# KES keys rotation - Is it necessary to generate new KES keys?

**URL:** <https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353>\
**Category:** Setup a Stake Pool\
**Created:** [22 January 2022 08:02 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353 "2022-01-22T08:02:46Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![7.4d4](https://avatars.discourse-cdn.com/v4/letter/7/bc79bd/32.png) [@7.4d4](https://forum.cardano.org/u/7.4d4)\
**Post date:** [22 January 2022 08:02 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/1 "2022-01-22T08:02:46Z")

</div>

I am confused about KES key rotation now. In past rotations, I have created new KES keys with:

```auto
cardano-cli node key-gen-KES \
  --verification-key-file kes.vkey \
  --signing-key-file kes.skey

```

And then done the rest of the steps in the IOHK reference document to create a new certificate:

> <https://github.com/input-output-hk/cardano-node/blob/master/doc/stake-pool-operations/KES_period.md>

This document says: “… the node operator has to generate a new KES key pair, issue a new operational node certificate with that new key pair …”

However, the command sequence in this reference document doesn’t actually list the creation of new KES keys.

Also, other answers seem to skip creating new KES keys. Eg:

> <https://cardano.stackexchange.com/questions/2430/what-is-the-proper-way-to-rotate-kes-keys>

So what is the proper sequence to rotate KES keys?

Is the missing ‘key-gen-KES’ command just an oversight in the IOHK document?

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [22 January 2022 08:06 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/2 "2022-01-22T08:06:34Z")

</div>

Hi,

Follow the step 18.1 from coincashew guide

> **[18. Operational and Maintenance Tips](https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/18.-operational-and-maintenance-tips)**

Cheers,

---

<div class="post-metadata">

**Author:** ![7.4d4](https://avatars.discourse-cdn.com/v4/letter/7/bc79bd/32.png) [@7.4d4](https://forum.cardano.org/u/7.4d4)\
**Post date:** [22 January 2022 08:30 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/3 "2022-01-22T08:30:06Z")

</div>

Thanks.

So you do need to do:

```auto
cardano-cli node key-gen-KES \
  --verification-key-file kes.vkey \
  --signing-key-file kes.skey

```

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [22 January 2022 08:31 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/4 "2022-01-22T08:31:22Z")

</div>

Yes, you will generate new KES files + new node.cert

---

<div class="post-metadata">

**Author:** ![7.4d4](https://avatars.discourse-cdn.com/v4/letter/7/bc79bd/32.png) [@7.4d4](https://forum.cardano.org/u/7.4d4)\
**Post date:** [22 January 2022 08:33 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/5 "2022-01-22T08:33:30Z")

</div>

@Alexd1985 I really appreciate how much effort you put in to help others and so fast with your replies. Do you ever sleep?

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [22 January 2022 08:34 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/6 "2022-01-22T08:34:40Z")

</div>

:)) yes, actually I sleep 6-8 hours, now playing with my son :)) busy life

You’re welcome 🍻

---

<div class="post-metadata">

**Author:** ![Geoffrey\_Tipy](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/geoffrey_tipy/32/45227_2.png) [@Geoffrey\_Tipy](https://forum.cardano.org/u/Geoffrey_Tipy)\
**Post date:** [31 March 2022 07:06 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/7 "2022-03-31T07:06:17Z")

</div>

When you cycle your node.cert. do I also need to upload the kes.skey to the priv/pool/[id]. folder?

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [2 June 2022 09:11 UTC](https://forum.cardano.org/t/kes-keys-rotation-is-it-necessary-to-generate-new-kes-keys/93353/8 "2022-06-02T09:11:12Z")

</div>

I think not can’t tell u for sure… but what u need to check is the next cerificate incremental number inside node.counter / cold.counter… should be higher than the last one used

Cheers,