From 8b2301f3a4123e55c14abf308233815ce16f8db7 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Tue, 7 Jul 2026 17:53:48 +0100
Subject: [PATCH] fix: request individual certs per domain instead of SAN cert

---
 tools/nextwks-tool/main.go | 60 +++++++++++++++++---------------------
 1 file changed, 27 insertions(+), 33 deletions(-)

diff --git a/tools/nextwks-tool/main.go b/tools/nextwks-tool/main.go
index 67cde91..dedff1c 100644
--- a/tools/nextwks-tool/main.go
+++ b/tools/nextwks-tool/main.go
@@ -163,44 +163,38 @@ func obtainCertsLego(domains []string, email, backupDir, legoDir, legoPath strin
 		return fmt.Errorf("creating lego dir: %w", err)
 	}
 
-	// Build lego args (v5+: flags go after the command, use = syntax)
-	args := []string{"run",
-		"--http",
-		"--http.address=:80",
-		"--path", legoDir,
-		"--accept-tos",
-		"-m", email,
-	}
-	for _, d := range domains {
-		args = append(args, "-d", d)
-	}
-
-	cmd := exec.Command(legoPath, args...)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	log.Printf("  Running: %s %s", legoPath, strings.Join(args, " "))
-
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("lego run failed: %w", err)
-	}
-
-	// Copy certificates from lego output to backup
-	// Lego issues a SAN cert (single cert for all domains) named after the first domain
 	certDir := filepath.Join(legoDir, "certificates")
-	firstDomain := domains[0]
-	crtSrc := filepath.Join(certDir, firstDomain+".crt")
-	keySrc := filepath.Join(certDir, firstDomain+".key")
-
-	if !fileExists(crtSrc) || !fileExists(keySrc) {
-		return fmt.Errorf("lego did not produce expected cert files in %s", certDir)
-	}
 
 	for _, domain := range domains {
+		log.Printf("  Requesting cert for %s...", domain)
+		args := []string{"run",
+			"--http",
+			"--http.address=:80",
+			"--path", legoDir,
+			"--accept-tos",
+			"-m", email,
+			"-d", domain,
+		}
+
+		cmd := exec.Command(legoPath, args...)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		if err := cmd.Run(); err != nil {
+			log.Printf("  [WARN] lego failed for %s: %v", domain, err)
+			continue
+		}
+
+		// Copy cert to per-domain backup
+		crtSrc := filepath.Join(certDir, domain+".crt")
+		keySrc := filepath.Join(certDir, domain+".key")
 		domainDir := filepath.Join(backupDir, domain)
 		os.MkdirAll(domainDir, 0755)
-		copyFile(crtSrc, filepath.Join(domainDir, "fullchain.pem"))
-		copyFile(keySrc, filepath.Join(domainDir, "privkey.pem"))
-		log.Printf("[OK] Certificate obtained for %s", domain)
+
+		if fileExists(crtSrc) && fileExists(keySrc) {
+			copyFile(crtSrc, filepath.Join(domainDir, "fullchain.pem"))
+			copyFile(keySrc, filepath.Join(domainDir, "privkey.pem"))
+			log.Printf("[OK] Certificate obtained for %s", domain)
+		}
 	}
 	return nil
 }