@Paul2, this is a known limitation in the Certbot client and is being worked on right now. A future version of Certbot will make this easier. Right now the best workaround is probably to remove the affected certificate entirely (all references to it in /etc/letsencrypt/live, /etc/letsencrypt/archive, and /etc/letsencrypt/renewal, and all references to it in your web server configuration) and generate a new certificate. We know that an easier way to remove a name upon renewal is an important feature for a lot of our users.