Skip to content
HotKVDocs

Ask the HotKV docs

Answers come only from these docs and can be wrong; check the linked pages before you rely on them.

ENCRYPTION.ROTATE

Last updated 
ENCRYPTION.ROTATE new-key-file
Group
Encryption
Complexity
O(1)
Arity
2 (exactly, counting the command name)
Flags
admin, slow
HotKV Cloud
Scale
On-Premise
requires the encryption-at-rest license feature

ENCRYPTION.ROTATE loads the key in new-key-file, a file on the server that holds a 32-byte key, and uses it for every snapshot written from then on. Snapshots already on disk are not rewritten.

To finish a rotation:

  1. Run ENCRYPTION.ROTATE /path/to/new.key.
  2. Run BGSAVE, so the current snapshot is written with the new key.
  3. Point key_path (encryption.key-file) at the new key file, so the next restart uses it.
  4. Keep the old key as long as you keep snapshots written with it: a snapshot can only be read with the key it was written with.

The command cannot be called from a script.

Return value

Section titled “Return value”

Simple string OK in RESP2 and RESP3, or one of these errors:

Case Error
The file is missing, unreadable, or does not hold a 32-byte key ERR key rotation failed - check key file path and format
No license that includes encryption-at-rest NOLICENSE encryption-at-rest requires a HotKV license. Contact sales@hotkv.com

Examples

Section titled “Examples”
127.0.0.1:6379> ENCRYPTION.ROTATE /etc/hotkv/master-2026-10.key
OK
127.0.0.1:6379> BGSAVE
Background saving started
127.0.0.1:6379> ENCRYPTION.ROTATE /etc/hotkv/missing.key
(error) ERR key rotation failed - check key file path and format

Compatibility

Section titled “Compatibility”

HotKV-only command.

See also

Section titled “See also”

ENCRYPTION.INFO, ENCRYPTION.VERIFY, BGSAVE