We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Letsencrypt Force Renewal
Is there a limit on the Subject Alt Name entries?

I have updated my /mailu/mailu.env "HOSTNAMES" variable, but when I restart Mailu it doesn't update the Subject Alt Names on the mailu cert.

Previously it has worked, so I am guessing that I need to force Letsencrypt to refresh as it isnt within the renewal window. But there is no guidance for the new letsencrypt certbot.

I am using the latest Mailu version (1.7) and this is the command I am using to restart mailu '/mailu/docker-compose -p mailu up -d'
Letsencrypt Force Renewal
Is there a limit on the Subject Alt Name entries?

I have updated my /mailu/mailu.env "HOSTNAMES" variable, but when I restart Mailu it doesn't update the Subject Alt Names on the mailu cert.

Previously it has worked, so I am guessing that I need to force Letsencrypt to refresh as it isnt within the renewal window. But there is no guidance for the new letsencrypt certbot.

I am using the latest Mailu version (1.7) and this is the command I am using to restart mailu '/mailu/docker-compose -p mailu up -d'

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `core/nginx/letsencrypt.py`
Content:
```
1 #!/usr/bin/python3
2 
3 import os
4 import time
5 import subprocess
6 
7 command = [
8     "certbot",
9     "-n", "--agree-tos", # non-interactive
10     "-d", os.environ["HOSTNAMES"],
11     "-m", "{}@{}".format(os.environ["POSTMASTER"], os.environ["DOMAIN"]),
12     "certonly", "--standalone",
13     "--cert-name", "mailu",
14     "--preferred-challenges", "http", "--http-01-port", "8008",
15     "--keep-until-expiring",
16     "--config-dir", "/certs/letsencrypt",
17     "--post-hook", "/config.py"
18 ]
19 command2 = [
20     "certbot",
21     "-n", "--agree-tos", # non-interactive
22     "-d", os.environ["HOSTNAMES"],
23     "-m", "{}@{}".format(os.environ["POSTMASTER"], os.environ["DOMAIN"]),
24     "certonly", "--standalone",
25     "--cert-name", "mailu-ecdsa",
26     "--preferred-challenges", "http", "--http-01-port", "8008",
27     "--keep-until-expiring",
28     "--key-type", "ecdsa",
29     "--config-dir", "/certs/letsencrypt",
30     "--post-hook", "/config.py"
31 ]
32 
33 def format_for_nginx(fullchain, output):
34     """ We may want to strip ISRG Root X1 out
35     """
36     certs = []
37     with open(fullchain, 'r') as pem:
38         cert = ''
39         for line in pem:
40             cert += line
41             if '-----END CERTIFICATE-----' in line:
42                 certs += [cert]
43                 cert = ''
44     with open(output, 'w') as pem:
45         for cert in certs[:-1] if len(certs)>2 and os.getenv('LETSENCRYPT_SHORTCHAIN', default="False") else certs:
46             pem.write(cert)
47 
48 # Wait for nginx to start
49 time.sleep(5)
50 
51 # Run certbot every day
52 while True:
53     subprocess.call(command)
54     format_for_nginx('/certs/letsencrypt/live/mailu/fullchain.pem', '/certs/letsencrypt/live/mailu/nginx-chain.pem')
55     subprocess.call(command2)
56     format_for_nginx('/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem', '/certs/letsencrypt/live/mailu-ecdsa/nginx-chain.pem')
57     time.sleep(86400)
58
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -13,6 +13,7 @@
     "--cert-name", "mailu",
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
+    "--renew-with-new-domains",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]
@@ -26,6 +27,7 @@
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
     "--key-type", "ecdsa",
+    "--renew-with-new-domains",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]

{"golden_diff": "diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py\n--- a/core/nginx/letsencrypt.py\n+++ b/core/nginx/letsencrypt.py\n@@ -13,6 +13,7 @@\n     \"--cert-name\", \"mailu\",\n     \"--preferred-challenges\", \"http\", \"--http-01-port\", \"8008\",\n     \"--keep-until-expiring\",\n+    \"--renew-with-new-domains\",\n     \"--config-dir\", \"/certs/letsencrypt\",\n     \"--post-hook\", \"/config.py\"\n ]\n@@ -26,6 +27,7 @@\n     \"--preferred-challenges\", \"http\", \"--http-01-port\", \"8008\",\n     \"--keep-until-expiring\",\n     \"--key-type\", \"ecdsa\",\n+    \"--renew-with-new-domains\",\n     \"--config-dir\", \"/certs/letsencrypt\",\n     \"--post-hook\", \"/config.py\"\n ]\n", "issue": "Letsencrypt Force Renewal\nIs there a limit on the Subject Alt Name entries?\r\n\r\nI have updated my /mailu/mailu.env \"HOSTNAMES\" variable, but when I restart Mailu it doesn't update the Subject Alt Names on the mailu cert.\r\n\r\nPreviously it has worked, so I am guessing that I need to force Letsencrypt to refresh as it isnt within the renewal window. But there is no guidance for the new letsencrypt certbot.\r\n\r\nI am using the latest Mailu version (1.7) and this is the command I am using to restart mailu '/mailu/docker-compose -p mailu up -d'\nLetsencrypt Force Renewal\nIs there a limit on the Subject Alt Name entries?\r\n\r\nI have updated my /mailu/mailu.env \"HOSTNAMES\" variable, but when I restart Mailu it doesn't update the Subject Alt Names on the mailu cert.\r\n\r\nPreviously it has worked, so I am guessing that I need to force Letsencrypt to refresh as it isnt within the renewal window. But there is no guidance for the new letsencrypt certbot.\r\n\r\nI am using the latest Mailu version (1.7) and this is the command I am using to restart mailu '/mailu/docker-compose -p mailu up -d'\n", "before_files": [{"content": "#!/usr/bin/python3\n\nimport os\nimport time\nimport subprocess\n\ncommand = [\n    \"certbot\",\n    \"-n\", \"--agree-tos\", # non-interactive\n    \"-d\", os.environ[\"HOSTNAMES\"],\n    \"-m\", \"{}@{}\".format(os.environ[\"POSTMASTER\"], os.environ[\"DOMAIN\"]),\n    \"certonly\", \"--standalone\",\n    \"--cert-name\", \"mailu\",\n    \"--preferred-challenges\", \"http\", \"--http-01-port\", \"8008\",\n    \"--keep-until-expiring\",\n    \"--config-dir\", \"/certs/letsencrypt\",\n    \"--post-hook\", \"/config.py\"\n]\ncommand2 = [\n    \"certbot\",\n    \"-n\", \"--agree-tos\", # non-interactive\n    \"-d\", os.environ[\"HOSTNAMES\"],\n    \"-m\", \"{}@{}\".format(os.environ[\"POSTMASTER\"], os.environ[\"DOMAIN\"]),\n    \"certonly\", \"--standalone\",\n    \"--cert-name\", \"mailu-ecdsa\",\n    \"--preferred-challenges\", \"http\", \"--http-01-port\", \"8008\",\n    \"--keep-until-expiring\",\n    \"--key-type\", \"ecdsa\",\n    \"--config-dir\", \"/certs/letsencrypt\",\n    \"--post-hook\", \"/config.py\"\n]\n\ndef format_for_nginx(fullchain, output):\n    \"\"\" We may want to strip ISRG Root X1 out\n    \"\"\"\n    certs = []\n    with open(fullchain, 'r') as pem:\n        cert = ''\n        for line in pem:\n            cert += line\n            if '-----END CERTIFICATE-----' in line:\n                certs += [cert]\n                cert = ''\n    with open(output, 'w') as pem:\n        for cert in certs[:-1] if len(certs)>2 and os.getenv('LETSENCRYPT_SHORTCHAIN', default=\"False\") else certs:\n            pem.write(cert)\n\n# Wait for nginx to start\ntime.sleep(5)\n\n# Run certbot every day\nwhile True:\n    subprocess.call(command)\n    format_for_nginx('/certs/letsencrypt/live/mailu/fullchain.pem', '/certs/letsencrypt/live/mailu/nginx-chain.pem')\n    subprocess.call(command2)\n    format_for_nginx('/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem', '/certs/letsencrypt/live/mailu-ecdsa/nginx-chain.pem')\n    time.sleep(86400)\n", "path": "core/nginx/letsencrypt.py"}], "after_files": [{"content": "#!/usr/bin/python3\n\nimport os\nimport time\nimport subprocess\n\ncommand = [\n    \"certbot\",\n    \"-n\", \"--agree-tos\", # non-interactive\n    \"-d\", os.environ[\"HOSTNAMES\"],\n    \"-m\", \"{}@{}\".format(os.environ[\"POSTMASTER\"], os.environ[\"DOMAIN\"]),\n    \"certonly\", \"--standalone\",\n    \"--cert-name\", \"mailu\",\n    \"--preferred-challenges\", \"http\", \"--http-01-port\", \"8008\",\n    \"--keep-until-expiring\",\n    \"--renew-with-new-domains\",\n    \"--config-dir\", \"/certs/letsencrypt\",\n    \"--post-hook\", \"/config.py\"\n]\ncommand2 = [\n    \"certbot\",\n    \"-n\", \"--agree-tos\", # non-interactive\n    \"-d\", os.environ[\"HOSTNAMES\"],\n    \"-m\", \"{}@{}\".format(os.environ[\"POSTMASTER\"], os.environ[\"DOMAIN\"]),\n    \"certonly\", \"--standalone\",\n    \"--cert-name\", \"mailu-ecdsa\",\n    \"--preferred-challenges\", \"http\", \"--http-01-port\", \"8008\",\n    \"--keep-until-expiring\",\n    \"--key-type\", \"ecdsa\",\n    \"--renew-with-new-domains\",\n    \"--config-dir\", \"/certs/letsencrypt\",\n    \"--post-hook\", \"/config.py\"\n]\n\ndef format_for_nginx(fullchain, output):\n    \"\"\" We may want to strip ISRG Root X1 out\n    \"\"\"\n    certs = []\n    with open(fullchain, 'r') as pem:\n        cert = ''\n        for line in pem:\n            cert += line\n            if '-----END CERTIFICATE-----' in line:\n                certs += [cert]\n                cert = ''\n    with open(output, 'w') as pem:\n        for cert in certs[:-1] if len(certs)>2 and os.getenv('LETSENCRYPT_SHORTCHAIN', default=\"False\") else certs:\n            pem.write(cert)\n\n# Wait for nginx to start\ntime.sleep(5)\n\n# Run certbot every day\nwhile True:\n    subprocess.call(command)\n    format_for_nginx('/certs/letsencrypt/live/mailu/fullchain.pem', '/certs/letsencrypt/live/mailu/nginx-chain.pem')\n    subprocess.call(command2)\n    format_for_nginx('/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem', '/certs/letsencrypt/live/mailu-ecdsa/nginx-chain.pem')\n    time.sleep(86400)\n", "path": "core/nginx/letsencrypt.py"}]}