# Adding SAN to a certificate **URL:** \ **Category:** Help\ **Created:** [October 12, 2019, 3:06pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954 "2019-10-12T15:06:30Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jfgodfrey](https://avatars.discourse-cdn.com/v4/letter/j/439d5e/32.png) [@jfgodfrey](https://community.letsencrypt.org/u/jfgodfrey)\ **Post date:** [October 12, 2019, 3:06pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/1 "2019-10-12T15:06:30Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [spirit.org](http://spirit.org) I ran this command: cerbot --apache It produced this output: A certificate for my website: [https://www.spirit.org](https://www.spirit.org) My web server is (include version): apache2-2.4.25 The operating system my web server runs on is (include version): debian stretch My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don’t know): yes I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): certbot 0.28.0 However, someone tried to connect to [https://spirit.org](https://spirit.org), and got an error since I didn’t have that as a SAN. My question is, do I need to reissue the certificate with a SAN, or can I modify the one that I have, and if so, how would I do so. Thanks for any help and or advice. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [October 12, 2019, 3:29pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/2 "2019-10-12T15:29:08Z")
Hi @jfgodfrey > [@jfgodfrey](#): > > My domain is: [spirit.org](http://spirit.org) > > I ran this command: cerbot --apache do you have a correct vHost? What says ```nohighlight apachectl -S ``` Add a ```nohighlight ServerAlias spirit.org ``` Then use ```nohighlight certbot certificates ``` to see your current certificate. If the vHost is correct, use ```nohighlight certbot -d spirit.org -d www.spirit.org --cert-name [nameofyourcertificate] ``` to overwrite the existing certificate. PS: Yep, there is a certificate with only the www version: ```nohighlight CN=www.spirit.org 13.08.2019 11.11.2019 expires in 30 days www.spirit.org - 1 entry ``` ---
**Author:** ![jfgodfrey](https://avatars.discourse-cdn.com/v4/letter/j/439d5e/32.png) [@jfgodfrey](https://community.letsencrypt.org/u/jfgodfrey)\ **Post date:** [October 12, 2019, 4:14pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/3 "2019-10-12T16:14:36Z")
> [@JuergenAuer](#): > > certbot -d [spirit.org](http://spirit.org) -d [www.spirit.org](http://www.spirit.org) --cert-name Juergen, Your instructions were perfect! Followed the steps (learned in the process), and can now connect to [https://spirit.org](https://spirit.org) without certificate errors. P.S. Like your ps, I wanted to know what cmd you ran to get your output? thanks again! john ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [October 12, 2019, 5:05pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/4 "2019-10-12T17:05:06Z")
> [@jfgodfrey](#): > > P.S. Like your ps, I wanted to know what cmd you ran to get your output? > thanks again! I've checked your domain with my online tool - [https://check-your-website.server-daten.de/?q=spirit.org#certificates](https://check-your-website.server-daten.de/?q=spirit.org#certificates) It's the part of the certificates. The tool is online, you can use it. Most ideas added are from this forum. ---
**Author:** ![jfgodfrey](https://avatars.discourse-cdn.com/v4/letter/j/439d5e/32.png) [@jfgodfrey](https://community.letsencrypt.org/u/jfgodfrey)\ **Post date:** [October 12, 2019, 6:30pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/5 "2019-10-12T18:30:24Z")
Thanks Juergen! I appreciate your making your work available. Do you think I should somehow revoke the old certs, like the ones from startcom (no longer in business for certs, afaik)? ---
**Author:** ![jfgodfrey](https://avatars.discourse-cdn.com/v4/letter/j/439d5e/32.png) [@jfgodfrey](https://community.letsencrypt.org/u/jfgodfrey)\ **Post date:** [October 12, 2019, 7:51pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/6 "2019-10-12T19:51:55Z")
Juergen, what’s your recommended way to enable TLS 1.2 for my setup? Thanks! john ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [October 12, 2019, 7:58pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/7 "2019-10-12T19:58:32Z")
> [@jfgodfrey](#): > > Do you think I should somehow revoke the old certs No, there is no need to revoke certificates if the private key isn't stolen. > [@jfgodfrey](#): > > what’s your recommended way to enable TLS 1.2 for my setup? The last check of your domain - there is Tls.1.2 enabled. ---
**Author:** ![jfgodfrey](https://avatars.discourse-cdn.com/v4/letter/j/439d5e/32.png) [@jfgodfrey](https://community.letsencrypt.org/u/jfgodfrey)\ **Post date:** [October 12, 2019, 8:24pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/8 "2019-10-12T20:24:47Z")
You’re right. I think it was because I saw something in the test that was run about TLS 1.2. I’ll recheck. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 11, 2019, 8:24pm UTC](https://community.letsencrypt.org/t/adding-san-to-a-certificate/103954/9 "2019-11-11T20:24:47Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.