You can comment the domain which already has a cert. Dunnow if the renewal works fine, though.

👍

I can confirm such strange behavior ....

Also ran into this. Looks like the role is just taking the first certificate, so I guess a workaround is to always prepend to that list?

Doesn't seem too difficult to make it operate on all elements of the list, rather than just the first

Ah, after prepending I run into:

fatal: [hostname.fqdn.com]: FAILED! => {"changed": true, "cmd": ["certbot", "certonly", "--standalone", "--noninteractive", "--agree-tos", "--email", "[email protected]", "-d", "newdomain.org,olddomain.org"]...

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Missing command line flag or config entry for this setting:
You have an existing certificate that contains a portion of the domains you requested (ref: /etc/letsencrypt/renewal/olddomain.org.conf)

It contains these names: olddomain.org

You requested these names for the new certificate: newdomain.org, olddomain.org.

Do you want to expand and replace this existing certificate with the new certificate?

(You can set this with the --expand flag)

This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark issues as stale.

This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.