>Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. Well, they can generate certs for

>Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case. >I have yet to hear any useful reason to rotate the key. http://security.stackexchange.com/questions/85963/what-is-the-purpose-of-frequently-rotating-tls-certificates-without-changing-und http://security.stackexchange.com/questions/85963/what-is-th... Basically limiting damage in case of a compromise.