add --no-reuse-key (#9029)

Fixes #9002.

certbot-ci/certbot_integration_tests/certbot_tests/test_main.py

@@ -433,6 +433,21 @@ def test_reuse_key(context):
         privkey3 = file.read()
     assert privkey2 != privkey3
 
+    context.certbot(['--cert-name', certname, '--domains', certname,
+                     '--reuse-key','--force-renewal'])
+    context.certbot(['renew', '--cert-name', certname, '--no-reuse-key', '--force-renewal'])
+    context.certbot(['renew', '--cert-name', certname, '--force-renewal'])
+
+    with open(join(context.config_dir, 'archive/{0}/privkey4.pem').format(certname), 'r') as file:
+        privkey4 = file.read()
+    with open(join(context.config_dir, 'archive/{0}/privkey5.pem').format(certname), 'r') as file:
+        privkey5 = file.read()
+    with open(join(context.config_dir, 'archive/{0}/privkey6.pem').format(certname), 'r') as file:
+        privkey6 = file.read()
+    assert privkey3 == privkey4
+    assert privkey4 != privkey5
+    assert privkey5 != privkey6
+
     with open(join(context.config_dir, 'archive/{0}/cert1.pem').format(certname), 'r') as file:
         cert1 = file.read()
     with open(join(context.config_dir, 'archive/{0}/cert2.pem').format(certname), 'r') as file:

certbot/CHANGELOG.md

@@ -6,7 +6,8 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 ### Added
 
-*
+* Added `--no-reuse-key`. This remains the default behavior, but the flag may be
+  useful to unset the `--reuse-key` option on existing certificates.
 
 ### Changed
 

certbot/certbot/_internal/cli/__init__.py

@@ -212,6 +212,13 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False):
         action="store_true", default=flag_default("reuse_key"),
         help="When renewing, use the same private key as the existing "
              "certificate.")
+    helpful.add(
+        "automation", "--no-reuse-key", dest="reuse_key",
+        action="store_false", default=flag_default("reuse_key"),
+        help="When renewing, do not use the same private key as the existing "
+             "certificate. Not reusing private keys is the default behavior of "
+             "Certbot. This option may be used to unset --reuse-key on an "
+             "existing certificate.")
 
     helpful.add(
         ["automation", "renew", "certonly"],