Skip to main content
In this final lesson, you’ll learn how to rekey Vault (regenerate unseal or recovery key shares) and rotate the encryption key that secures data-at-rest. Both operations are essential Vault administration tasks that help maintain security, comply with policies, and ensure high availability.

​
Rekey Vault

Rekeying creates a brand-new set of unseal or recovery key shares and lets you adjust how many shares exist and how many are required to reconstruct the master key. This operation is performed online—Vault continues to serve requests throughout.
The image explains the concept of "Rekey" in a Vault system, highlighting its functions such as creating new recovery keys, specifying key numbers and thresholds, requiring a key threshold for rekeying, and providing a nonce value for key holders.
By default, Vault initializes with 5 shares and a threshold of 3. Rekeying can, for example, increase this to 10 shares with a threshold of 7, or reduce it to 1 share with a threshold of 1—giving you full control over key distribution and recovery.

​
Why Rekey Vault?

Rekeying is commonly required when:
  • Lost or inaccessible key shares need replacement (e.g., lost PGP private key).
  • Employees or key holders leave the organization.
  • Your security policy mandates periodic rotation of master key shares.
The image explains reasons for rekeying, such as lost keys, employee departures, and organizational security policies, using a diagram of key shards leading to a master key.

​
Rekey Command

Use the vault operator rekey command to start a rekey. You can include -key-shares and -key-threshold to change those values. Initialize a rekey for recovery keys (auto-unseal defaults to unseal keys):
Example output:
Distribute the nonce to key holders. Each holder submits their key share with:
Progress output:
Repeat until the threshold is met. On the final submission, Vault prints the new key shares:
In Vault Enterprise with replication enabled, always run the rekey on the primary cluster. Replicas will automatically receive the updated key shares.

​
Production Impact

Rekey is non-disruptive. Vault continues handling API calls and UI requests throughout the process, ensuring zero downtime.

​
Rekey vs. Key Rotation

These two operations are often confused. The diagram below clarifies their roles:
The image illustrates the difference between "Rekey" and "Key Rotation," showing a process involving unseal/recovery keys leading to a master key, and an encryption key protected by a master key.

​
Rotate Encryption Key

Key rotation updates Vault’s internal encryption key used for data-at-rest. Vault transparently retains old key versions so existing data remains decryptable.
The image explains key rotation, highlighting that it involves changing the encryption key used for data protection without requiring user access, and allows old data to be decrypted with the previous key. It includes a visual of an encryption key and a "Rotate" button.
Execute the following command:
Sample output:

​
Permissions Required

To rotate the encryption key, your policy must grant:
Omitting sys/key-status read permission causes the CLI to report a permission error when displaying key status, even though the rotation itself succeeds.
Explore these resources for deeper insights into Vault key management. Good luck practicing these operations in your live environment!

Watch Video