Create a new private key during renewal the certificate

[Peter-A-Tech]

How can I set that during the renewal of the certificate I want to create a new private key instead of using the existing one? Thanks.

[fabriziosalmi]

Good news: that is already what CertMate does. There is nothing to configure — every renewal generates a fresh private key.

The reason is certbot's own default. From certbot --help all:

--reuse-key    When renewing, use the same private key as the existing
               certificate. (default: False)
--no-reuse-key ... Not reusing private keys is the default behavior of Certbot.

CertMate never passes --reuse-key on any code path, so the default stands: each renewal produces a new keypair, and the old key is retired with the old certificate.

Verifying it on your instance

Compare the public-key fingerprint before and after a renewal — it will differ:

openssl pkey -in privkey.pem -pubout -outform DER | openssl sha256

Or read it off the certificate itself, which is easier if you only keep the cert:

openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -pubout -outform DER | openssl sha256

Run it, force a renewal, run it again. A changed digest means a new key. (Comparing the certificate serial only tells you the cert was reissued, not that the key changed — so use the public key, not the serial.)

The inverse, in case that is what you actually wanted

Some setups need the opposite — HPKP-style pinning, or an HSM-backed key that must stay put. CertMate has no switch for that today, because certbot's default is the safer behaviour and we did not want to surface a footgun. If you have a case that needs key reuse, open an issue describing it and it can be considered.

One related thing worth knowing: if you want to change the key type or size (say RSA 2048 to ECDSA P-256), that is not a renewal but a reissue — the key options are on the create/reissue path, since a plain renewal deliberately keeps the existing certificate's key shape.

[Peter-A-Tech]

Hi Fabrizio,

Thank you very much for your response and the detailed explanation. This is a really excellent feature of certmate.

Regards,

Peter

[fabriziosalmi]

I am really sorry for the long time occurred to catch this, lesson learned and weekly sweep check armed now. TY Peter.