# Webroot --expand : a user error or a doc error? **URL:** \ **Category:** Client dev\ **Created:** [December 15, 2016, 6:17pm UTC](https://community.letsencrypt.org/t/webroot-expand-a-user-error-or-a-doc-error/24193 "2016-12-15T18:17:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Shnoulle](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shnoulle/32/9966_2.png) [@Shnoulle](https://community.letsencrypt.org/u/Shnoulle)\ **Post date:** [December 15, 2016, 6:17pm UTC](https://community.letsencrypt.org/t/webroot-expand-a-user-error-or-a-doc-error/24193/1 "2016-12-15T18:17:16Z")
Hi, I have an already existing certs for 2 domain, done like this : ``` /root/bin/certbot-auto certonly --expand --email denis@example.net --webroot \ -w /home/example.net/htdocs/www -d www.example.net \ -w /home/example.net/htdocs/doli/htdocs -d doli.example.net ``` And then have 😍 ``` :/etc/letsencrypt# cat renewal/www.example.net.conf # renew_before_expiry = 30 days version = 0.9.3 cert = /etc/letsencrypt/live/www.example.net/cert.pem privkey = /etc/letsencrypt/live/www.example.net/privkey.pem chain = /etc/letsencrypt/live/www.example.net/chain.pem fullchain = /etc/letsencrypt/live/www.example.net/fullchain.pem # Options used in the renewal process [renewalparams] account = 89978d42325c7f16202ae7bf722c8064 authenticator = webroot installer = None webroot_path = /home/example.net/htdocs/www, /home/example.net/htdocs/dolibarr/htdocs [[webroot_map]] www.gsill.net = /home/example.net/htdocs/www doli.gsill.net = /home/example.net/htdocs/dolibarr/htdocs ``` Seems OK, but then i try to expand actual cert with one server, then doing : ``` /root/bin/certbot-auto certonly --expand --email denis@example.net --webroot \ -w /home/example.net/htdocs/www -d www.example.net \ -w /home/example.net/htdocs/piwik -d piwik.example.net ``` But : it take a second cert with 😒 ``` :/etc/letsencrypt# cat renewal/www.example.net-0002.conf # renew_before_expiry = 30 days version = 0.9.3 cert = /etc/letsencrypt/live/www.example.net-0002/cert.pem privkey = /etc/letsencrypt/live/www.example.net-0002/privkey.pem chain = /etc/letsencrypt/live/www.example.net-0002/chain.pem fullchain = /etc/letsencrypt/live/www.example.net-0002/fullchain.pem # Options used in the renewal process [renewalparams] authenticator = webroot installer = None account = 89978d42325c7f16202ae7bf722c8064 webroot_path = /home/example.net/htdocs/www, /home/example.net/htdocs/piwik [[webroot_map]] piwik.gsill.net = /home/example.net/htdocs/piwik www.gsill.net = /home/example.net/htdocs/www ``` The only way to expand (with my method) an existing cert is to add ALL server in command line: ``` /root/bin/certbot-auto certonly --expand --email denis@example.net --webroot \ -w /home/example.net/htdocs/www -d www.example.net \ -w /home/example.net/htdocs/doli/htdocs -d doli.example.net \ -w /home/example.net/htdocs/piwik -d piwik.example.net ``` with this instruction certbot really expand www.example.net.conf and not create a new cert. The [user guide](https://certbot.eff.org/docs/using.html#certbot-command-line-options) seems to show we can add only one server at the command line: πŸ˜• > ``` > --expand If an existing cert covers some subset of the > requested names, always expand and replace it with the > additional names. (default: False) > > ``` An error from me ? The doc ? Or a bug in certbot ? πŸ™€ Thanks a lot. PS : unsure for category : seems related top certbot, not really help ? ---
**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\ **Post date:** [December 15, 2016, 6:30pm UTC](https://community.letsencrypt.org/t/webroot-expand-a-user-error-or-a-doc-error/24193/2 "2016-12-15T18:30:44Z")
The explanation for `--expand` is indeed a bit hard to parse. Trying to come up with something better just gives me a headache, unfortunately. πŸ˜’ Basically, `certbot` works like this: - You always need to provide _all_ the domains that should appear on the certificate, rather than just the ones that you want to add. - `--expand` only replaces an existing certificate if all the domains in the existing certificate also are included in your current certificate request. In other words, it won’t help you get rid of a subset of domains from an existing certificate, it’ll just be useful to add new ones. Does that make sense? πŸ˜• ---
**Author:** ![Shnoulle](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/shnoulle/32/9966_2.png) [@Shnoulle](https://community.letsencrypt.org/u/Shnoulle)\ **Post date:** [December 16, 2016, 7:22am UTC](https://community.letsencrypt.org/t/webroot-expand-a-user-error-or-a-doc-error/24193/3 "2016-12-16T07:22:55Z")
> [@pfg](#): > > Does that make sense? πŸ˜• OK , the strange part is "existing cert covers some subset" , the some subset make me mad πŸ™‚. Why not just > ``` > --expand If an existing cert covers requested names, > always expand and replace it with the > additional names. (default: False) > > ``` removing the "some subset". And some lines up in the manual : > (All of the domains covered by the certificate must be specified in this case in order to renew and replace the old certificate rather than obtaining a new one; don’t forget any www. domains! Specifying a subset of the domains creates a new, separate certificate containing only those domains, rather than replacing the original certificate, even with expand.) Just adding "even with expand ". This part is not needed, just remove the some subset is really better. Thanks a lot πŸ™‚ ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 15, 2017, 7:23am UTC](https://community.letsencrypt.org/t/webroot-expand-a-user-error-or-a-doc-error/24193/4 "2017-01-15T07:23:09Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.