1) csr file in older backups got corrupt 2) new key results in a new cert request in LE (for rate limits)