Renewing keys and certificates

You can renew the keys of a user of a Password account to change their encryption or signature keys.

To renew keys from a user’s workstation:

1. Right-click on the SDS Enterprise  icon in the system tray.
2. Select Properties.
3. Select the Configuration tab.
4. Double-click on the Key ring icon.
   • If the user has two keys, choose the Encryption key or Signing key tab.
   • If the user has only one key, choose the Personal key tab.

5. Click on Operations and choose Renew key, then skip the introduction screen.
   
6. Specify how to create the encryption key:
   • To create a new key, select the option Generate your key and select the type and length of the key. Refer to the section Creating a Password Account Manually for further instructions.
   • To import an existing key, select Import your key. Refer to the section Creating a Password Account Manually for further instructions.
7. Click on Finish.

SDS Enterprise generates or imports the personal key and moves the old key as a decryption key so that the user can decrypt his old documents. It is visible in the user’s Keyring Decryption tab. Signature keys are not kept.

For more information, refer to the section Decrypting a user's data with an old key or a delegation key.

To renew certificates or keys on smart cards and USB tokens, take note of the information below.

Renewing certificates

When renewing certificates on the smart card or USB token, the new certificates are effective the next time the user connects to SDS Enterprise.

When a new certificate is added, the certificate object that is created must have the same CKA_ID PKCS#11 attribute as the old one.

The old certificate should not be deleted unless SDS Enterprise has correctly recognized the new one. You can check whether the new certificate is recognized in the SDS Enterprise agent's key ring.

Renewing keys

When renewing keys (with the associated certificate) on the card or USB token, the new keys are taken into consideration once the certificates of the older keys expire.

For an account with several keys (one for encryption and one for signing), the new keys are selected based on the use of the associated certificates.

You can check whether the new keys are recognized in the SDS Enterprise agent's keyring.

IMPORTANT
Make sure that you keep the old encryption key, even after the new key has been taken into account by SDS Enterprise.

The old key automatically becomes a decryption key and always decrypts the user’s old documents. It is visible in the user’s Keyring Decryption tab.

It is not necessary to keep the old signature key.

For more information, refer to the section Decrypting a user's data with an old key or a delegation key.

In SSO mode, encryption and signature keys as well as certificates can be stored in the user’s Windows Certificate Store. In this case, please observe the following information.

Renewing keys

If you need to renew a user’s keys in the Windows Certificate Store, proceed as follows:

1. As the mechanism for managing the keys is similar for the Card accounts and SSO accounts, start by activating automatic key renewal in the configuration file SBox.ini. To do this, indicate the value 1 or 2 for the AutomaticRenewFromCard parameter in the file's KeyRenewalWizardGP section. For more information, refer to the [SBox.KeyRenewalWizardKS]/[SBox.KeyRenewalWizardGP] section of the Advanced configuration guide of SDS Enterprise.

2. After editing their SBox.ini file, the user must restart their computer to ensure that the modification has been taken into account.

3. By precaution, if you renew an encryption key, save the user's private key in a safe place to allow decryption of old data should the renewal procedure fail. A backup is not necessary to renew a signature key.

4. Via the Windows Certificates Manager, in the user's personal store, right-click the certificate matching the key to be renewed, and select the menu All tasks > Ask for a certificate with a new key.
   A new key and its certificate are generated and displayed in the Certificates Manager.
   

IMPORTANT
Do not omit to ask for a new certificate with a new key and not a certificate renewal. Indeed, the previous key will be overwritten by the new one. In the encryption, the old key must remain present in the Certificate Store to allow the user to decrypt his/her old data. Therefore, never delete the old encryption keys.

The SDS Enterprise agent then considers the new key once the certificate of the old key expired.

At the end of this operation, the old encryption key is added automatically as the decryption key to the Decryption tab in the user's keyring. Although the key is visible in the keyring, it remains stored in the user's Windows Certificate store. Therefore it is important to keep it in the Store.

For more information on the decryption key, refer to the section Decrypting a user's data with an old key or a delegation key.

Once a key has been renewed, if you have entered a value of 1 for the AutomaticRenewFromCard parameter in the SBox.ini file, the user will have to confirm the key renewal in the window that opens the next time they log in to their SDS Enterprise account.

Two different confirmation windows open if the encryption key and the signature key have been renewed.

You can check whether the new keys are recognized in the SDS Enterprise agent's keyring.

Renewing certificates

If you need to renew a user’s certificate (without changing the key), you must renew it via the Windows Certificate Manager so that it remains associated with the same encryption or signature key:

• In the user’s personal store, right-click on the certificate to be renewed and select the menu All tasks > Advanced operations > Renew this certificate with the same key.

The next time SDS Enterprise starts, the new certificate is automatically taken into account in the user’s keyring.