renewing a certificate does not involve making a new keypair either... It's merely a pair of signatures, one for the CSR and one by the CA.