Private key hygiene for certificates

Private key hygiene means treating the private key as a secret that never leaves a controlled place. You keep it mode 0640, out of git, out of tickets, and out of anything a browser can fetch. If the key is copied or exposed, you reissue the certificate with a new key rather than hoping a deleted email or paste undoes the leak.

When you should reissue

Reissue with a new private key and a new certificate whenever the key left the server in a way you did not fully control. That includes git history, a public paste, a shared Drive folder, an ex-contractor laptop, or a file such as wp-content/uploads/cert.pem from a backup plugin. Revoke at the CA if that step is easy for your issuer, but the fix that matters is a fresh key and a fresh leaf.

Installing the same certificate on a CDN you control is a copy you chose. You still protect that copy, restrict who can see it, and remove it when you leave the CDN. Copying a cert to a CDN always copies the private key with it, so treat that path with the same care you give the origin server.

Default handling on cPanel

Let AutoSSL keep the private key on the server. You do not need to download keys for routine checks, and you should not store them in a zip under public_html. JetBackup already keeps a copy on a path that is not a URL. If you buy an OV certificate, generate the CSR in cPanel SSL/TLS so the key never sits on your laptop.

When a CDN requires the key, upload over TLS, limit who can view it, and rotate when staff changes. Keep the file 0640 and owned by the account, not world-readable. A key that lived in a support ticket is burned even if the ticket is marked private. Treat private keys like database passwords: secrets stay off chat, email, and shared folders.

Reissue steps that actually clear the leak

Create a new private key and CSR, obtain a new leaf, install the full chain, and remove the old certificate from the vhost and from any CDN. If AutoSSL owns the hostname, delete the leaked certificate material and run AutoSSL so it mints a fresh key. You can keep the old leaf in a private incident folder for records, but never under public_html.

How TLS works does not change because you paid for the cert. The leaf is public; the private key is not. Mixing them in one Slack paste is how a routine install becomes an incident. See How TLS certificates work if you need the public side of this picture.