title: What are existing practices for encryption / decryption / key rotation for Java Web apps
body: <p>I need to encrypt user entered data in my java based web-application (using jasypt) which is persisted in a MySQL Database and I want to be able to change the encryption key/passphrase in a regular interval (e.g. 90 days). The application lives on a server in the web.</p>
  
  <p>The existing already encrypted data would need to be reencrypted with the new key, but in order to do so it would of course need the old key. </p>
  
  <ol>
  <li>What are common practises to rotate the keys?</li>
  <li>What are common ways to make the encryption keys available to the system (e.g. System properties passed via commandline, encrypted properties files, downloading from another server via https)</li>
  </ol>
  
  <p>I expect there is no single answer to this but I would like to get some hints, pointers and buzzwords to investigate in the right direction. </p>