An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only they have the corresponding private key. Size of plain texts to be encrypted is way smaller than the RSA keys. Keys are stored and distributed in X509 certificates.
Question: When end node's certificate is to be renewed, persisted ciphers need to be re-encrypted? Unless the updated certificate use the exact same private key in the renewed certificate? Can I controll this process using public CAs or is this only controllable using self-signed certs?