Question about reusing private keys as it relates to DANE for mail servers

[Legacy777]

Based on the information in the manual and the ‑‑reuse-privatekey switch I'd like to use that to support DANE configuration on my mail server.

The recommendation is to have two 3 1 1 entries, one for the current certificate and one for the future. In the documentation I've read about setting up DANE it's assumed that the next public key would be one incremental character or to pre-publish a key. I'm not sure how this would work with Let's Encrypt and Simple Acme. I can always just set a calendar reminder and rollover the private key once a year but curious what others are doing.

Thanks
Josh

[NotAFlightRisk]

With 3 1 1 and --reuse-privatekey, renewals don't change the hash, so the second record is only for a deliberate roll. simple-acme can't give you that next key in advance though - it only makes one when there's no cached key. To pre-publish, use the CSR source and bring your own key:

openssl req -new -newkey rsa:2048 -nodes -keyout next.key -out next.csr -subj "/CN=mail.example.com" -addext "subjectAltName=DNS:mail.example.com"
openssl pkey -in next.key -pubout -outform DER | openssl sha256

wacs --source csr --csrfile C:\dane\current.csr --pkfile C:\dane\current.key

The hex after the = is your next 3 1 1 record. After at least two TTLs, copy next.csr and next.key over the current pair in one go. The next scheduled run spots the changed CSR and gets a cert on the new key straight away, it doesnt wait untill it's due. Once that's live, drop the old record.

Checked on v2.4.0: the CSR is re-read every run and a changed one counts as a source change.

[Legacy777]

Thank you for the detailed reply!

I think I understand everything you shared, but will give it a try to make sure I can get it all sorted out.

Thank you again!!