Maximum (and minimum) certificate lifetimes?

[eva2000]

@jcjones

I'm told right now the idea is regenerate by default -- but there should be a config parameter to change to re-using the existing CSR/private key. Clearly that's what you and I want to turn on.

Having a backup key is still extremely critical for compromise recovery, so it's still something that should have great care taken in implementation.

that's indeed best

what config paramter is for re-using existing CSR or existing private key ?