# Rotating KES, possible to do offline?

**URL:** <https://forum.cardano.org/t/rotating-kes-possible-to-do-offline/68479>\
**Category:** Operate a Stake Pool\
**Created:** [10 August 2021 08:36 UTC](https://forum.cardano.org/t/rotating-kes-possible-to-do-offline/68479 "2021-08-10T08:36:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![demetrio](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@demetrio](https://forum.cardano.org/u/demetrio)\
**Post date:** [10 August 2021 08:36 UTC](https://forum.cardano.org/t/rotating-kes-possible-to-do-offline/68479/1 "2021-08-10T08:36:14Z")

</div>

I am at the point where I need to rotate my KES keys and it seems easiest to do with CNTOOLS \> Pool \> Rotate. This requires that the cold.skey is in the stake pool folder referenced by CNTOOLS. I am uneasy about copying my cold secure key to the block producing node as, after all, they are to be stored offline in cold storage. I know I can delete it once the KES keys have been updated on the BP node but I was wondering whether I could update the key in CNTOOLS in offline mode and then copy the required files to the BP node before restarting.

---

<div class="post-metadata">

**Author:** ![DinoDude](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@DinoDude](https://forum.cardano.org/u/DinoDude)\
**Post date:** [11 August 2021 01:53 UTC](https://forum.cardano.org/t/rotating-kes-possible-to-do-offline/68479/2 "2021-08-11T01:53:34Z")

</div>

There should be a way to generate the new KES keys in a “live linux” OS from bootable USB offline but I know very little about being a SPO …

@Alexd1985 What would you do?

---

<div class="post-metadata">

**Author:** ![Alexd1985](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/alexd1985/32/23759_2.png) [@Alexd1985](https://forum.cardano.org/u/Alexd1985)\
**Post date:** [11 August 2021 05:22 UTC](https://forum.cardano.org/t/rotating-kes-possible-to-do-offline/68479/3 "2021-08-11T05:22:59Z")

</div>

Did u tried to start cntools in offline mode?

- Offline - When CNTools is launched with `-o` runtime argument, this launches CNTools with limited set of features. This mode **does not require access to cardano-node**. It is mainly used to create Wallet/Pool and access `Transaction >> Sign` to sign an offline transaction file created in Hybrid mode.

---

<div class="post-metadata">

**Author:** ![hanswurst](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/hanswurst/32/21722_2.png) [@hanswurst](https://forum.cardano.org/u/hanswurst)\
**Post date:** [11 August 2021 06:26 UTC](https://forum.cardano.org/t/rotating-kes-possible-to-do-offline/68479/4 "2021-08-11T06:26:32Z")

</div>

> [@DinoDude](#):
>
> There should be a way to generate the new KES keys in a “live linux” OS from bootable USB offline

There’s always the option to the generation of the operational certificat offline, like for example coinchashew [shows it](https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node#18-1-rotate-pools-kes-keys-updating-the-operational-cert-with-a-new-kes-period). As long as you do know the current KES period you’ll only need your key files.  
I have never used cntools. But if you do the rotation manually, you’ll have to copy the certificate to your node and restart it manually, of course.