Published
Let's Encrypt for Multiple Domains: One Certificate, Many Names
One certificate can cover several names, like example.com, www.example.com and shop.example.com, as Subject Alternative Names (SAN). Here is how to request one and add or remove names later.
Full guide: Full Let's Encrypt guide
1. Request a multi-name certificate
Every -d adds a name. The first one becomes the certificate name.
sudo certbot --nginx -d example.com -d www.example.com -d shop.example.com2. See what each certificate covers
sudo certbot certificates3. Add a name later
List every name you want to keep plus the new one; –expand grows the existing certificate.
sudo certbot --nginx --expand -d example.com -d www.example.com -d shop.example.com -d blog.example.com4. Remove a name
Re-issue under the same certificate name with only the names you keep.
sudo certbot --nginx --cert-name example.com -d example.com -d www.example.com5. Verify the names on the live certificate
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName6. Troubleshooting
One name failing validation stops the whole request: check DNS for each name. Let's Encrypt allows up to 100 names per certificate.
dig +short shop.example.comFAQ
One certificate for all names, or one per site?
One per site is easier to manage and a failed name cannot block the others. A shared certificate is fine for names that always live on the same server.
Does a SAN certificate cost more?
No. Let's Encrypt certificates are free regardless of how many names they cover.
Further reading: Certbot user guide