You'd use the command with certonly
(or --apache
, etc.), but not with renew
. Basically, you use the same command you originally used to get the certificate, plus --expand
.
You'll need to provide all domains that you want to appear on the certificate. As an example, if you originally got a certificate for example.com
and www.example.com
, and want to add mail.example.com
, your command might be:
letsencrypt certonly --standalone -d example.com -d www.example.com -d mail.example.com --expand
If the command fails, no new files should be created (or modified) in /etc/letsencrypt/live
. I'd recommend ignoring any other files in /etc/letsencrypt
- consider those client-internal files. In case I misunderstood the question: can you provide more details, like the error you got, and which files were created?
The counter is increased whenever a certificate is actually issued. If the client is unable to save those files for some reason (again, I'd need to see the error to say more), that's not something the server would know or care about, as the resources to sign a certificate were already consumed.
What do you mean with "import"? Using --test-cert
will do the exact same thing as the production environment, the only difference is that certificates issued by that server are not trusted by browsers, and that the rate limits are higher than production (hence the recommendation to use it for testing).