How does Let's Encrypt create the private key?

[rugk]

I think I should mention another thing here, because it's clearly important to know if you want to answer the question how the LE client generates this cert:

The LE client regenerates the key pair every time it renewals the certificate.

@jcjones

I asked in #letsencrypt this morning whether the letsencrypt-renewer script would default to regenerating the private key each time, or keep it and re-submit the prior CSR. I'm told right now the idea is regenerate by default -- but there should be a config parameter to change to re-using the existing CSR/private key.

That's especially important to know if you want to use HPKP.