Scenario

I start with generating a single cert for "example.com, www.example.com, test.example.com", this is stored in /etc/letsencrypt/archive/example.com

Later I generate a new cert with "example.com, www.example.com"
This will be stored in /etc/letsencrypt/archive/example.com-0001

Problems

At this stage it is unclear whether the user intended to remove test.example.com or to generate a new cert.

The risks are that one might not notice the suffix and assume that the new certs are in the original location.
I'm not suggesting silently replacing the cert in the original location.

The location of the generated certs should be known before running the client.

Suggestion

With this issue I suggest removal of the automatic suffix generation.

The algorithm that triggers the use of prefix should still be in use but once triggered I suggest the following approach.

When triggered an error will occur.
The error message will instruct that one of the following approaches is required.

1. Indicate that you want to modify the domains in the current cert. This feature is suggested in Allow removing SAN from multidomain certificate when renewing #2071
2. Choose a new alias for the storage using an option like --alias

With option 2 the use of --alias example2 would store the certs in /etc/letsencrypt/archive/example2

These two options can work independently and combined.

Examples

If your intention was to remove test.example.com then you use 1

If you intention was to generate another different cert then use 2

If you want to further modify the domain list for the cert in the new location you must use both 1 and 2.