Repository: certbot/certbot

Issue:
Why do we recommend --duplicate as a way of expanding a cert?
In `cli.py` at line 363 we say

https://github.com/letsencrypt/letsencrypt/blob/master/letsencrypt/cli.py#L363

"--expand (or, in some cases, --duplicate)".

These two options have opposite behaviors with respect to controlling the creation of new lineages. What are the "some cases" in which `--duplicate` would be appropriate to "expand and replace th[e] existing certificate with the new certificate"? Could we remove the parenthesis there? I think it's even leading people astray to try `--duplicate` when it's not useful to them at all.



Discussion:
@schoen i have been meaning to post an issue related to this but wasn't unsure if it was an issue or not (maybe i had misunderstood something) but i'm utilising LetsEncrypt for subdomain SSLs on the same machine, ex: frontend.project.tld , backend.project.tld, another.project.tld . Before running `letsencrypt-auto cert`, i generate (using a custom Ansible role ive been working on https://github.com/zemanel/ansible-letsencrypt/blob/master/templates/cli.ini.j2#L13, master is outdated atm) this cli.ini:

```
# This is an example of the kind of things you can do in a configuration file.
# All flags used by the client can be configured here. Run Let's Encrypt with
# "--help" to learn more about the available options.

# Use a 4096 bit RSA key instead of 2048
rsa-key-size = 2048

# Uncomment and update to register with the specified e-mail address
email = tech@repositive.io

# Uncomment and update to generate certificates for the specified
# domains.
domains = frontend.project.tld , backend.project.tld, another.project.tld

# Uncomment to use a text interface instead of ncurses
text = True

# Uncomment to use the standalone authenticator on port 443
authenticator = standalone
standalone-supported-challenges = tls-sni-01

# Uncomment to use the webroot authenticator. Replace webroot-path with the
# path to the public_html / webroot folder being served by your web server.
# authenticator = webroot
# webroot-path = /usr/share/nginx/html
agree-tos
keep-until-expiring
noninteractive
no-self-upgrade

```

When running the `letsencrypt-auto certonly`, i get asked that question, which breaks automation since i'm not interested in expanding (each subdomain is a module which generates his own nginx virtual host) or duplicating (not sure if `--duplicate` is what i want here, since what i want is merely to generate missing certificates or a no-op, instead `another.project.tld-000N` certificates are geenrate each time the client runs.)

Hi @zemanel, what existing cert(s) do you have when you run the client with that `cli.ini`, do you give any other options on the command line, what question does it ask you, and what behavior did you expect instead? (I just didn't quite understand exactly what you're trying to do.)

The reason this is there is because either supplying `--expand` or `--duplicate` will remove the interactive question that's asked of the user.

However, people should almost never use `--duplicate` so I'm probably okay removing that if you want to.


Resolving patch:
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -360,7 +360,7 @@ def _handle_subset_cert_request(config, domains, cert):
              br=os.linesep)
     if config.expand or config.renew_by_default or zope.component.getUtility(
             interfaces.IDisplay).yesno(question, "Expand", "Cancel",
-                                       cli_flag="--expand (or in some cases, --duplicate)"):
+                                       cli_flag="--expand"):
         return "renew", cert
     else:
         reporter_util = zope.component.getUtility(interfaces.IReporter)


Test patch: