# Renew is creating new directories? **URL:** \ **Category:** Help\ **Created:** [September 26, 2017, 8:32pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044 "2017-09-26T20:32:57Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![wizzardude](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/wizzardude/32/5554_2.png) [@wizzardude](https://community.letsencrypt.org/u/wizzardude)\ **Post date:** [September 26, 2017, 8:32pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/1 "2017-09-26T20:32:57Z")
For _most_ of the certs I get from Let’s Encrypt, they get updated into their own directories (/etc/letsencrypt/live/domain & /etc/letsencrypt/archive/domain) For one of the domains I use LE for, upon renewal, it’s generating new subdirectories - /etc/letsencrypt/live/domain-000n & /etc/letsencrypt/archive/domain-000n Why is the renewal failing for one domain, but not others? ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [September 26, 2017, 10:18pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/2 "2017-09-26T22:18:18Z")
Hi @wizzardude, This means that you specified a different set of domains (probably partially but not completely overlapping) for your renewal. Thus, this is being tracked as a distinct certificate and both of them will be renewed in the future. For example, if you had a certificate covering [www.example.com](http://www.example.com), [example.com](http://example.com), [www.example.net](http://www.example.net), and [example.net](http://example.net), and then you asked for a new certificate covering [www.example.com](http://www.example.com), [example.com](http://example.com), [newsite.example.com](http://newsite.example.com), and [example.net](http://example.net), this would probably result in a certificate lineage called www.example.com-0001 because it doesn’t cover [www.example.net](http://www.example.net). You can find out the coverage of each of these certificates by running `certbot certificates`, and then you can see how they’re different. Edit: This can also happen if you add the `--duplicate` option to your command line or your `cli.ini`. ---
**Author:** ![wizzardude](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/wizzardude/32/5554_2.png) [@wizzardude](https://community.letsencrypt.org/u/wizzardude)\ **Post date:** [September 27, 2017, 6:24pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/3 "2017-09-27T18:24:43Z")
Except this domain ([nc.antipaucity.com](http://nc.antipaucity.com)) has only ever been itself 😑 ---
**Author:** ![wizzardude](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/wizzardude/32/5554_2.png) [@wizzardude](https://community.letsencrypt.org/u/wizzardude)\ **Post date:** [September 27, 2017, 6:27pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/4 "2017-09-27T18:27:25Z")
Also - why would it be appending a new value at the end of the -000 (1, 2, 3, currently 4, etc) on running the same renewal? ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [September 27, 2017, 6:29pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/5 "2017-09-27T18:29:17Z")
You have some certificates for just [nc.antipaucity.com](http://nc.antipaucity.com) and some for [nc.antipaucity.com](http://nc.antipaucity.com) and [office.antipaucity.com](http://office.antipaucity.com). If you request a “subset cert” (my own jargon) that covers a _smaller_ number of names, Certbot tried to make that as a duplicate (with -0001) instead of changing the larger certificate to cover only the smaller set. My guess is that perhaps - you first requested [nc.antipaucity.com](http://nc.antipaucity.com), which created the `nc.antipaucity.com` certificate lineage - later you requested [nc.antipaucity.com](http://nc.antipaucity.com) and [office.antipaucity.com](http://office.antipaucity.com), which made Certbot offer to expand `nc.antipaucity.com` to cover both - still later, you requested only [nc.antipaucity.com](http://nc.antipaucity.com), which made Certbot create `nc.antipaucity.com-0001` covering only that domain (without office), because this was a subset cert - now, you have both (`nc.antipaucity.com` covering nc and office, and `nc.antipaucity.com-0001` covering only nc) ---
**Author:** ![wizzardude](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/wizzardude/32/5554_2.png) [@wizzardude](https://community.letsencrypt.org/u/wizzardude)\ **Post date:** [September 28, 2017, 2:06am UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/6 "2017-09-28T02:06:08Z")
I have separate calls to Let’s Encrypt for both of those domains ([nc.antipaucity.com](http://nc.antipaucity.com) and [office.antipaucity.com](http://office.antipaucity.com)) … never had them together … so why would LE think they should be coupled? ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [September 28, 2017, 9:54pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/7 "2017-09-28T21:54:47Z")
If you used `certbot --apache` or `certbot --nginx`, it would have defaulted to wanting to obtain a single certificate covering all of the domain names that that server was serving. Otherwise, I’d need to see what commands you ran in order to try to explain it. ---
**Author:** ![wizzardude](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/wizzardude/32/5554_2.png) [@wizzardude](https://community.letsencrypt.org/u/wizzardude)\ **Post date:** [September 29, 2017, 3:23pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/8 "2017-09-29T15:23:37Z")
I use: `letsencrypt-auto -t -n --agree-tos --keep --expand --standalone certonly --rsa-key-size 4096 -m -d nc.antipaucity.com` To generate and renew all of my domains (with different `-d` arguments for each one, of course). I have a few certs that cover more than one domain/subdomain. But nc. and office. are not among those ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [September 29, 2017, 3:56pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/9 "2017-09-29T15:56:36Z")
> [@wizzardude](#): > > I have separate calls to Let’s Encrypt for both of those domains ([nc.antipaucity.com](http://nc.antipaucity.com) and [office.antipaucity.com](http://office.antipaucity.com)) … never had them together … so why would LE think they should be coupled? Maybe never is not the right word 🙂 21st July you created a cert covering both domains [crt.sh | 176293914](https://crt.sh/?id=176293914) ``` CRT ID DOMAIN (CN) VALID FROM VALID TO EXPIRES IN SANs 176293914 nc.antipaucity.com 2017-Jul-21 15:06 CEST 2017-Oct-19 15:06 CEST 19 days nc.antipaucity.com office.antipaucity.com ``` ---
**Author:** ![wizzardude](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/wizzardude/32/5554_2.png) [@wizzardude](https://community.letsencrypt.org/u/wizzardude)\ **Post date:** [September 29, 2017, 5:39pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/10 "2017-09-29T17:39:09Z")
hmmm - that’s odd 😑 ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [September 29, 2017, 6:22pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/11 "2017-09-29T18:22:34Z")
Maybe you still have the commands in your command history if you run `history | grep certbot`? ---
**Author:** ![wizzardude](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/wizzardude/32/5554_2.png) [@wizzardude](https://community.letsencrypt.org/u/wizzardude)\ **Post date:** [October 2, 2017, 6:40pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/12 "2017-10-02T18:40:02Z")
my history only goes back to about mid August … nothing showing the duplicate domain request since then how can I split those certs back apart? ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [October 2, 2017, 6:51pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/13 "2017-10-02T18:51:27Z")
If you don’t have any references to the `-0001` cert in your web server configuration, you could do `certbot delete --cert-name nc.antipaucity.com-0001` `certbot certonly --force-renewal --cert-name nc.antipaucity.com -d nc.antipaucity.com # plus any authentication options that you needed before, like --standalone` `certbot certonly --force-renewal --cert-name office.antipaucity.com -d office.antipaucity.com # plus any authentication options that you needed before, like --standalone` If you do have references to the `-0001` cert in the web server configuration, you should change those to point at the other cert before running the `delete` command. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 1, 2017, 6:52pm UTC](https://community.letsencrypt.org/t/renew-is-creating-new-directories/43044/14 "2017-11-01T18:52:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.