Skip to content

Rotate a key now

Give a key a new material version under the same identifier, so that new encryption and signing use fresh key material while applications keep using the same key name.

Who can do it

A tenant administrator, a tenant key manager, or a platform super administrator working inside the tenant. The console offers Rotate only to a person who holds the permission to rotate keys, and only on a key whose state your tenant's lifecycle policy allows to rotate.

Before you start

  • The key is active or expired. A suspended, revoked, archived or pending-destruction key cannot be rotated under the default lifecycle policy, and the console does not offer Rotate on it.
  • Rotation is how an expired key protects again: the new version starts with no uses counted and its own expiry.
  • Decide whether the new version keeps the current algorithm or moves to another one. A new algorithm is always within the key's purpose, and your tenant's rotation policy can refuse a target.
  • If your tenant has a quorum approval policy, a rotation that makes the new version weaker than the current one (exportable where it was not, or a higher or removed usage limit) waits for approval.

Steps

  1. Open Key Inventory.
  2. Start the rotation in one of three ways:
    • Select Rotate on the key's row.
    • Open the key with View Details and select Rotate at the bottom of its details.
    • In the key's details, open the Rotation schedule tab and select Rotate now.
  3. In Rotate Key, choose a rotation mode. The console shows the current version and the version the rotation will create.
    • Keep or Upgrade keeps the current configuration or moves to a stronger algorithm.
    • Intent-Based asks why you are rotating and recommends a target.
    • Full Control lets you set every parameter of the new version.
  4. Complete each step and select Continue. In Keep or Upgrade:
    1. Strategy: select Keep configuration to rotate with the same algorithm and parameters, or the upgrade option to choose a new algorithm.
    2. Algorithm (upgrade only): choose the target. The console checks each target against your tenant's rotation policy.
    3. Lifecycle: choose the expiry and usage limits of the new version.
    4. Review: check the current and the new configuration side by side.
  5. If the target is weaker than the current key and your policy permits it, the review shows Security downgrade. Confirm that you understand the rotation lowers the key's security level.
  6. Select Execute Rotation.

What you see when it worked

The console shows Key Rotated Successfully: the new version is now the key's current version under the same identifier, and the previous version is retired. The rotation is recorded in the audit trail. Select View Key to open the key with its new version.

On the Lineage tab the new version reads Manual in its rotation cause. The retired version keeps decrypting and verifying what it protected, so existing data stays readable. Any rotation restarts the key's automatic rotation interval from the new version.

If the rotation waits for a quorum approval, the console shows Waiting for approval with a link to the quorum request, and nothing changes until the approvals are given.

If it fails

What you see Cause What to do
Rotate is not offered The key's state, or your tenant's lifecycle policy, does not allow rotating it, or you do not hold the permission Check the key's state; a suspended key must be reactivated first
Couldn't verify the rotation policy. Execute stays disabled until the verdict loads. The console could not read the rotation policy's verdict for the chosen target Select Retry in the review step
The rotation target is refused Your tenant's rotation policy does not admit that algorithm Choose another target, or ask an administrator to review the rotation policy
The rotation is refused because the key changed Another rotation or change of the key landed first; nothing was changed Reopen the key to see its current version, then rotate again if still needed
The rotation is refused because no key protection backend is configured The tenant has no backend A tenant administrator configures the key protection backend, then you retry

If the answer to a rotation is lost, for example the connection drops, confirming the same rotation again in the same window never rotates the key twice. Closing the window, or changing the target, starts a new rotation.

Without the console

Surface How
Key management CLI ankasecure-km rotation rotate --kid <id> --body-file <json>; add --idempotency-key <key> to make a retry safe
Admin SDK RotationOperations.rotate(String kid, RotationRequest request), or rotate(kid, request, idempotencyKey)
API POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/rotations (operation rotateKey)