---
title: "Rotate encryption keys"
slug: "s3suite94-rotate-encryption-keys"
updated: 2026-10-27T18:42:04Z
published: 2026-10-27T18:42:04Z
canonical: "docs.onespan.com/s3suite94-rotate-encryption-keys"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate encryption keys

## Introduction

If your company requires rotation of encryption keys, then use the Admin Console or nnl-mgmt.sh to manage your tenants’ encryption keys. If your company doesn’t have such a policy, there is no need for you to use this feature.

The Nok Nok Server uses symmetric encryption, based on the encryption key, to encode temporary state information needed for protocol operations. This information is exchanged with the client.

There can be only one active encryption key per tenant. When a new key is created, it is automatically activated and the previous active key is made obsolete.

## Using the Admin Console

1. Login and, if needed, switch to the desired tenant. Navigate to **Configuration > Encryption Keys**.
2. Click **Add Key/Alias** to add an encryption key. The **Add Key** dialog opens.
  - If you are not using the Crypto plugin, click **Add Encryption Key**.
    1. To auto-generate an encryption key, select the **Autogenerate** checkbox and click **Save**.
    2. To create your own key
      1. Clear the **Autogenerate** checkbox.
      2. Enter the required key in the **Key** text box and click **Save**.
  - If you are using the Crypto plugin, click **Add Key Alias,** enter the alias for your key and click **Save**.

## Using nnl-mgmt.sh

Use nnl-mgmt.sh's key add command to create and activate a new credential encryption key. The example below creates and activates a new encryption key for the marketing tenant.

```plaintext
./nnl-mgmt.sh key add -tenantid marketing
```

There are additional commands to list keys, delete a key, and activate a key. See details at [nnl-mgmt.sh's key add command](/dpoa/docs/s3suite94-encryption-key-commands).