Certbot certificates not working on Apache for multiple Flask sites sharing an IP address - python-3.x

Question

After two days of trying, I am completely at a loss with adding a certificate to my second domain. Here is my situation:
What works:
I have a dynamic site (domain1 / site1) hosted on a Digital Ocean droplet running Ubuntu. It is served using Apache and uses the Flask microframework. Everything works correctly, and I was able to install a Let's Encrypt certificate successfully using certbot.
I have added a second dynamic site (domain2 / site2) to the same droplet, sharing the single IP across the two domains/sites. I was able to get this working by following this answer: hosting multiple Flask apps for unique domains. Now I can:
(1) visit site1 via domain1 over HTTPS like I always could
(2) visit site2 via domain2 over HTTP.
What doesn't:
The problem comes in when I try to add a new Let's Encrypt certificate to site2/domain2. The tutorial at Digital Ocean and the certbot documentation suggest all I need to do is run certbot again with the new domain. A new certificate is created, but best case scenario, site1 becomes a "potential security risk" and site2 is still insecure.
Below are the contents of /etc/apache2/sites-available/ files BEFORE I attempt to install the second certificate.
000-default.conf
<VirtualHost *:80>
<Directory /var/www/FlaskApp>
Options +ExecCGI
DirectoryIndex index.py
</Directory>
AddHandler cgi-script .py
ServerAdmin webmaster#localhost
DocumentRoot /var/www/FlaskApp
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
FlaskApp.conf
<VirtualHost *:80>
ServerName www.audiologysource.com
ServerAlias audiologysource.com
#ServerName 157.245.135.241
ServerAdmin admin#mywebsite.com
WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
<Directory /var/www/FlaskApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/FlaskApp/FlaskApp/static
<Directory /var/www/FlaskApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =audiologysource.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
<VirtualHost *:80>
ServerName www.travismmoore.com
ServerAlias travismmoore.com
ServerAdmin youemail#email.com
WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.wsgi
<Directory /var/www/PersonalSiteApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/PersonalSiteApp/FlaskApp/static
<Directory /var/www/PersonalSiteApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
FlaskApp-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName www.audiologysource.com
ServerAlias audiologysource.com
#ServerName 157.245.135.241
ServerAdmin admin#mywebsite.com
WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
<Directory /var/www/FlaskApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/FlaskApp/FlaskApp/static
<Directory /var/www/FlaskApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/audiologysource.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/audiologysource.com/privkey.pem
</VirtualHost>
</IfModule>
My /var/www directory is organized like this:
\var\www
|
└─── FlaskApp
| | flaskapp.wsgi
| |
| └─── FlaskApp
| | __init__.py
| |
| └─── static
| └─── templates
| | home.html
| |
| └─── venv
|
└─── PersonalSiteApp #same as FlaskApp
| flaskapp.wsgi
|
└─── FlaskApp
| __init__.py
|
└─── static
└─── templates
| home.html
|
└─── venv
Here are the same files AFTER I run certbot and reload Apache:
sudo certbot --apache -d travismmoore.com -d www.travismmoore.com
000-default.conf: unchanged
FlaskApp.conf
<VirtualHost *:80>
ServerName www.audiologysource.com
ServerAlias audiologysource.com
#ServerName 157.245.135.241
ServerAdmin admin#mywebsite.com
WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
<Directory /var/www/FlaskApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/FlaskApp/FlaskApp/static
<Directory /var/www/FlaskApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =audiologysource.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanen$
</VirtualHost>
<VirtualHost *:80>
ServerName www.travismmoore.com
ServerAlias travismmoore.com
ServerAdmin youemail#email.com
WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.w$
<Directory /var/www/PersonalSiteApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/PersonalSiteApp/FlaskApp/static
<Directory /var/www/PersonalSiteApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =www.audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =travismmoore.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanen$
</VirtualHost>
FlaskApp-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName www.audiologysource.com
ServerAlias audiologysource.com
#ServerName 157.245.135.241
ServerAdmin admin#mywebsite.com
WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
<Directory /var/www/FlaskApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/FlaskApp/FlaskApp/static
<Directory /var/www/FlaskApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
Include /etc/letsencrypt/options-ssl-apache.conf
ServerAlias travismmoore.com
SSLCertificateFile /etc/letsencrypt/live/travismmoore.com/fullchain.p$
SSLCertificateKeyFile /etc/letsencrypt/live/travismmoore.com/privkey.$
</VirtualHost>
</IfModule>
<IfModule mod_ssl.c>
<VirtualHost *:80>
ServerName www.travismmoore.com
ServerAlias travismmoore.com
ServerAdmin youemail#email.com
WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.w$
<Directory /var/www/PersonalSiteApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/PersonalSiteApp/FlaskApp/static
<Directory /var/www/PersonalSiteApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
</IfModule>
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName www.travismmoore.com
ServerAlias travismmoore.com
ServerAdmin youemail#email.com
WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.w$
<Directory /var/www/PersonalSiteApp/FlaskApp/>
Order allow,deny
Allow from all
</Directory>
Alias /static /var/www/PersonalSiteApp/FlaskApp/static
<Directory /var/www/PersonalSiteApp/FlaskApp/static/>
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLCertificateFile /etc/letsencrypt/live/travismmoore.com/fullchain.p$
SSLCertificateKeyFile /etc/letsencrypt/live/travismmoore.com/privkey.$
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
Any help is greatly appreciated!

Answer 1

I thought I'd update this with what ended up working for those who run into the same issue. I ended up having to remove all the certificates, then add them one at a time manually, using:
sudo certbot --manual certonly -d domain_1.com -d www.domain_1.com
sudo certbot --manual certonly -d domain_2.com -d www.domain_2.com