[Kaliumhexacyanoferrat]

Follow-up to #122, which sends www. in front of a custom domain on to the domain. That redirect only helps once a browser trusts the server for the www. name. A certificate issued for the domain alone does not cover it, so until it is reissued its visitors get the fallback certificate and a warning.

reissue-www.sh goes through /opt/genhttp-lambda/certs and, for each certificate whose names lack their www.:

• checks that www. resolves to where its domain does - otherwise certbot would fail for both names - and names it if not;
• reissues through the web root with both names, finding the certbot lineage by the names rather than the folder;
• installs the files with the owner and permissions the README uses.

It leaves alone the hosting domain's wildcard, domains entered with www., and certificates that already have it. It does not restart the server: the new certificates are served from the next restart, the deploy of #122 for instance. The README's custom domain section describes it.

sudo ./reissue-www.sh --list      # what would be reissued, nothing changed
sudo ./reissue-www.sh --dry-run   # asks the staging CA, installs nothing
sudo ./reissue-www.sh             # reissues and installs

I tried it on this machine with test certificates, a stand-in DNS lookup and a stand-in certbot. It handled each case correctly: www. missing and resolving, resolving elsewhere, not resolving, a wildcard, and complete. The certbot command it built was right. I haven't run it against a real certbot.

🤖 Generated with Claude Code