016-01-04T15:48:32Z")
Ah ok, thanks a lot! But for example if I have a virtual host using the 0001 one then does chasing it to the [example.com](http://example.com) dir still works? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 4, 2016, 3:48pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/7 "2016-01-04T15:48:58Z")
> [@sahsanu](#): > > you created a second cert **removing** www domain so Let's Encrypt created a new cert Probably the other way around 😉 I think the 0001-cert (just the [example.com](http://example.com) SAN version) is a "backup" of the first certificate and the non-0001 cert is the 2nd certificate, i.e., when @tiferrei found out he could add multiple domains to a single certificate. @tiferrei If the non-0001 certificate has _both_ the [www.example.com](http://www.example.com) ánd [example.com](http://example.com) domain in the subjectAltName extension, then it will work fine. The CN field of a certificate is deprecated anyway. Clients only look at the subjectAltName field nowadays. ---
**Author:** ![tiferrei](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tiferrei/32/3502_2.png) [@tiferrei](https://community.letsencrypt.org/u/tiferrei)\ **Post date:** [January 4, 2016, 3:54pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/8 "2016-01-04T15:54:16Z")
Hum and if I pass using just one then I can remove the other dir right? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 4, 2016, 3:56pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/9 "2016-01-04T15:56:47Z")
If there’s no reference to that directory in your configuration files, sure. But you should also remember: the /live/ directory contains symbolic links to the actual files in the /archive/ directory. Just removing the symbolic links will leave residual files in the /archive/ directory, so perhaps you should look in that directory too. Also, what’s the harm in just leaving the directory? ---
**Author:** ![tiferrei](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tiferrei/32/3502_2.png) [@tiferrei](https://community.letsencrypt.org/u/tiferrei)\ **Post date:** [January 4, 2016, 3:58pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/10 "2016-01-04T15:58:47Z")
Yes, actually good point, it won’t be used but it doesn’t bite 🙂 ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [January 4, 2016, 4:23pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/11 "2016-01-04T16:23:50Z")
Hi @Osiris, > [@Osiris](#): > > Probably the other way around 😉 I think the 0001-cert (just the [example.com](http://example.com) SAN version) is a "backup" of the first certificate and the non-0001 cert is the 2nd certificate, i.e., when @tiferrei found out he could add multiple domains to a single certificate. **-000x** dirs are created not as a backup but as a new cert directory because a new cert with same cn domain (but some domain removed) is already in use. those dirs are also created when you use `--duplicate` switch or when you add a domain that was not included in the first certificate and don't use `--renew-by-default` or `--expand` switches. I tested it yesterday 7 times (in staging) because of this [post](https://community.letsencrypt.org/t/how-to-prevent-creation-of-etc-letsencrypt-live-domain-tld-0001-when-removing-domains-from-a-domain-tld-multidomain-certificate/8135) 😉 Cheers, sahsanu ---
**Author:** ![tiferrei](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tiferrei/32/3502_2.png) [@tiferrei](https://community.letsencrypt.org/u/tiferrei)\ **Post date:** [January 4, 2016, 4:26pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/12 "2016-01-04T16:26:05Z")
Just a question, when I need to renew my certificate, which options the command should I use, so that it won’t generate a 0001 again? ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [January 4, 2016, 4:28pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/13 "2016-01-04T16:28:15Z")
You should use exactly the same command that you used to create the first certificate, just add `--renew-by-default` switch to that command. ---
**Author:** ![tiferrei](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tiferrei/32/3502_2.png) [@tiferrei](https://community.letsencrypt.org/u/tiferrei)\ **Post date:** [January 4, 2016, 4:29pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/14 "2016-01-04T16:29:48Z")
Alright, thanks again! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 4, 2016, 4:36pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/15 "2016-01-04T16:36:23Z")
Granted, backup isn’t the right term 🙂 ---
**Author:** ![paulschreiber](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/paulschreiber/32/1512_2.png) [@paulschreiber](https://community.letsencrypt.org/u/paulschreiber)\ **Post date:** [January 10, 2016, 8:14pm UTC](https://community.letsencrypt.org/t/2-lets-encrypt-certificates-found/8223/16 "2016-01-10T20:14:17Z")
I believe the -0001 certificates were created by an earlier beta version of letsencrypt. Delete both the [example.com](http://example.com) and the example.com-0001 files (from various places in /etc/letsencrypt) and then re-install the certificate.