Use existing private key?

[mnordhoff]

@AliceWonderMiscreati

A) Normally I prefer ecdsa certs and it seems let’s encrypt doesn’t do that (yet)

Let's Encrypt can issue ECDSA (P-256 or P-384) certificates, but the current intermediates and roots are RSA. ECDSA intermediates and roots are on the to-do list.

@AliceWonderMiscreati

I’ll use 2048 (or 3072 if allowed) RSA for A - I use 3072 self-signed for mail servers.

3072 is allowed. I think the maximum is 4096? 2048-bit RSA is not likely to get broken any time soon, though.

@AliceWonderMiscreati

Is there an option to certbot to specify the private key to used?

Yes. Well, technically, there's an option to specify the CSR to use. However, Certbot current'y doesn't support automatic renewal with custom CSRs, so the usability is worse, and you may be happier with a different client.

Related thread:

How to recreate let's encrypt certificate with public key from the past?

S…