Fix #3531

core/nginx/letsencrypt.py

@@ -20,6 +20,7 @@ command = [
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
     "--allow-subset-of-names",
+    "--key-type", "rsa",
     "--renew-with-new-domains",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"

towncrier/newsfragments/3531.bugfix

@@ -0,0 +1 @@
+Ensure we have both RSA and ECDSA certs when using letsencrypt