You should always generate a new CSR and key when renewing a certificate. Also, it is recommended to renew an SSL certificate before the expiration date. Otherwise, a new certificate purchase will be ...

If you're serving up websites from your Linux data center and using NGINX, you need to enable SSL for a more secure solution.

More concerning, as the private key on every SSL certificate shipped with CloudPanel is the same, it could allow threat actors to snoop on encrypted HTTPS traffic to CloudPanel servers.

Next, StartSSL will generate the private key needed for the client certificate it provides to you for authentication. There's no good reason to choose anything but 2048 (High Grade) as the option.