<p>This link is also helpful in this regard: <a href="https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/part-iv-administration/kes-rotate-companion-script" rel="nofollow noreferrer">https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/part-iv-administration/kes-rotate-companion-script</a></p>

CC BY-SA 4.0
2022-06-07T01:48:54.380Z
2023-10-19T18:26:08.597Z
2023-10-19T18:26:08.597Z
Falcon Stakepool
<p>I always found this very useful on this matter: <a href="https://ecp.gitbook.io/how-to-guides-for-coincashew-method-cardano-spos/maintenance-and-daily-operations/how-to-guides-for-spos-using-coincashew-method/adjust-node.counter-for-kes" rel="nofollow noreferrer">https://ecp.gitbook.io/how-to-guides-for-coincashew-method-cardano-spos/maintenance-and-daily-operations/how-to-guides-for-spos-using-coincashew-method/adjust-node.counter-for-kes</a></p>

CC BY-SA 4.0
2024-06-26T01:54:37.163Z
2024-06-26T01:54:37.163Z
Falcon Stakepool
<p>VRF keys does not need to be rotated, only KES keys.</p>
<p>To use <code>cardano-cli</code>, follow the <a href="https://github.com/input-output-hk/cardano-node/blob/master/doc/stake-pool-operations/KES_period.md" rel="nofollow noreferrer">KES_period.md</a>, as such:</p>
<p>Create new KES keys:</p>
<pre><code>cardano-cli node key-gen-KES --verification-key-file kes.vkey --signing-key-file kes.skey 
</code></pre>
<p>To find out how long one period is and for how long a key can evolve, we can look into the <em>genesis file</em>. If that file is called <code>mainnet-shelley-genesis.json</code>,
we can type</p>
<pre><code>cat mainnet-shelley-genesis.json | grep KES
&quot;slotsPerKESPeriod&quot;: 129600,
&quot;maxKESEvolutions&quot;: 62,
</code></pre>
<p>in this example, the key will evolve after each period of 129600 slots and that it can evolve 62 times before it needs to be renewed.</p>
<p>Before we can create an operational certificate for our node, we need to figure out the start of the KES validity period, i.e. which KES evolution period we are in.</p>
<p>We check the current tip of the blockchain:</p>
<pre><code>cardano-cli query tip --mainnet

{
    &quot;epoch&quot;: 259,
    &quot;hash&quot;: &quot;dbf5104ab91a7a0b405353ad31760b52b2703098ec17185bdd7ff1800bb61aca&quot;,
    &quot;slot&quot;: 26633911,
    &quot;block&quot;: 5580350
}
</code></pre>
<p>In this example, we are currently in slot 26633911, and we know from the genesis file that one period lasts for 129600 slots. So we calculate the current period by</p>
<pre><code>expr 26633911 / 129600
&gt; 205
</code></pre>
<p>With this we are able to generate an operational certificate for our stake pool:</p>
<pre><code>cardano-cli node issue-op-cert \
--kes-verification-key-file kes.vkey \
--cold-signing-key-file cold.skey \
--operational-certificate-issue-counter cold.counter \
--kes-period 205 \
--out-file node.cert
</code></pre>

CC BY-SA 4.0
2022-07-02T23:37:21.933Z
We need to add KES key creation step: cardano-cli node key-gen-KES \
  --verification-key-file kes.vkey \
  --signing-key-file kes.skey
AmineMs
CC BY-SA 4.0
2021-08-26T11:33:02.160Z
2022-08-04T06:26:43.147Z
2022-08-04T06:26:43.147Z
Marek Mahut - StakeNuts
<p>I would like to rotate my KES keys using cardano-cli (I'm not using cncli or other tools). What would be the proper way to rotate the keys?
is the VRF keys need to be updated also?</p>

<stake-pool>
What is the proper way to rotate KES keys?
# What is the proper way to rotate KES keys?

(Asked by: username_0 on 2021-08-25)

I would like to rotate my KES keys using cardano-cli (I'm not using cncli or other tools). What would be the proper way to rotate the keys?
is the VRF keys need to be updated also?

**Tags:** stake-pool

---

## 3 answers

### Answer by username_2 on 2021-08-26. Score: 7 | Accepted answer

VRF keys does not need to be rotated, only KES keys.
To use cardano-cli, follow the KES_period.md, as such:
Create new KES keys:
cardano-cli node key-gen-KES --verification-key-file kes.vkey --signing-key-file kes.skey 

To find out how long one period is and for how long a key can evolve, we can look into the genesis file. If that file is called mainnet-shelley-genesis.json,
we can type
cat mainnet-shelley-genesis.json | grep KES
"slotsPerKESPeriod": 129600,
"maxKESEvolutions": 62,

in this example, the key will evolve after each period of 129600 slots and that it can evolve 62 times before it needs to be renewed.
Before we can create an operational certificate for our node, we need to figure out the start of the KES validity period, i.e. which KES evolution period we are in.
We check the current tip of the blockchain:
cardano-cli query tip --mainnet

{
    "epoch": 259,
    "hash": "dbf5104ab91a7a0b405353ad31760b52b2703098ec17185bdd7ff1800bb61aca",
    "slot": 26633911,
    "block": 5580350
}

In this example, we are currently in slot 26633911, and we know from the genesis file that one period lasts for 129600 slots. So we calculate the current period by
expr 26633911 / 129600
> 205

With this we are able to generate an operational certificate for our stake pool:
cardano-cli node issue-op-cert \
--kes-verification-key-file kes.vkey \
--cold-signing-key-file cold.skey \
--operational-certificate-issue-counter cold.counter \
--kes-period 205 \
--out-file node.cert

> **Comments:**
> **username_0**: We need to add KES key creation step: cardano-cli node key-gen-KES \   --verification-key-file kes.vkey \   --signing-key-file kes.skey  

---

### Answer by username_1 on 2022-06-07. Score: 1

This link is also helpful in this regard: <https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/part-iv-administration/kes-rotate-companion-script>


---

### Answer by username_1 on 2024-06-26. Score: 0

I always found this very useful on this matter: <https://ecp.gitbook.io/how-to-guides-for-coincashew-method-cardano-spos/maintenance-and-daily-operations/how-to-guides-for-spos-using-coincashew-method/adjust-node.counter-for-kes>


---

