The end users should ideally not be prompted when they see a certificate renewed by the same CA.  It should also ideally be a &#x2F;renewal&#x2F; of the old one, and not an entirely new private key generated each time as well.  Of course everything could be tuneable.<p>I believe these are sane defaults.<p>* Prompt on CA change? (Default Yes)
* Prompt on private key change? (Default No IF the cached certificate is on the old CA&#x27;s revocation list.)
* Prompt on CA renewal? (Default No)