diff --git a/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb b/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb
index e1a17ef4c1d37f5ecfbc2cbee5b4c1e9d7c30903_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9yZXNvdXJjZXMvY2VydGlmaWNhdGUucmI=..715e27bc7a08791845d9f7c2b951aa64f79b85ea_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9yZXNvdXJjZXMvY2VydGlmaWNhdGUucmI= 100644
--- a/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb
+++ b/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb
@@ -22,6 +22,21 @@
   # they provide invalid data
   helper = LetsEncryptHelper.new(node)
   contact_info = helper.contact
+  target_key_size = new_resource.key_size || node['acme']['key_size']
+
+  if ::File.file?("#{new_resource.key}-staging")
+    staging_key = OpenSSL::PKey::RSA.new ::File.read "#{new_resource.key}-staging"
+    staging_key_size = staging_key.n.num_bits
+
+    if staging_key_size != target_key_size
+      file "#{new_resource.key}-staging" do
+        action :delete
+      end
+      file "#{new_resource.crt}-staging" do
+        action :delete
+      end
+    end
+  end
 
   acme_certificate 'staging' do
     alt_names new_resource.alt_names unless new_resource.alt_names.empty?
@@ -44,6 +59,20 @@
     end
   end
 
+  if ::File.file?(new_resource.key)
+    production_key = OpenSSL::PKey::RSA.new ::File.read new_resource.key
+    production_key_size = production_key.n.num_bits
+
+    if production_key_size != target_key_size
+      file new_resource.key do
+        action :delete
+      end
+      file new_resource.crt do
+        action :delete
+      end
+    end
+  end
+
   acme_certificate 'production' do
     alt_names new_resource.alt_names unless new_resource.alt_names.empty?
     key_size new_resource.key_size unless new_resource.key_size.nil?
diff --git a/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb b/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb
index e1a17ef4c1d37f5ecfbc2cbee5b4c1e9d7c30903_c3BlYy9jaGVmL2xldHNlbmNyeXB0L3Jlc291cmNlcy9sZXRzZW5jcnlwdF9jZXJ0aWZpY2F0ZV9zcGVjLnJi..715e27bc7a08791845d9f7c2b951aa64f79b85ea_c3BlYy9jaGVmL2xldHNlbmNyeXB0L3Jlc291cmNlcy9sZXRzZW5jcnlwdF9jZXJ0aWZpY2F0ZV9zcGVjLnJi 100644
--- a/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb
+++ b/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb
@@ -44,6 +44,36 @@
       )
     end
 
+    context 'specifying a different key_size' do
+      before do
+        allow(File).to receive(:file?).and_call_original
+        allow(File).to receive(:file?).with('/etc/gitlab/ssl/fakehost.example.com.key').and_return(true)
+        allow(File).to receive(:read).with(anything).and_call_original
+        allow(File).to receive(:read).with('/etc/gitlab/ssl/fakehost.example.com.key').and_return(OpenSSL::PKey::RSA.new(2048))
+
+        stub_gitlab_rb(
+          external_url: 'https://fakehost.example.com',
+          letsencrypt: {
+            enable: true,
+            key_size: 3072
+          }
+        )
+      end
+
+      it 'deletes and recreates the SSL files' do
+        expect(chef_run).to delete_file('/etc/gitlab/ssl/fakehost.example.com.key')
+        expect(chef_run).to delete_file('/etc/gitlab/ssl/fakehost.example.com.crt')
+
+        expect(chef_run).to create_acme_certificate('production').with(
+          crt: '/etc/gitlab/ssl/fakehost.example.com.crt',
+          key: '/etc/gitlab/ssl/fakehost.example.com.key',
+          key_size: 3072,
+          wwwroot: '/var/opt/gitlab/nginx/www',
+          sensitive: true
+        )
+      end
+    end
+
     it 'reloads nginx' do
       prod_cert = chef_run.acme_certificate('production')
       expect(prod_cert).to notify('execute[reload nginx]').to(:run)
@@ -72,6 +102,11 @@
   end
 
   context 'when NGINX is not running' do
+    before do
+      allow_any_instance_of(OmnibusHelper).to receive(:service_up?).and_return(false)
+      allow_any_instance_of(OmnibusHelper).to receive(:service_up?).with('nginx').and_return(false)
+    end
+
     it 'does not attempt to create a certificate' do
       expect(chef_run).not_to create_acme_certificate('staging')
       expect(chef_run).not_to create_acme_certificate('production')
diff --git a/spec/fixtures/cookbooks/acme/attributes/default.rb b/spec/fixtures/cookbooks/acme/attributes/default.rb
new file mode 100644
index 0000000000000000000000000000000000000000..715e27bc7a08791845d9f7c2b951aa64f79b85ea_c3BlYy9maXh0dXJlcy9jb29rYm9va3MvYWNtZS9hdHRyaWJ1dGVzL2RlZmF1bHQucmI=
--- /dev/null
+++ b/spec/fixtures/cookbooks/acme/attributes/default.rb
@@ -0,0 +1,1 @@
+default['acme']['key_size'] = 2048