# \[SOLVED\] How to add subdomains to Letsencrypt: "how to renew certificate and expand with subdomains"! **URL:** https://discuss.freedombox.org/t/solved-how-to-add-subdomains-to-letsencrypt-how-to-renew-certificate-and-expand-with-subdomains/812 **Category:** Support **Created:** [April 16, 2020, 12:30am UTC](https://discuss.freedombox.org/t/solved-how-to-add-subdomains-to-letsencrypt-how-to-renew-certificate-and-expand-with-subdomains/812 "2020-04-16T00:30:02Z") **Posts on this page:** 1 **Showing post:** 2
### Author: ![ScottishFreedom](https://discuss.freedombox.org/user_avatar/discuss.freedombox.org/scottishfreedom/32/316_2.png) [@ScottishFreedom](https://discuss.freedombox.org/u/ScottishFreedom) #### Post date: [April 16, 2020, 1:13pm UTC](https://discuss.freedombox.org/t/solved-how-to-add-subdomains-to-letsencrypt-how-to-renew-certificate-and-expand-with-subdomains/812/2 "2020-04-16T13:13:34Z")
**Letsencrypt - Adding Subdomains on Freedombox** _My setup: Raspberry Pi 3B/ Raspbian GNU/Linux 10 (buster) and **FreedomBox version 20.5**._ _( **NOTE** : the following is all part or a greater effort to get a TURN server running with Riot/Matrix and NextCloud Talk. As I understand it I need two secured subdomains to set up STUN and TURN!)_ ## **SOLUTION SUMMARY** To add subdomain names to a existing Letsencrypt certificate on a Freedombox the following commands worked for me. **Install the Apache server certbot connector:** ` sudo apt install python3-certbot-apache` **Then add the subdomain names to the existing domain’s Letsencrypt certificate:** ``` `sudo certbot --apache --expand -d domainname.com -d subone.domainname.com -d subtwo.domainname.com` ``` **Example** : ``` `sudo certbot --apache --expand -d mydomain.ddnsfree.com -d turn.mydomain.ddnsfree.com -d stun.mydomain.ddnsfree.com` ``` ## **BACKGROUND AND EXTENDED STEPS** I basically pieced together the above commands that I needed from these two pages (I have given a full explanation of the steps I went through with Freedombox to get set this up below): - Re-creating and Updating Existing Certificates: [https://certbot.eff.org/docs/using.html#re-creating-and-updating-existing-certificates](https://certbot.eff.org/docs/using.html#re-creating-and-updating-existing-certificates) - How to Secure Apache with Free Let’s Encrypt SSL Certificate on Ubuntu and Debian: [https://www.tecmint.com/install-free-lets-encrypt-ssl-certificate-for-apache-on-debian-and-ubuntu/](https://www.tecmint.com/install-free-lets-encrypt-ssl-certificate-for-apache-on-debian-and-ubuntu/) - Certbot missing Apache plugin:[https://community.letsencrypt.org/t/certbot-missing-apache-plugin/58579](https://community.letsencrypt.org/t/certbot-missing-apache-plugin/58579)): [https://community.letsencrypt.org/t/certbot-missing-apache-plugin/58579](https://community.letsencrypt.org/t/certbot-missing-apache-plugin/58579) **The steps I followed** _ **NOTE** : I have used my test domain and subdomain names below, obviously these need to be changed for your domain and subdomain names._ **Domain Name and DDNS Setup** - set up a free domain name with a DDNS provider (I used: [www.dynu.com](http://www.dynu.com)). To test this process I set up the domain: [mydomain.ddnsfree.com](http://mydomain.ddnsfree.com); - set up two additional subdomain names (aliases): [turn.mydomain.ddnsfree.com](http://turn.mydomain.ddnsfree.com) and [stun.mydomain.ddnsfree.com](http://stun.mydomain.ddnsfree.com) - see screenshot; ![01 - DYNU](https://discuss.freedombox.org/uploads/default/original/1X/cf13f5e46b9031bad850e87c66837435fd90071d.png) - set up a DDNS client. In my case I used the DDNS function on my DD-WRT router. But the built in Freedombox DDNS client can be used just as well; - set up the home router port forwarding to the Freedombox machine on the local network. **Freedombox Configuration** - log into Freedombox as an admin user; - set up the domain in System \> Configure – see screenshot below ![01 - FB Configure Domain](https://discuss.freedombox.org/uploads/default/original/1X/ece3b436767893738266035ee366b8a0fa3111c1.png) - get Letsencrypt certificate for the domain name, System \> Letsencrypt – see screenshot below ![01 - FB Configure Letsencrypt](https://discuss.freedombox.org/uploads/default/original/1X/d07fc18f6b7913e73e68e840785294fd692672b4.png) **Add Subdomains to Letsencrypt Certificate** - open a terminal on the Freedombox machine (SSH into the box!) - install the Letsencrypt plug-in to connect with Apache server `sudo apt install python3-certbot-apache` _ **NOTE** : initially got the error message: certbot: **error: unrecognized arguments: --apache2 and discovered** I had to when running the command below and then discovered that I had to install the python3-certbot-apache package, as above!_`\* - run the following Letsencrypt command to add the subdomains to the existing domain certificate: I then had to make a number of selections based on the following output: ``` Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Renewing an existing certificate Performing the following challenges: http-01 challenge for stun.mydomain.ddnsfree.com http-01 challenge for turn.mydomain.ddnsfree.com Waiting for verification... Cleaning up challenges Running deploy-hook command: /etc/letsencrypt/renewal-hooks/deploy/50-freedombox Output from 50-freedombox: Let's Encrypt calling deploy hook for FreedomBox: Domains: 'mydomain.ddnsfree.com turn.mydomain.ddnsfree.com stun.mydomain.ddnsfree.com' Lineage: '/etc/letsencrypt/live/mydomain.ddnsfree.com' Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf We were unable to find a vhost with a ServerName or Address of turn.mydomain.ddnsfree.com. Which virtual host would you like to choose? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: freedombox-tls-site-macro.conf | | HTTPS | Enabled 2: freedombox-tls-site-macro.conf | | HTTPS | Enabled 3: 000-default.conf | | | Enabled 4: default-ssl.conf | | HTTPS | Enabled 5: 000-default-le-ssl.conf | mydomain.ddnsfree | HTTPS | Enabled - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-5] then [enter] (press 'c' to cancel): 5 ``` **NOTE** : I chose option 5 (as can be seen above) ``` Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf We were unable to find a vhost with a ServerName or Address of stun.mydomain.ddnsfree.com. Which virtual host would you like to choose? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: freedombox-tls-site-macro.conf | | HTTPS | Enabled 2: freedombox-tls-site-macro.conf | | HTTPS | Enabled 3: 000-default.conf | | | Enabled 4: default-ssl.conf | | HTTPS | Enabled 5: 000-default-le-ssl.conf | Multiple Names | HTTPS | Enabled - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-5] then [enter] (press 'c' to cancel): 5 ``` **NOTE** : I chose option 5 (as can be seen above) ``` Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2 ``` **NOTE** : I chose option 2 (as can be seen above) ``` Redirecting vhost in /etc/apache2/sites-enabled/000-default.conf to ssl vhost in /etc/apache2/sites-available/000-default-le-ssl.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Your existing certificate has been successfully renewed, and the new certificate has been installed. The new certificate covers the following domains: https://mydomain.ddnsfree.com, https://turn.mydomain.ddnsfree.com, and https://stun.mydomain.ddnsfree.com You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=mydomain.ddnsfree.com https://www.ssllabs.com/ssltest/analyze.html?d=turn.mydomain.ddnsfree.com https://www.ssllabs.com/ssltest/analyze.html?d=stun.mydomain.ddnsfree.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/mydomain.ddnsfree.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/mydomain.ddnsfree.com/privkey.pem Your cert will expire on 2020-07-15. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le ``` Done! **Test the Subdomain HTTPS Connections** Test as per the suggestions in the out put above. I can now access my Freedombox with all three domain/subdomains via HTTPS without the browser complaining. Joy! _ **Please let me know if I have done anything stupid here or if this could be achieved more efficiently or leave any other comment – thanks.** _ --- _[View the full topic](https://discuss.freedombox.org/t/solved-how-to-add-subdomains-to-letsencrypt-how-to-renew-certificate-and-expand-with-subdomains/812)._