Help: I messed it up, multiple certs for the same domain and its subs

Yes, if

  • your web server configuration is not currently referring to any of them
  • your situation won't run into the issuance rate limits (https://letsencrypt.org/docs/rate-limits/) (these are only related to historical issuance volume, and not related to whether the certificates are unrevoked or in use)

Nope, these are separate. Revocation is only necessary if you have reason to believe that a certificate is no longer accurate or that someone has improperly accessed the private key. It's not generally necessary merely because an accurate certificate is no longer used.

Certbot's behavior about this can be confusing. Certbot requires you to specify all names that a certificate should cover; if new names are added, all of the old names must be listed as well. The --expand option does not cause Certbot to try to find a related certificate, but simply avoids asking a yes/no question about whether to replace an existing certificate if the new list of names is a strict superset of an old certificate's list of names. (If even a single name from the old certificate is omitted from the list, Certbot will always create a separately named and tracked certificate, unless you force it to replace the existing certificate by specifying --cert-name.)

Basically, Certbot is much less proactive about checking for possibly-related existing certificates than many users would expect it to be, and also more willing to create partially-overlapping certificates without warning the user in many circumstances.

1 Like