Certbot seems to generate a new private key each time it requests certificates. This makes it very difficult to use SSL pinning with Certbot: ordinarily you would distribute the server (public) key with your application and use the (private) key to obtain the server’s certificate. If the server’s certificate changes every three months then you would also have to update your application every three months (and risk users being locked out entirely if they happened not to upgrade).

The only way to bring your own server key to Certbot seems to be to create your own CSR and pass this to Certbot using the --csr option. (In my understanding the key is “baked in” to the CSR in a way that makes it a suitable proxy for the private key.)

This has drawbacks, however. You have to get the CSR from somewhere but Certbot offers no relevant documentation. (I followed this documentation from letsencrypt-nosudo, another ACME client.) More significantly, when Certbot obtains the certificates from your CSR it doesn’t put them in /etc/letsencrypt but just in the current working directory. Part of the appeal of Certbot is that it usually puts certificates in a well-defined directory hierarchy; having symlinks to the latest versions in /etc/letsencrypt/live is also a boon for convenience. Neither of these is the case when you use your own CSR.

I am requesting that one of the following features be added to Certbot:

1. The ability to point Certbot to an existing server private key, presumably with a command-line flag. (This would be my preferred solution.)
2. Certificates that “came from” a user-provided CSR should be treated the same (i.e. placed in the same directories) as certificates that were obtained in the usual way.