I've reduced the number of virtual hosts on my computer to make management easier (or so I thought!). 
I'm now using the one VirtualHost for the company, which I copied below. My aim was that the company website
along with a few common errors in typing that (missing out a k in my name, or using a .com instead of a .co.uk) were caught by buying a couple of extra domains. I've set up Let's encrypt, but whilst the certificate works, and it gets an A at
https://www.ssllabs.com/ssltest/analyze.html?d=kirkbymicrowave.co.uk
the certificate contains a weird Subject, Common name, and list of alternative names, which are completely unrelated to what is wanted.
Subject bitcoinhelp.uk
Common names bitcoinhelp.uk
Alternative names bitcoinhelp.uk dhars.org.uk g8wrb.co.uk kirbymicrowave.co.uk kirkbymicrowave.co.uk kirkbymicrowave.com www.bitcoinhelp.uk www.dhars.org.uk www.g8wrb.co.uk www.kirbymicrowave.co.uk www.kirkbymicrowave.co.uk www.kirkbymicrowave.com
The other domains (bitcoinhelp.co.uk, g8wrb.co.uk and dhargs.org.uk) are all domains I have on the server, in different VirtualHost's but why are they showing up in the SSL certificate? I would only have expected to see at the very most the kirkbymicrowave.co.uk, kirkbymicrowave.com and/or kirbymicrowave.co.uk domains in the one certificate, as they are on the same virtual host. The other domains have nothing whatsoever to do with the company, so I would rather they were not there.
<IfModule mod_ssl.c>
<VirtualHost *:443>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerName kirkbymicrowave.co.uk
# Add www
ServerAlias www.kirkbymicrowave.co.uk
# .com
ServerAlias kirkbymicrowave.com
ServerAlias www.kirkbymicrowave.com
# Wrong spelling
ServerAlias kirbymicrowave.co.uk
ServerAlias www.kirbymicrowave.co.uk
ServerAdmin drkirkby@kirkbymicrowave.co.uk
DocumentRoot /var/www/html/kirkbymicrowave.co.uk
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/kirkbymicrowave.co.uk.error.log
CustomLog ${APACHE_LOG_DIR}/kirkbymicrowave.co.uk.access.log combined
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/bitcoinhelp.uk/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/bitcoinhelp.uk/privkey.pem
</VirtualHost>
</IfModule>
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: kirkbymicrowave.co.uk
I ran this command: # certbot renew --dry-run -v
It produced this output:
root@foobar:/etc/apache2/sites-enabled# certbot renew --dry-run -v
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/bitcoinhelp.uk.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not due for renewal, but simulating renewal for dry run
Plugins selected: Authenticator apache, Installer apache
Simulating renewal of an existing certificate for bitcoinhelp.uk and 11 more domains
Performing the following challenges:
http-01 challenge for bitcoinhelp.uk
http-01 challenge for dhars.org.uk
http-01 challenge for g8wrb.co.uk
http-01 challenge for kirbymicrowave.co.uk
http-01 challenge for kirkbymicrowave.co.uk
http-01 challenge for kirkbymicrowave.com
http-01 challenge for www.bitcoinhelp.uk
http-01 challenge for www.dhars.org.uk
http-01 challenge for www.g8wrb.co.uk
http-01 challenge for www.kirbymicrowave.co.uk
http-01 challenge for www.kirkbymicrowave.co.uk
http-01 challenge for www.kirkbymicrowave.com
Waiting for verification...
Cleaning up challenges
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/bitcoinhelp.uk/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
My web server is (include version): Apache
The operating system my web server runs on is (include version): Debian 10.x
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.27.0
