Adding extra domain fails

[wiggly]

Using 'letsencrypt::certonly' it appears that adding extra domain names does not work once the certificate has been issued.

Running the command that eventually happens reveals that the certbot code goes user-interactive and asks if you wish to expand the certificate to cover the new domains, but the puppet module does not deal with this and the current certificate remains in place.

I have had a look on the letsencrypt community board and issue tracker, it seems that this is still something undergoing change but there is an '--expand' flag that certbot should honour to add new domains, possibly ONLY if they are a complete superset (you can't remove any).

I'm not sure what a good solution is here, possibly adding '--expand' for now but it will probably still fail when domains are removed since doing this does not affect the currently issued certificate and does not change the renewal paramters in /etc/letsencrypt/renewal/.conf

[igalic]

so i just ran into this,

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org

-------------------------------------------------------------------------------
You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/cyhr.net.conf)

It contains these names: cyhr.net

You requested these names for the new certificate: cyhr.net, static.cyhr.net.

Do you want to expand and replace this existing certificate with the new
certificate?
-------------------------------------------------------------------------------
(E)xpand/(C)ancel: 

my version of letsencrypt --help certonly doesn't even document an --expand option.
When was that added?

[cwells]

You can use --force-renewal to cause the cert to be reissued.

If the letsencrypt_directory fact from PR #110 were to be merged, it would seemingly be a simple matter of comparing the fact values to the resource domains attribute and regenerating/running the script if they don't match. But I've quit holding my breath on that one.

[adenau]

+1 on this bug. I had to renew the certificates manually using the --force-renewal ,but it would nice if Puppet were to notice the additional domain.

[Nekototori]

Current workaround I've been doing is multiple certonly resources, which each creates its own cronjob.

[ianssoftcom]

The version of /usr/bin/letsencrypt from the package install on Ubuntu 16.04 does not have the --cert-name parameter. letsencrypt might have to come from vcs instead of package

letsencrypt: error: unrecognized arguments: --cert-name

$ letsencrypt --version
letsencrypt 0.4.1

[ianssoftcom]

I upgraded the letsencrypt package version by adding bionic to the sources.list and pinning the priority.

# sed 's/xenial/bionic/g' sources.list > sources.list.d/bionic.list

# cat /etc/apt/preferences.d/bionic.pref 
Package: *
Pin: release v=18.04
Pin-Priority: 50

# cat /etc/apt/preferences.d/letsencrypt.pref 
Package: letsencrypt*
Pin: release v=18.04
Pin-Priority: 600

Not the puppet way to do this (apt::source { pin => 50 }), but it is quick and dirty and resolves the errors.