diff --git a/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb b/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb
index be8cbd4fd4e0b4711eced1a1c85d9e4acdcd5316_c3BlYy9jaGVmL2xldHNlbmNyeXB0L3Jlc291cmNlcy9sZXRzZW5jcnlwdF9jZXJ0aWZpY2F0ZV9zcGVjLnJi..650f0a15660f62ebefdc34dfaa6ef1e5bc860086_c3BlYy9jaGVmL2xldHNlbmNyeXB0L3Jlc291cmNlcy9sZXRzZW5jcnlwdF9jZXJ0aWZpY2F0ZV9zcGVjLnJi 100644
--- a/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb
+++ b/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb
@@ -44,6 +44,36 @@
       )
     end
 
+    context 'specifying a different key_size' do
+      before do
+        allow(File).to receive(:file?).and_call_original
+        allow(File).to receive(:file?).with('/etc/gitlab/ssl/fakehost.example.com.key').and_return(true)
+        allow(File).to receive(:read).with(anything).and_call_original
+        allow(File).to receive(:read).with('/etc/gitlab/ssl/fakehost.example.com.key').and_return(OpenSSL::PKey::RSA.new(2048))
+
+        stub_gitlab_rb(
+          external_url: 'https://fakehost.example.com',
+          letsencrypt: {
+            enable: true,
+            key_size: 3072
+          }
+        )
+      end
+
+      it 'deletes and recreates the SSL files' do
+        expect(chef_run).to delete_file('/etc/gitlab/ssl/fakehost.example.com.key')
+        expect(chef_run).to delete_file('/etc/gitlab/ssl/fakehost.example.com.crt')
+
+        expect(chef_run).to create_acme_certificate('production').with(
+          crt: '/etc/gitlab/ssl/fakehost.example.com.crt',
+          key: '/etc/gitlab/ssl/fakehost.example.com.key',
+          key_size: 3072,
+          wwwroot: '/var/opt/gitlab/nginx/www',
+          sensitive: true
+        )
+      end
+    end
+
     it 'reloads nginx' do
       prod_cert = chef_run.acme_certificate('production')
       expect(prod_cert).to notify('execute[reload nginx]').to(:run)