Repository: certbot/certbot

Issue:
Domains dialog should recommend bundling all domains to be enabled in a single certificate
If you're having trouble using Certbot and aren't sure you've found a bug or
request for a new feature, please first try asking for help at
https://community.letsencrypt.org/. There is a much larger community there of
people familiar with the project who will be able to more quickly answer your
questions.

## My operating system is (include version):
```
No LSB modules are available.
Distributor ID:	Debian
Description:	Debian GNU/Linux 10 (buster)
Release:	10
Codename:	buster
```

0.31.0-1+deb10u1

## I installed Certbot with (snap, OS package manager, pip, certbot-auto, etc):
apt/dpkg

## I ran this command and it produced this output:

`certbot`
```
Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: example.com
2: example.net
3: www.example.net
4: example.org
...
```

I selected `2`, and then repeated for `3`.


## Certbot's behavior differed from what I expected because:

It created a certificate that it could have known would break apache configuration. (resulting in insecure certificates for the `servername` or `serveralias` not specified.)

## Here is a Certbot log showing the issue (if available):
###### Logs are stored in `/var/log/letsencrypt` by default. Feel free to redact domains, e-mail and IP addresses as you see fit.

## Here is the relevant nginx server block or Apache virtualhost for the domain I am configuring:

The problem is that 2 + 3 are tied to the same apache config
```
<VirtualHost *:80>
        ServerName example.net
        ServerAlias www.example.net
```



Discussion:
Which version of certbot are you running?
> 0.31.0-1+deb10u1
When you say "selected 2 then repeated for 3", do you mean you ran certbot twice, or entered "2,3" in response to the question?
Ran it twice
Ah yes. Our recommended strategy there is to put both domains in the same cert, especially for rate limit reasons. But we could be more clear about that in the dialog, so thanks for highlighting this confusion for us!
> Ah yes. Our recommended strategy there is to put both domains in the same cert, especially for rate limit reasons. But we could be more clear about that in the dialog, so thanks for highlighting this confusion for us!

I'm currently working locally on a feature for the Apache plugin which recommends hostnames from virtualhosts from which hostnames are selected, but aren't in that set of selected hostnames. I.e., the missing hostnames.

Just needs tests.
@ohemorange: I just expected it to do the right thing. It sounds like it will soon.

Yes, I took one of my certificates and extended it to include the other domain. But I figured I should file a report.
@osirisinferi would you be able to share your design plan and what the output would look like, for that change?

I think it would be ideal to keep it as a single interactive prompt, rather than prompting twice to warn users about the remaining domains in that virtualhost.

One idea we had was to group up the domains by virtualhost, to encourage the correct selection of domains in the first instance.

Very roughly, when running just `certbot --apache` it might look like:

    Which names would you like to activate HTTPS for?
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    In VirtualHost /etc/apache2/sites-enabled/000-default.conf:1
      1: example.com
      2: www.example.com
    In VirtualHost /etc/apache2/sites-enabled/three.conf:1
      3: three.com
    In VirtualHost /etc/apache2/sites-enabled/x1.conf:1
      4: x1.com
      5: app.x1.com
      6: www.x1.com
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    We recommend selecting either all domains, or all domains in a VirtualHost.

    Select the appropriate numbers separated by commas and/or spaces, or leave input
    blank to select all options shown (Enter 'c' to cancel):

In the case of running `certbot --apache -d example.com` interactively, we could instead have the prompt suggesting securing the other domains in virtualhosts to which this domain belongs (i.e. `www.example.com` in `000-default.conf:1`).

This is just thinking out loud and and I'm not saying it should be this way, but it would be useful to get all our ideas out and thoughts lined up.


@alexzorin I agree a second prompt isn't very "clean", but that was what I was going with earlier. See my [WIP](https://github.com/certbot/certbot/compare/master...osirisinferi:wip1-hostname-suggestions-from-vhosts?expand=1).

I like your idea better, but probably would require more difficult modifications to already existing functions. My WIP above could possibly be used quite easilly for your second suggestion when the user uses `-d`.
Yep, it might turn out the more ambitious approach isn't achievable due to having to break the installer interface. Thanks for posting your code. We'll update this hopefully soon. 

Update: Installer should be OK, I think extending `FileDisplay.checklist` with the ability to group the choices is the biggest challenge. Maybe there's some other way to get the picture across.
It should be much easier to make the required display changes once https://github.com/certbot/certbot/pull/8835 is merged.

Jul 26: I began working on this in https://github.com/certbot/certbot/compare/master...alexzorin:ux-grouped-domain-dialog.
@alexzorin I see you started working on this in a branch but the issue is unassigned, were you hoping for (or open to) someone to take over the branch or did you want to finish it yourself?
Totally open to that, it's unlikely that I'll be working on this again any time soon. 
I'll grab this
Fwiw, the _simplest_ fix for this would be to just say:

> If you have more than one domain assigned to a virtualhost you should select all of them.

... or something to that effect in the dialog.

Conceptually, that's:
```diff
 Which names would you like to activate HTTPS for?
+If you have more than one domain assigned to a virtualhost you should select all of them.
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 1: example.com
 2: example.net
 3: www.example.net
 4: example.org
...
```


Resolving patch:
diff --git a/certbot/certbot/display/ops.py b/certbot/certbot/display/ops.py
--- a/certbot/certbot/display/ops.py
+++ b/certbot/certbot/display/ops.py
@@ -181,7 +181,10 @@ def _filter_names(names: Iterable[str],
     if override_question:
         question = override_question
     else:
-        question = "Which names would you like to activate HTTPS for?"
+        question = (
+            "Which names would you like to activate HTTPS for?\n"
+            "We recommend selecting either all domains, or all domains in a VirtualHost/server "
+            "block.")
     code, names = display_util.checklist(
         question, tags=sorted_names, cli_flag="--domains", force_interactive=True)
     return code, [str(s) for s in names]


Test patch: