Replacing several certificates with one wildcard certificate

Help
21

Good. We will keep the file path the same even after adding the root.

You haven't shown your certbot command but here is the key

sudo certbot (your options) --cert-name orchardmusic.com-0001 -d orchardmusic.com -d *.orchardmusic.com

We list both domain names (two -d clauses) and specify the exact cert to update with --cert-name. Certbot will probably ask if you want to expand the cert and confirm that.

If you want the exact command to use please show either this cert's renewal file from the /etc/letsencrypt/renewal or just show us the command you used.

UPDATE:
And once you have everything using the new cert you should delete the older ones

sudo certbot delete --cert-name X

Where X is the name from "Certificate Names" from certbot certificates

2 Likes
22

Ah, got it, I did read about expanding a certificate - I'm going to actually know what I'm doing here if I'm not careful... This was the certbot command I used just for completeness:

certbot certonly --manual --preferred-challenges=dns -d '*.orcharmusic.com'

1 Like
23

So here's what I 'think' would be correct @MikeMcQ - grateful if you get a mo to check - guessing the single quotes I used (copy/pasted from a guide) are not really required btw?

sudo certbot certonly --manual --preferred-challenges=dns -d --cert-name orchardmusic.com-0001 -d orchardmusic.com -d *.orchardmusic.com

It may well be best done in the morning after espresso though :coffee:

24

Not quite. You have an extra -d before --cert-name So like this:

sudo certbot certonly --manual --preferred-challenges=dns --cert-name orchardmusic.com-0001 -d orchardmusic.com -d *.orchardmusic.com
4 Likes
25

The single quotes may be required depending on your shell. I'm usually in zsh, and you would need a quote to prevent the shell from trying to expand the wildcard. :wink:

4 Likes
26

Thank you - I'm in bash so... will I:

sudo certbot certonly --manual --preferred-challenges=dns --cert-name orchardmusic.com-0001 -d orchardmusic.com -d *.orchardmusic.com
Or
sudo certbot certonly --manual --preferred-challenges=dns --cert-name orchardmusic.com-0001 -d 'orchardmusic.com' -d '*.orchardmusic.com'

Haven't ever expanded a certificate before so didn't want to assume anything.

1 Like
27

This way should work under all shells:
sudo certbot certonly --manual --preferred-challenges=dns --cert-name orchardmusic.com-0001 -d orchardmusic.com -d '*.orchardmusic.com'
[you only need to quote the wildcard]

3 Likes
28

Right :+1: many thanks Rudy.

Thanks to all you guys I am learning new tricks in my old dog dotage, it's much appreciated.

2 Likes
29

All done and working properly with email, website and nextcloud. Many thanks chaps, much appreciated.

Will delete all the old certificates after 24hrs (belt and braces in the 'just in case' department!)

30

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.