You reissue adding the new site: ./letsencrypt-auto certonly --webroot -w /var/www/example -d www.example.com -d example.com -w /var/www/support -d support.example.com
LE will ask if you want to expand the certificate or cancel. When you expand, it’ll reissue with all requested domains (as long as it can reach them all).
Yep, all domains and subdomains the cert will cover have to be included. LE doesn’t allow wildcard certs, which are the only way to cover all subs of a domain without individually naming them.
btw, I just found out about the --expand --agree-tos -q options, which will make my quick server setup even faster. Add them to the command above and it just runs without any prompts.
I have comfortably entered such options in the /etc/letsencrypt/cli.ini configuration file. Saves me a lot of typing (and thinking ) for options I consider permanent in my setup.