With rotationPolicy: Always, a new private key will be generated each time anaction triggers the reissuance of the certificate object (see Actions that willtrigger a rotation of the private keyabove). Note that if the private key secret already exists when creating thecertificate object, the existing private key will not be used, since therotation mechanism also includes the initial issuance.