# What does privateKey.rotationPolicy: Always do on a Certificate?

cert-manager, Hard (Expert), Security. https://k8wiz.com/uquiz/what-does-privatekeyrotationpolicy-always-do-on-a-certificate

- A. The private key is rotated every 24 hours, even between renewals
- B. The key is only replaced when someone deletes the Secret
- C. A new private key is generated on every issuance and renewal
- D. The issuer rotates its own CA signing key on each renewal

**Answer:** A new private key is generated on every issuance and renewal

**Explanation:** With Always, each issuance creates a fresh key, so a leaked key stops being useful after the next renewal. With Never, cert-manager reuses the key already stored in the Secret. Always has been the default since cert-manager v1.18. Before that the default was Never.