If you run
sudo certbot -d example.org --standalone certonly
Certbot will obtain a certificate using a 2048 bit RSA key.
If you then run
sudo certbot -d example.org --standalone certonly --force-renewal --rsa-key-size 4096 --reuse-key
the current 2048 bit RSA key is reused in the new certificate and the resulting renewal configuration file contains the following renewal parameters
reuse_key = True
rsa_key_size = 4096
I don't think this is the correct behavior. We had a brief conversation about this in Mattermost, where most people thought erroring out was the correct behavior.
This probably seems right, however, I then think we need a way to specify that a new key should be created and that key should be used for subsequent renewals. Peng suggested maybe using a separate flag for this?
I think we should fix this, however, I think this is technically a breaking change and should be done a little cautiously.
If you run
Certbot will obtain a certificate using a 2048 bit RSA key.
If you then run
the current 2048 bit RSA key is reused in the new certificate and the resulting renewal configuration file contains the following renewal parameters
I don't think this is the correct behavior. We had a brief conversation about this in Mattermost, where most people thought erroring out was the correct behavior.
This probably seems right, however, I then think we need a way to specify that a new key should be created and that key should be used for subsequent renewals. Peng suggested maybe using a separate flag for this?
I think we should fix this, however, I think this is technically a breaking change and should be done a little cautiously.