You should always generate a new CSR and key when renewing a certificate. Also, it is recommended to renew an SSL certificate before the expiration date. Otherwise, a new certificate purchase will be ...

If you're serving up websites from your Linux data center and using NGINX, you need to enable SSL for a more secure solution.

Next, StartSSL will generate the private key needed for the client certificate it provides to you for authentication. There's no good reason to choose anything but 2048 (High Grade) as the option.