Just handholding a renewal with globalsign I generate the new key on the server as part of the csr creation process. I run it on the server itself so the key n

Just handholding a renewal with globalsign I generate the new key on the server as part of the csr creation process. I run it on the server itself so the key never leaves the server's internal storage. CSR gets sent off to globalsign (via a third party because #largeCompany), then a couple of days later I get the certificate back and apply to the server Would love to use ACME instead, and store the key in memory (ramdrive etc), but these are the downsides of working for a company less agile than an oil-tanker