How to replace cert with a stronger one

[husky]

Hi!
I have a Debian Linux homeserver running behind my DSL router 24/7, accessible via DynDNS. Let's-Encrypt certs are maintained via acme.sh without any problems. But the setup details are not the reason why I write this;:

Now - I have an RSA 2048 key at the moment, Since recent recommendations advise to use at least RSA 3072 - how do I replace the existing keys with a bigger one? Just issuing a new cert via acme.sh and putting that into the usual place in the filesystem, reloading the services? Or do I have to take extra precautions, since HSTS and CAA are all in place? SSLlabs test gives my setup an A+rating, so I think it's pretty well set pat the moment.

Services affected are nginx, postfix, dovecot and some more.

Thanks for any advice!

[rg305]

Hi @husky, and welcome to the LE community forum

This isn't really a support site for the acme.sh client.
That said, the information was easily found online:
see: acme.sh/README.md at master · acmesh-official/acme.sh · GitHub
[look for the "keylength" paramater]

IMHO, you are probably better off using an ECDSA type cert.
[but you have to be sure all you clients are OK with that type]

[husky]

Hi!
Yes, I'm aware that this is not about acme.sh - my question is not about usage of the acme client of choice, but about what precautions and considerations I have to take to make sure I don't lock me out o my domain (HSTS, CAA, ...) oder run into other trouble in the course of changing the keylength.

[Osiris]

HSTS and CAA will not be affected by changing the keypair of a certificate. Most ACME clients will generate a new keypair for every renewal anyway.

Only with HTTP Public Key Pinning (HPKP) this could be an issue, but that technology is obsolete and isn't often used any longer.

[danb35]

Neither HSTS nor CAA pins to a particular key, type of key, or size of key--the only technology that would (and that's pretty well deprecated at this point) is HPKP. You're free to issue a new cert with the desired key type/size and, as long as you aren't using HPKP, you should be good to go.

Edit: Ninja'd

[9peppe]

Also DANE with TLSA "1 * *" or "3 * *"

[ghen]

@husky

Since recent recommendations advise to use at least RSA 3072

Do consider an ECDSA (P-256) certificate before dialing up your RSA keysize to 11.