Pros and cons of 90-day certificate lifetimes

HPKP works, as the name indicates, on the public key level, rather than pinning to a specific certificate. It is perfectly acceptable to reuse the same key across multiple renewals. certbot just happens to generate a new key for each renewal by default, as that's the best choice for anyone not using HPKP (which is the large majority of users). If you'd like to reuse the same key, you can do that using the --csr flag or with one of the other ACME clients. certbot will likely gain a flag to reuse the key during normal (i.e. no --csr) operations in a future release as well, making this even easier.

More details on HPKP and Let's Encrypt can be found here:

2 Likes