Update certificate with certbot to add subdomain - ssl

Question

I have a domain with a LetsEncrypt certificate installed and apache conf setup to forward www to non-www and non-ssl to ssl. Everything was working great until I decided to add a subdomain and tried to generate a new certificate to cover both.
Now I get the following output when I run certbot:
root#arthas:~# certbot
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: domain.com
2: playground.domain.com
3: www.playground.domain.com
4: www.domain.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1,2,3,4
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
You have an existing certificate that contains a portion of the domains you
requested (ref: /etc/letsencrypt/renewal/domain.com.conf)
It contains these names: domain.com, www.domain.com
You requested these names for the new certificate: domain.com,
playground.domain.com, www.playground.domain.com, www.domain.com.
Do you want to expand and replace this existing certificate with the new
certificate?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(E)xpand/(C)ancel: e
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for domain.com
http-01 challenge for playground.domain.com
http-01 challenge for www.domain.com
http-01 challenge for www.playground.domain.com
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/000-default-le-ssl.conf
Created an SSL vhost at /etc/apache2/sites-enabled/000-default-le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/000-default-le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/000-default-le-ssl.conf
An unexpected error occurred:
ValueError: Unable to set value to path!
Please see the logfiles in /var/log/letsencrypt for more details.
IMPORTANT NOTES:
- Unable to install the certificate
- Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/domain.com/fullchain.pem
Your key file has been saved at: /etc/letsencrypt/live/domain.com/privkey.pem
Your cert will expire on 2019-07-19.
To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option.
To non-interactively renew *all* of your certificates, run "certbot renew"
- Some rewrite rules copied from /etc/apache2/sites-enabled/000-default.conf were disabled in the vhost for your HTTPS site located at /etc/apache2/sites-enabled/000-default-le-ssl.conf because they have the potential to create redirection loops.
Also, I've copied in the contents of my 000-default.conf file below:
# Added to mitigate CVE-2017-8295 vulnerability
UseCanonicalName On
<VirtualHost *:80>
ServerAdmin webmaster#localhost
ServerName domain.com
ServerAlias www.domain.com
DocumentRoot /var/www/html
<Directory /var/www/html/>
Options FollowSymLinks
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.domain.com [OR]
RewriteCond %{SERVER_NAME} =domain.com [OR]
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
<VirtualHost *:80>
ServerAdmin webmaster#localhost
ServerName playground.domain.com
ServerAlias www.playground.domain.com
DocumentRoot /var/www/html/playground
<Directory /var/www/html/playground>
Options FollowSymLinks
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.playground.domain.com [OR]
RewriteCond %{SERVER_NAME} =playground.domain.com [OR]
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

Answer 1

Same error message for me when trying to install certificates for multiple domains in one go. If you have all VirtualHost in the same configuration file and don't want to separate them, try installing certificate for the domains separately.
Example:
When you need to install certificates for the following domains
domain01.com
www.domain01.com
domain02.com
www.domain02.com
At the step
Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter 'c' to cancel): 1,2,3,4
enter 1, 2 instead of 1,2,3,4, then repeat to install for 3, 4

Answer 2

When you running this command make sure you have the order correct as well. So for example: example.org should be before mail.example.org in the request. Otherwise especially when using the Route 53 option get strange zone error messages.

Answer 3

It looks like you have several .conf files that may be causing conflict.
Method 1: place all <VirtualHost *:80> and <VirtualHost *:443>
rules in the same configuration file
Method 2: keep them separate and
add Include /path/to/httpd-le-ssl.conf to the end of
000-default.conf
Run $ sudo certbot renew --dry-run to check whether your revised config succeeds or fails.
Using --dry-run won't impact your limits as you troubleshoot and fix the configuration. Once it completes successfully, you could run certbot in various ways and expect things to work.

Answer 4

I have faced same problemm. Below step have been solved my problem.
Remove your all existing certbot file if you already tried to setup SSL.
Follow this link how to remove existing Certbot files from your system
https://askubuntu.com/a/1195603/871518
Separate all individual domain from a single vhost.conf file.
Example :
domain1.conf
domain2.conf
Enable vhost in your created two new file by typing :
a2ensite domain1.conf
a2esnite domain2.conf
Run certbot command :
sudo certbot --apache
Probably you will see 4 domain list if "serverAlias" contain in your virtual list :
1. domain1.com
2. domain2.com
3. www.domain1.com
4. www.domain2.com
Select only 1 and 3 in first journey
Yes, successfully you have done domain1.com SSL support and again follow same things for SSL support domain2.com :
sudo certbot --apache