Red Hat OpenShift Container Platform

Deleting old Tang server keys

Prerequisites

A root shell on the Linux machine running the Tang server.

Procedure

Locate and access the directory where the Tang server key is stored. This is usually the /var/db/tang directory:
```
# cd /var/db/tang/
```

List the current Tang server keys, showing the advertised and unadvertised keys:

# ls -A1

Example output

.36AHjNH3NZDSnlONLz1-V4ie6t8.jwk
.gJZiNPMLRBnyo_ZKfK4_5SrnHYo.jwk
Bp8XjITceWSN_7XFfW7WfJDTomE.jwk
WOjQYkyK7DxY_T5pMncMO5w0f6E.jwk

Delete the old keys:
```
# rm .*.jwk
```
List the current Tang server keys to verify the unadvertised keys are no longer present:
```
# ls -A1
```
Example output
```
Bp8XjITceWSN_7XFfW7WfJDTomE.jwk
WOjQYkyK7DxY_T5pMncMO5w0f6E.jwk
```

Verification

At this point, the server still advertises the new keys, but an attempt to decrypt based on the old key will fail.

Query the Tang server for the current advertised key thumbprints:
```
# tang-show-keys 7500
```
Example output
```
WOjQYkyK7DxY_T5pMncMO5w0f6E
```
Decrypt the test file created earlier to verify decryption against the old keys fails:
```
# clevis decrypt </tmp/encryptValidation
```
Example output
```
Error communicating with the server!
```

If you are running multiple Tang servers behind a load balancer that share the same key material, ensure the changes made are properly synchronized across the entire set of servers before proceeding.