Since Certbot 2.0 new certificates use ECDSA keys by default: smaller and faster than RSA with the same security. Older certificates may still be RSA. Here is how to check which you have and switch.
Full guide: Full Let's Encrypt guide
1. Check the key type
Certbot shows it per certificate.
sudo certbot certificates | grep -E 'Certificate Name|Key Type'2. Or check the live certificate
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -text | grep 'Public Key Algorithm'3. Switch to ECDSA
Renews now with a new ECDSA key and remembers the choice for future renewals.
sudo certbot renew --cert-name example.com --key-type ecdsa --force-renewal4. Need RSA for an old client?
Some very old devices only support RSA.
sudo certbot renew --cert-name example.com --key-type rsa --rsa-key-size 4096 --force-renewal5. Verify
Reload the web server and check again.
sudo systemctl reload nginx
sudo certbot certificates | grep 'Key Type'6. Troubleshooting
Certbot asks whether to replace the key type: answer yes, or add –key-type explicitly. Avoid repeated –force-renewal runs; Let's Encrypt limits duplicate certificates per week.
FAQ
Is ECDSA as secure as RSA?
Yes. A P-256 ECDSA key gives security comparable to RSA 3072 with much smaller keys and faster handshakes.
Will ECDSA break any visitors?
Every current browser and OS supports it. Only very old clients may need RSA.
Further reading: Certbot user guide