user1326: I would like to rotate my KES keys using cardano-cli (I'm not using cncli or other tools). What would be the proper way to rotate the keys?
is the VRF keys need to be updated also?

user2897: This link is also helpful in this regard: https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/part-iv-administration/rotating-kes-keys

user28: VRF keys does not need to be rotated, only KES keys.
To use cardano-cli, follow the KES_period.md, as such:
Create new KES keys:
cardano-cli node key-gen-KES --verification-key-file kes.vkey --signing-key-file kes.skey 

To find out how long one period is and for how long a key can evolve, we can look into the genesis file. If that file is called mainnet-shelley-genesis.json,
we can type
cat mainnet-shelley-genesis.json | grep KES
"slotsPerKESPeriod": 129600,
"maxKESEvolutions": 62,

in this example, the key will evolve after each period of 129600 slots and that it can evolve 62 times before it needs to be renewed.
Before we can create an operational certificate for our node, we need to figure out the start of the KES validity period, i.e. which KES evolution period we are in.
We check the current tip of the blockchain:
cardano-cli query tip --mainnet

{
    "epoch": 259,
    "hash": "dbf5104ab91a7a0b405353ad31760b52b2703098ec17185bdd7ff1800bb61aca",
    "slot": 26633911,
    "block": 5580350
}

In this example, we are currently in slot 26633911, and we know from the genesis file that one period lasts for 129600 slots. So we calculate the current period by
expr 26633911 / 129600
> 205

With this we are able to generate an operational certificate for our stake pool:
cardano-cli node issue-op-cert \
--kes-verification-key-file kes.vkey \
--cold-signing-key-file cold.skey \
--operational-certificate-issue-counter cold.counter \
--kes-period 205 \
--out-file node.cert


1326: <p>I would like to rotate my KES keys using cardano-cli (I'm not using cncli or other tools). What would be the proper way to rotate the keys?
is the VRF keys need to be updated also?</p>
 2897: <p>This link is also helpful in this regard: <a href="https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/part-iv-administration/rotating-kes-keys" rel="nofollow noreferrer">https://www.coincashew.com/coins/overview-ada/guide-how-to-build-a-haskell-stakepool-node/part-iv-administration/rotating-kes-keys</a></p>
 28: <p>VRF keys does not need to be rotated, only KES keys.</p>
<p>To use <code>cardano-cli</code>, follow the <a href="https://github.com/input-output-hk/cardano-node/blob/master/doc/stake-pool-operations/KES_period.md" rel="nofollow noreferrer">KES_period.md</a>, as such:</p>
<p>Create new KES keys:</p>
<pre><code>cardano-cli node key-gen-KES --verification-key-file kes.vkey --signing-key-file kes.skey 
</code></pre>
<p>To find out how long one period is and for how long a key can evolve, we can look into the <em>genesis file</em>. If that file is called <code>mainnet-shelley-genesis.json</code>,
we can type</p>
<pre><code>cat mainnet-shelley-genesis.json | grep KES
&quot;slotsPerKESPeriod&quot;: 129600,
&quot;maxKESEvolutions&quot;: 62,
</code></pre>
<p>in this example, the key will evolve after each period of 129600 slots and that it can evolve 62 times before it needs to be renewed.</p>
<p>Before we can create an operational certificate for our node, we need to figure out the start of the KES validity period, i.e. which KES evolution period we are in.</p>
<p>We check the current tip of the blockchain:</p>
<pre><code>cardano-cli query tip --mainnet

{
    &quot;epoch&quot;: 259,
    &quot;hash&quot;: &quot;dbf5104ab91a7a0b405353ad31760b52b2703098ec17185bdd7ff1800bb61aca&quot;,
    &quot;slot&quot;: 26633911,
    &quot;block&quot;: 5580350
}
</code></pre>
<p>In this example, we are currently in slot 26633911, and we know from the genesis file that one period lasts for 129600 slots. So we calculate the current period by</p>
<pre><code>expr 26633911 / 129600
&gt; 205
</code></pre>
<p>With this we are able to generate an operational certificate for our stake pool:</p>
<pre><code>cardano-cli node issue-op-cert \
--kes-verification-key-file kes.vkey \
--cold-signing-key-file cold.skey \
--operational-certificate-issue-counter cold.counter \
--kes-period 205 \
--out-file node.cert
</code></pre>
