Add the new CNAMES to the list of domains for certbot. No wonder it did work magicly...

host_vars/proxy-ovh.adm.auro.re.yml

@@ -2,10 +2,13 @@
 certbot:
   domains:
     - auro.re
+    - chat.auro.re  # cname to riot.auro.re
     - codimd.auro.re
     - grafana.auro.re
+    - hedgedoc.auro.re  # cname to codimd.auro.re
     - pad.auro.re
     - passbolt.auro.re
+    - paste.auro.re  # cname to privatebin.auro.re
     - phabricator.auro.re
     - privatebin.auro.re
     - riot.auro.re
@@ -13,7 +16,7 @@ certbot:
     - status.auro.re
     - wiki.auro.re
     - www.auro.re
-    - zero.auro.re
+    - zero.auro.re  # cname to privatebin.auro.re
   mail: tech.aurore@lists.crans.org
   certname: auro.re