fix: replace staging certificate on production switch

certbot/renew.sh

@@ -6,6 +6,7 @@ email="${LETSENCRYPT_EMAIL:-}"
 staging="${LETSENCRYPT_STAGING:-1}"
 renew_interval="${LETSENCRYPT_RENEW_INTERVAL_SECONDS:-43200}"
 retry_interval="${LETSENCRYPT_RETRY_SECONDS:-300}"
+renewal_config="/etc/letsencrypt/renewal/${domain}.conf"
 
 case "$domain" in "" | *[!A-Za-z0-9.-]* | .* | *. | *..*) echo "Invalid LETSENCRYPT_DOMAIN." >&2; exit 1 ;; esac
 [ -n "$email" ] || { echo "LETSENCRYPT_EMAIL is required when Let's Encrypt is enabled." >&2; exit 1; }
@@ -17,6 +18,11 @@ staging_argument=""
 [ "$staging" = 0 ] || staging_argument="--staging"
 trap 'exit 0' TERM INT
 
+if [ "$staging" = 0 ] && [ -f "$renewal_config" ] && grep -qi 'acme-staging' "$renewal_config"; then
+    echo "Removing existing Let's Encrypt staging certificate for ${domain} before requesting a production certificate."
+    certbot delete --cert-name "$domain" --non-interactive
+fi
+
 while :; do
     if certbot certonly --webroot --webroot-path /var/www/certbot --preferred-challenges http \
         --cert-name "$domain" --domain "$domain" --email "$email" --agree-tos --non-interactive \