Certonly --cert-name not recognised

Help
14

Nope, the default is to prompt the user with

You have an existing certificate that contains a portion of the domains you requested (ref: {0}){br}{br}It contains these names: {1}{br}{br}You requested these names for the new certificate: {2}.{br}{br}Do you want to expand and replace this existing certificate with the new certificate?

The --expand flag simply corresponds to saying "Yes" to this question. (There is also a --duplicate flag that forces the -0001 behavior.)

--force-renewal (previously known as --renew-by-default) means "get a new certificate, and replace an existing certificate if there's any existing certificate whose names are a subset of these names (including being the same as them)". If you omit a name in an existing certificate, --force-renewal will still make a totally new lineage (named -0001 if the first-specified name is the same as the name of an existing lineage).

For example, suppose you have a lineage called example.com that covers example.com, foo.example.com, bar.example.com.

Cases involving specifying the same 3 names:

  • -d example.com -d foo.example.com -d bar.example.com should ask you if you want to renew or not
  • --force-renewal -d example.com -d foo.example.com -d bar.example.com should renew
  • --duplicate -d example.com -d foo.example.com -d bar.example.com should make example.com-0001

Cases involving specifying the same 3 names plus additional names:

  • -d example.com -d foo.example.com -d bar.example.com -d baz.example.com should ask you if you want to expand or not
  • --expand -d example.com -d foo.example.com -d bar.example.com -d baz.example.com should expand
  • --duplicate -d example.com -d foo.example.com -d bar.example.com -d baz.example.com should make example.com-0001

Cases involving specifying only some of the existing names, with or without additional names:

  • -d example.com -d foo.example.com should make example.com-0001 (because you didn't mention bar.example.com; none of --expand, --duplicate, or --force-renewal should change this behavior)
  • -d example.com -d foo.example.com -d baz.example.com should make example.com-0001 (because you didn't mention bar.example.com; none of --expand, --duplicate, or --force-renewal should change this behavior)

So, if you want to specify a lineage to act on without mentioning every domain currently covered by it, or if you want to choose a specific lineage to act on when there are two lineages that cover the same names, or if you want to remove any domains from an existing lineage, you need --cert-name. --cert-name allows you to arbitrary reset the domain coverage of any existing lineage.