> It should also ideally be a /renewal/ of the old one, and not an entirely new private key generated each time as well sure? A new key provides quite a bit of

> It should also ideally be a /renewal/ of the old one, and not an entirely new private key generated each time as well sure? A new key provides quite a bit of security benefits because even when the key got loose without you noticing, three months later, it won't be usable any more when the new cert is made for a new key.