Procedure for OPENSSL_KEY change or rotation.

[robsoncombr]

Hello everyone.

I would like to know if there is a procedure for replacing the _APP_OPENSSL_KEY_V1 key without losing data.

The goal here would be to replace it in case of a public leak or to implement an auto-rotation policy.

Thank you,

Robson

[TomakataABC]

Hello,

I've stumbled upon this post wondering the exact same thing. Is there a way to safely change the key?

Thanks,
Thomas

[dharunashokkumar]

Hey!
Be careful with this one, it can break sessions

Backup your database first!
Generate new key:
openssl rand -base64 32

In your .env file, add both:
_APP_OPENSSL_KEY_V1=new_key_here
_APP_OPENSSL_KEY_V1_OLD=old_key_here

Restart:
docker-compose restart

Users will need to log in again after this. Test it in dev first before doing it in production.

What's the reason you need to rotate? There might be an easier solution.

[poptoall1-design]

This will work...