fix: request individual certs per domain instead of SAN cert

tools/nextwks-tool/main.go

@@ -163,45 +163,39 @@ func obtainCertsLego(domains []string, email, backupDir, legoDir, legoPath strin
 		return fmt.Errorf("creating lego dir: %w", err)
 	}
 
-	// Build lego args (v5+: flags go after the command, use = syntax)
+	certDir := filepath.Join(legoDir, "certificates")
+
+	for _, domain := range domains {
+		log.Printf("  Requesting cert for %s...", domain)
 		args := []string{"run",
 			"--http",
 			"--http.address=:80",
 			"--path", legoDir,
 			"--accept-tos",
 			"-m", email,
-	}
+			"-d", domain,
-	for _, d := range domains {
-		args = append(args, "-d", d)
 		}
 
 		cmd := exec.Command(legoPath, args...)
 		cmd.Stdout = os.Stdout
 		cmd.Stderr = os.Stderr
-	log.Printf("  Running: %s %s", legoPath, strings.Join(args, " "))
-
 		if err := cmd.Run(); err != nil {
-		return fmt.Errorf("lego run failed: %w", err)
+			log.Printf("  [WARN] lego failed for %s: %v", domain, err)
+			continue
 		}
 
-	// Copy certificates from lego output to backup
+		// Copy cert to per-domain backup
-	// Lego issues a SAN cert (single cert for all domains) named after the first domain
+		crtSrc := filepath.Join(certDir, domain+".crt")
-	certDir := filepath.Join(legoDir, "certificates")
+		keySrc := filepath.Join(certDir, domain+".key")
-	firstDomain := domains[0]
-	crtSrc := filepath.Join(certDir, firstDomain+".crt")
-	keySrc := filepath.Join(certDir, firstDomain+".key")
-
-	if !fileExists(crtSrc) || !fileExists(keySrc) {
-		return fmt.Errorf("lego did not produce expected cert files in %s", certDir)
-	}
-
-	for _, domain := range domains {
 		domainDir := filepath.Join(backupDir, domain)
 		os.MkdirAll(domainDir, 0755)
+
+		if fileExists(crtSrc) && fileExists(keySrc) {
 			copyFile(crtSrc, filepath.Join(domainDir, "fullchain.pem"))
 			copyFile(keySrc, filepath.Join(domainDir, "privkey.pem"))
 			log.Printf("[OK] Certificate obtained for %s", domain)
 		}
+	}
 	return nil
 }