mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-11-28 06:01:08 +01:00
Code Issues Projects Releases Wiki Activity

Docs- Update info on key rotation (#23274)

Browse Source 
* Docs- Update info on key rotation

Added a sentence about needing to seal-rewrap if you want to disable or delete old key.

* rectified the url for seal-rewrap

rectified the url for seal-rewrap

* fixed some grammar

* Update website/content/docs/configuration/seal/pkcs11.mdx

---------

Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
This commit is contained in:
prabhat-hashi 2024-05-02 08:42:54 +10:00 committed by GitHub
parent 07bfa6bd92
commit c88967abb5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
website/content/docs/configuration/seal/pkcs11.mdx
View File

@ -280,7 +280,9 @@ This seal supports rotating keys by using different key labels to track key vers
the key value, generate a new key in a different key label in the HSM and update Vault's
configuration with the new key label value. Restart your vault instance to pick up the new key
label and all new encryption operations will use the updated key label. Old keys must not be disabled
or deleted and are used to decrypt older data.
or deleted and are used to decrypt older data. To disable or delete old keys, Vault needs to
perform [seal-rewrap](/vault/api-docs/system/sealwrap-rewrap#start-a-seal-rewrap-process)
so that data encrypted by the old key can be decrypted using the new key.
**NOTE**: Prior to version 0.10.1, key information was not tracked with the ciphertext. If
rotation is desired for data that was seal wrapped prior to this version must also set