<i>&gt; It should also ideally be a &#x2F;renewal&#x2F; of the old one, and not an entirely new private key generated each time as well</i><p>sure? A new key provides quite a bit of security benefits because even when the key got loose without you noticing, three months later, it won&#x27;t be usable any more when the new cert is made for a new key.