Rotate keys

In environments that use Enhanced Account Encryption (EAE), you can rotate keys on your Groundplex nodes. This topic covers Linux, Windows, and Docker Groundplexes, all of which support Enhanced Account Encryption. However, Windows-based Groundplexes still require a Linux machine to run the jcc.sh script used to generate and rotate keys. For Kubernetes Groundplexes, which use a separate Enhanced Encryption secret workflow, see Deploy a Groundplex on Kubernetes.

The environment must have an Enhanced Account Encryption subscription and be configured to use it.
A Groundplex node on Linux, Windows, or Docker, running the latest Snaplex installation package or image.

Important: If your Snaplex runs only on Windows nodes, you need a Linux machine to run the key-generation command in step 1 — a real Groundplex node, or one installed solely for this purpose. See the prerequisites in Prepare nodes for details.

To rotate the keys for Enhanced encryption:

Generate a new key pair and append it to the keystore with the specified alias:
- On a Linux Groundplex node: as root user on the node's host, run /opt/snaplogic/bin/jcc.sh addDataKey key_alias.
- On a Docker Groundplex node: run the same command inside the running container: docker exec container_name /opt/snaplogic/bin/jcc.sh addDataKey key_alias.
- On a Windows-only Snaplex: before running the command, copy the environment's existing jcc-datakeys.jks and jcc-datakeys.pass from a current Windows node's SL_KEY_DIR folder into /etc/snaplogic on the Linux machine. Otherwise a freshly installed Linux machine has its own unrelated keystore, and the new key gets appended to the wrong one. Then run the command on that Linux machine, as described in the prerequisites above.
This command generates a new key pair and appends it to the keystore in /etc/snaplogic — on the node's host for Linux, or inside the container for Docker — with the specified alias.
Copy /etc/snaplogic/jcc-datakeys.jks and /etc/snaplogic/jcc-datakeys.pass to all Snaplexes in the Environment:
- On Linux machines: The /etc/snaplogic folder on all Snaplex node hosts.
- On Windows machines: The folder defined by the jcc.jvm_options global property SL_KEY_DIR value in the Snaplex settings. The instructions to prepare Windows nodes describe how to find this property.
- On Docker containers: Copy the files out of the container that generated them into a secure, permission-restricted directory on the host, then into each other Docker Groundplex node's container:
```
mkdir -m 700 -p ~/eae-key-backup
docker cp source_container:/etc/snaplogic/jcc-datakeys.jks ~/eae-key-backup/
docker cp source_container:/etc/snaplogic/jcc-datakeys.pass ~/eae-key-backup/
docker cp ~/eae-key-backup/jcc-datakeys.jks other_container:/etc/snaplogic/jcc-datakeys.jks
docker cp ~/eae-key-backup/jcc-datakeys.pass other_container:/etc/snaplogic/jcc-datakeys.pass
```
  Repeat the last two commands for every other Docker Groundplex node. Keep ~/eae-key-backup as a durable backup rather than deleting it — see preparing Docker nodes for why a container's writable layer doesn't survive recreation, and how to restore from this backup into a replacement container.
Restart the nodes from the command line or from the SnapLogic Monitor.
For a Docker node, run docker restart container_name. To confirm the node came back up before continuing, check its health endpoint. On Linux or Windows, run curl -k https://localhost:8081/healthz on the node's host. On Docker, run the check inside the specific container instead, since multiple nodes can share a host with different port mappings: docker exec container_name curl -k https://localhost:8081/healthz (port 8081 is HTTPS only; the equivalent endpoint on port 8090 uses HTTP instead).
From the Admin Manager navigation pane Security section, select Account encryption.
In the Encryption settings tab select Enhanced encryption.
Select the public key with the alias you provided on the command line in Step 1.
Confirm the new key. This configuration causes all accounts to be decrypted using the existing keys and then re-encrypted with the newly selected Org-level key.
Click Save to apply Enhanced encryption.
The new status displays if you click Enhanced encryption.