diff --git a/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb b/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb
index 3926a76dc33fa7adf0c6450eae15ff466d6b631f_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9yZXNvdXJjZXMvY2VydGlmaWNhdGUucmI=..f74d581596f2adeaa615ed4a3416ee906fdd0c92_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9yZXNvdXJjZXMvY2VydGlmaWNhdGUucmI= 100644
--- a/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb
+++ b/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb
@@ -22,6 +22,21 @@
   helper = LetsEncryptHelper.new(node)
   contact_info = helper.contact
 
+  staging_key = `/opt/gitlab/embedded/bin/openssl rsa -text -noout -in #{new_resource.key}-staging`
+  staging_key_size = staging_key.lines.grep(/Private.Key/i).first[/[0-9]* bit/].split.first.to_i
+
+  if new_resource.key_size.nil?
+    unless staging_key_size == node['acme']['key_size']
+      file "#{new_resource.key}-staging" do
+        action :delete
+      end
+    end
+  elsif staging_key_size != new_resource.key_size
+    file "#{new_resource.key}-staging" do
+      action :delete
+    end
+  end
+
   acme_certificate 'staging' do
     alt_names new_resource.alt_names unless new_resource.alt_names.empty?
     key_size new_resource.key_size unless new_resource.key_size.nil?
@@ -43,6 +58,21 @@
     end
   end
 
+  production_key = `/opt/gitlab/embedded/bin/openssl rsa -text -noout -in #{new_resource.key}`
+  production_key_size = production_key.lines.grep(/Private.Key/i).first[/[0-9]* bit/].split.first.to_i
+
+  if new_resource.key_size.nil?
+    unless production_key_size == node['acme']['key_size']
+      file "#{new_resource.key}" do
+        action :delete
+      end
+    end
+  elsif production_key_size != new_resource.key_size
+    file "#{new_resource.key}" do
+      action :delete
+    end
+  end
+
   acme_certificate 'production' do
     alt_names new_resource.alt_names unless new_resource.alt_names.empty?
     key_size new_resource.key_size unless new_resource.key_size.nil?