Adding domains to existing certificate leads to duplicate certs/renewal configs with pattern <cert>-0001,2 etc about puppet-letsencrypt

[grant-veepshosting]

Please note: this bug doesn't happen every time with the above reproduction steps - it's unreliable and there may be some other precipitating factor we've not yet found.

[itzwam]

I encounter the same issue so I'll add some explanations to it :

As soon as you create a Duplicate certificate from letsencrypt (you create a new certificate for an already-valid domain) certbot will append a number to /etc/letsencrypt/live/${domain} -> /etc/letsencrypt/live/${domain}-0001

with that said, the check script used for the certbot certonly command's unless condition is not checking for the good path, so it returns 1, so puppet re-run certbot certonly, issue another duplicate certificate for the same domain, and repeat the operation on each puppet run until letsencrypt API ban

[itzwam]

if I find the time I'll make a PR ;)