I have web-server (nginx) with LE-certificate up & running, but now I'd like to switch to using the same private key when renewing certificate. Certbot has "--reuse-key" option, so this should be probably used when renewing certificate. I checked /etc/cron.d/certbot expecting to find there command …

Unless you're using DANE (should you?), why would you reuse the keypair? (That setting is in cli.ini and in each renewal.conf for each certificate.)

You do know that no browser actually supports it and it's only useful for server-to-server smtp over tls, right?

AFAIK, there is dane/dnssec validator addon for FF, but I want to use it mainly for mail-server. It is running on the same host as web-server, so I'd like to use the same certificate...

You can use the same certificate. Or you can use different ones. The hostname is not the same, usually. (It's the content of the MX record on @) So you can have a zone that looks like this @ in A 10.10.10.10 @ in MX 5 mail www in A 10.10.10.10 mail in A 10.10.10.10 mail in TLSA "etc etc etc" And…

Be aware that reusing certificates across multiple services (protocols) can make you vulnerable to ALPACA-style attacks: https://alpaca-attack.com/ The industry best-practice is to use different hostnames wherever you can (that doesn't mean that you have to use distinct machines for services, just …

@rg305 's suggestion is correct, /etc/letsencrypt/cli.ini parameters appear exactly as they do on the command line. The per-certificate renewal parameters in /etc/letsencrypt/renewal/*.conf feature different syntax and options. The confusion is easy because there is an overlap. A certificate can hav…

Thanks for the correction, I can't remember the cli.ini conventions I guess :roll_eyes: [image] _az: but this is different to globally setting --reuse-key in cli.ini . I am pretty sure though that -- shouldn't be used in cli.ini?

Certificate renewal: using the same private key

Help

rg305 March 11, 2022, 6:56pm 2

Hi @Jarry and welcome to the LE community forum

I think it can be accomplished by putting the setting in the "/etc/letsencrypt/cli.ini" file.

I'm guessing here, add:
reuse-key = True

How to set a domain to reuse a key?

Topic		Replies	Views
Configure renewal to use existing key without editing (fragile) systemd configuration file Help	2	1552	February 1, 2020
How to set a domain to reuse a key? Help	1	493	February 6, 2024
Config file overwritten, reuse-key parameter removed & ignored Help	5	1228	August 13, 2019
Certbot `--reuse-key` flag does not preserve public key Help	9	4911	September 1, 2019
Prevent public key changin when renewing SSL certs Help	5	4721	January 12, 2017

Certificate renewal: using the same private key

Related topics