# Certbot - Remove one domain from a SAN cert (multiple domains)

**URL:** <https://community.letsencrypt.org/t/certbot-remove-one-domain-from-a-san-cert-multiple-domains/35554>\
**Category:** Help\
**Created:** [June 5, 2017, 3:26pm UTC](https://community.letsencrypt.org/t/certbot-remove-one-domain-from-a-san-cert-multiple-domains/35554 "2017-06-05T15:26:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hal1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/hal1/32/8228_2.png) [@hal1](https://community.letsencrypt.org/u/hal1)\
**Post date:** [June 5, 2017, 3:26pm UTC](https://community.letsencrypt.org/t/certbot-remove-one-domain-from-a-san-cert-multiple-domains/35554/1 "2017-06-05T15:26:34Z")

</div>

I have a cert that won’t renew due to one of the domains having moved their web hosting and thus the DNS is no longer pointing to where it used to be. The error is:

Type: unauthorized  
Detail: Invalid response from

which is causing a failure for the entire cert. Whats the best way to either remove the problematic domain, or just recreate the cert? Thanks.

---

<div class="post-metadata">

**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\
**Post date:** [June 5, 2017, 4:08pm UTC](https://community.letsencrypt.org/t/certbot-remove-one-domain-from-a-san-cert-multiple-domains/35554/2 "2017-06-05T16:08:25Z")

</div>

hi @hal1

Starting a new chain is an option. There are also the flags below

> **--cert-name** flag can also be used to modify the domains a certificate contains, by specifying new domains using the -d or --domains flag. If certificate [example.com](http://example.com) previously contained [example.com](http://example.com) and [www.example.com](http://www.example.com), it can be modified to only contain [example.com](http://example.com) by specifying only [example.com](http://example.com) with the -d or --domains flag.

> **--allow-subset-of-names** tells Certbot to continue with certificate generation if only some of the specified domain authorizations can be obtained. This may be useful if some domains specified in a certificate no longer point at this system.

Andrei

---

<div class="post-metadata">

**Author:** ![hal1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/hal1/32/8228_2.png) [@hal1](https://community.letsencrypt.org/u/hal1)\
**Post date:** [June 5, 2017, 4:36pm UTC](https://community.letsencrypt.org/t/certbot-remove-one-domain-from-a-san-cert-multiple-domains/35554/3 "2017-06-05T16:36:47Z")

</div>

> [@ahaw021](#):
>
> --allow-subset-of-names

Thank you! --allow-subset-of-names was exactly what I needed and had not seen it in the docs. Worked like a charm!

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [June 5, 2017, 4:43pm UTC](https://community.letsencrypt.org/t/certbot-remove-one-domain-from-a-san-cert-multiple-domains/35554/4 "2017-06-05T16:43:18Z")

</div>

Wow, I have actually never heard of intentionally using `--allow-subset-of-names` to remove specific names from a cert, but that’s great if it works.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [July 5, 2017, 4:43pm UTC](https://community.letsencrypt.org/t/certbot-remove-one-domain-from-a-san-cert-multiple-domains/35554/5 "2017-07-05T16:43:27Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.