Caution: certbot certonly doesn't use renewal configuration information

[griffin]

@raf

even when --force-renewal is used with both so they are both renewing

The (awful) --force-renewal parameter has no specific affiliation with the renew subcommand.

First, a huge clarification:

@griffin

Let's Encrypt...

• sends an expiration email twenty days, ten days, and one day before a certificate expires
• will not send an expiration email for a renewed certificate
• considers a certificate to be renewed if a newer duplicate of that certificate has been issued
• considers a certificate to be a duplicate of another certificate if both certificates have the exact same set of subject alternative names (SANs)

A renewal certificate is just a new certificate that happens to be a duplicate certificate.

The (awful) --force-renewal parameter simply tells certbot to acquire a duplicate certificate even if the current certificate is more than 30 days from expiration. If said current certificate doesn't exist, the awful parameter does nothing (meaning that a new certificate is simply acquired).