Adding a new SubjectAlternativeName to a set doesn't cause a renew

[jinnatar]

If I first have a domainset such as:

domainsets:
    www:
      - example.com
      - www.example.com

And have that applied and then later on amend the domainset to for example:

domainsets:
    www:
      - example.com
      - www.example.com
      - www2.example.com

Applying the state won't trigger adding www2.example.com as an alternate name to the domainset's cert. The command visible in state apply output is correct and would cause the correct action, if it was actually executed:

/usr/bin/certbot certonly --quiet -d example.com -d www.example.com -d www2.example.com --non-interactive

.. but looks like it doesn't get executed. To me it seems because of this:

unless: {{ check_cert_cmd }} {{ domainlist[0] }}

i.e. only the status of the CN is checked, which ignores the fact of having new alternative names.

[jinnatar]

Looks like this could be worked around by having '--expand' as a certbot parameter.

[jinnatar]

The root cause is: https://github.com/saltstack-formulas/letsencrypt-formula/blob/master/letsencrypt/domains.sls#L44

If that would be expanded to checking the entire list the situation would be detected, and renewing always with --expand would allow the renew to do the correct thing.

[TimidRobot]

Specifying expand = True in pillar.letsencrypt.config does not result in SANs being added to the original certificate. I had to manually invoke certbot ({{ check_cert_cmd }} per L44 above).

[saltstack-formulas-travis]

🎉 This issue has been resolved in version 2.1.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀