Saw this in another thread:
Haven't read it myself, but people were raving about it
Hey there, I'm a software developer at Amazon working on s2n, our TLS Implementation that encrypts a lot of the web traffic for Amazon. We've hired interns as full time employees in the past who worked on s2n over the summer.
s2n is written in C, and intended to be very small, very simple, easy to review, and easy to test.
If you would like to help out we have a lot of good beginner tasks that you can work on at your own pace here: https://github.com/awslabs/s2n/labels/good-first-patch
If you are looking for a book recommendation you should look at Bulletproof TLS: https://www.amazon.com/dp/1907117040
That's your problem.
A server has both a public and a private key. The public key is given out to visitors, the private key is used to prove they are legitimate. If the keys don't match (math) then the server fails since it will be unable to build up any SSL channels for inbound visitors.
You mention you're using letencrypt, based on what's on their support forum during renewal both public and private keys are regenerated. You won't be able to mix and match keys without a more complex setup involving CSR.
I found This as a good starting point if you don't know anything about SSL/TLS or how it works.
Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications https://www.amazon.com/gp/product/1907117040/ref=oh_aui_detailpage_o00_s00?ie=UTF8&psc=1