> While a 2048 bit key is normally considered to take tens of years to break [...]

FYI: You can renew your cert without changing the key, e.g. for mail servers and DANE/TLSA.

http://www.internetsociety.org/deploy360/blog/2016/03/lets-e...

http://www.internetsociety.org/deploy360/blog/2016/01/lets-e... (part 1)