HTTP Public Key Pinning (HPKP)

[rugk]

@jcjones

@rugk

The only bad thing is that occasional visitors (who only visit the site after 90 days) do not benefit from the security mechanism HPKP.

HPKP works off the SPKI (public key hash), not the certificate. That's why you can generate the hash from the private key file before you even generate a CSR. As long as you don't regenerate your site's private key, you don't need to do staggered key rollovers with 90 day limits, you can push that out to nicer, longer timeframes.

Yes, I'm aware of this. The part you quoted from my reply was intended for @My1 as a reply to his/her idea of automating this.
As I also describe later in the post you quoted it's of course possible to use the same HPKP hash longer than 90 days.

However I was not aware of the fact that the LE client regenerates the private key every time. That's very interesting (and quite important) to know, so thanks for mentioning this.