I would like to rotate my KES keys using cardano-cli (I'm not using cncli or other tools). What would be the proper way to rotate the keys? is the VRF keys need to be updated also?

2 Answers 2


VRF keys does not need to be rotated, only KES keys.

To use cardano-cli, follow the KES_period.md, as such:

Create new KES keys:

cardano-cli node key-gen-KES --verification-key-file kes.vkey --signing-key-file kes.skey 

To find out how long one period is and for how long a key can evolve, we can look into the genesis file. If that file is called mainnet-shelley-genesis.json, we can type

cat mainnet-shelley-genesis.json | grep KES
"slotsPerKESPeriod": 129600,
"maxKESEvolutions": 62,

in this example, the key will evolve after each period of 129600 slots and that it can evolve 62 times before it needs to be renewed.

Before we can create an operational certificate for our node, we need to figure out the start of the KES validity period, i.e. which KES evolution period we are in.

We check the current tip of the blockchain:

cardano-cli query tip --mainnet

    "epoch": 259,
    "hash": "dbf5104ab91a7a0b405353ad31760b52b2703098ec17185bdd7ff1800bb61aca",
    "slot": 26633911,
    "block": 5580350

In this example, we are currently in slot 26633911, and we know from the genesis file that one period lasts for 129600 slots. So we calculate the current period by

expr 26633911 / 129600
> 205

With this we are able to generate an operational certificate for our stake pool:

cardano-cli node issue-op-cert \
--kes-verification-key-file kes.vkey \
--cold-signing-key-file cold.skey \
--operational-certificate-issue-counter cold.counter \
--kes-period 205 \
--out-file node.cert
  • We need to add KES key creation step: cardano-cli node key-gen-KES \ --verification-key-file kes.vkey \ --signing-key-file kes.skey
    – AmineMs
    Jul 2, 2022 at 23:37

This link is also helpful in this regard: https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/part-iv-administration/kes-rotate-companion-script

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.