Master Encryption Key Rotation

This topic applies to Secret Server On-Premises, standalone Secret Server Cloud, and Delinea Platform.
Important: Rotating the master encryption key is a sensitive operation. While we have detailed the steps in this topic, we urge you to contact Support to work with a support representative before attempting any MEK rotation to ensure all prerequisites have been met. Please provide at least a five-day notice in advance of when you want to conduct the rotation.

Overview

When Secret Server is first installed, it generates a unique, random AES256 Master Encryption Key (MEK) and stores it in a file called encryption.config. The MEK protects everything sensitive that is not tied to a specific secret It also protects each secret's own AES256 key whenever a Hardware Security Module (HSM) is not in use. Rotating the MEK generates a fresh key and re-encrypts all protected data under it, which is a good periodic hygiene practice and often a compliance requirement.

Rotation requires Enterprise Plus edition or the advanced encryption license. A few conditions must be met before starting: Geo-Replication, DPAPI, and any active secret key rotation must not be running. DPAPI must be disabled on all nodes, or the rotate button stays disabled. Because Secret Server only tracks the current and previous MEK, a rotation must finish completely before another can begin. It is a sensitive operation. We urge you to contact Support with at least five days' notice before attempting one.

The rotation itself is the same core workflow in both cloud an on-premises Secret Server versions:

  1. The Master Encryption Key Rotation page is accessed.

  2. The encryption key process is begun.

  3. A strong warning appears and is acknowledged.

  4. The server enters maintenance mode and writes both the new and previous MEK into encryption.config.

  5. A background worker re-encrypts all data (and, on the first rotation only, any on-disk session recording videos).

What differs is what you are responsible for in that sequence.

On-Premises versus Secret Server Cloud MEK Rotation

The essential contrast is who owns the infrastructure and the key file:

  • Secret Server On-Premises: You own the whole process. Before rotating you must manually back up the encryption.config file on each node, back up the SQL database, and (on a first rotation) back up encrypted session-recording videos. Skipping any of these risks permanent data loss. In a clustered environment there are manual steps: run iisreset /stop on all nodes, copy the updated encryption.config from the rotating node to every other node, then iisreset /start. Optional external key protection comes from an HSM, which must be disabled for the first MEK rotation and can be re-enabled afterward.

  • Secret Server Cloud and Delinea Platform: Delinea hosts and manages the infrastructure, so the encryption.config file handling, database backups, and node/IIS restart steps are handled for you rather than performed manually. The optional external key layer is cloud key management (BYOK) rather than a physical HSM, for example AWS KMS or Azure Key Vault. If cloud key management is enabled, you first set the Key Management Type to None (Administration > Key Management), let that complete, then run the MEK rotation, and afterward rotate the cloud KMS key and re-enable key management.

In short: the procedure is nearly identical, but On-Premises puts the backup, file-copy, clustering, and HSM steps on the administrator, whereas Cloud offloads the infrastructure work to Delinea and swaps the HSM for cloud-based key management.

On-Premises MEK Rotation

Overview

When Secret Server is first installed, a unique random AES256 Master Encryption Key (MEK) is generated and saved in a file, encryption.config. The MEK protects anything sensitive in Secret Server that is not associated with a specific secret, as well as each secret’s unique AES256 key when an HSM is not used.

For added security, you can rotate the MEK, re-encrypting protected data with the new key.

Geo-Replication, DPAPI, or an active secret key rotation must not be in effect when rotating the MEK.

MEK rotation fully supports using a Hardware Security Module (HSM) for Secret Server On-Premises or key management for Secret Server Cloud. This feature requires Enterprise Plus edition or the advanced encryption license. If you are using an HSM, disable it for your first MEK rotation. You can then re-enabled it, and you can run future MEK rotations without disabling it.

If the rotation button is disabled then DPAPI also needs to be disabled, otherwise it will cause the process to fail. The DPAPI needs to be disabled on all nodes.

Rotation Procedure

To perform a MEK rotation:

  1. Important: Back up the current MEK file encryption.config in the application directory on each node.

    Do not continue until you back up your encryption key. Failure to do so could cause extensive permanent data loss.

    If this is the first MEK rotation, also backup any encrypted session recording videos saved to disk. They are only updated during the very first MEK rotation. Failure to do so could cause extensive permanent data loss.

  2. Important: Back up your database. See the first task on the Moving the Microsoft SQL Server Database to Another Machine topic for details.

    Do not continue until you back up your database. Failure to do so could cause extensive permanent data loss.

  3. Search for Security. The Configuration page appears,

  4. Click the Security tab.

  5. Go to the Master Encryption Key Rotation section (not the Key Rotation section).

  6. Click the Rotate Encryption Keys button. The Master Encryption Key Rotation popup appears:

  7. Carefully read the text, especially for the check boxes themselves.

  8. When you are finished, click to select the three check boxes to acknowledge having read them.

  9. Click the Continue button. The server goes into maintenance mode to perform MEK rotation. Secrets and configuration settings cannot be updated while in maintenance mode. Secrets cannot be updated while in this mode. Processing time will vary, depending on the hardware, number of secrets, and HSM key size.

  10. The rotation begins.

  11. Secret Server updates the encryption.config file on the current server. The file now contains the new MEK, as well as the previous MEK, which is needed to re-encrypt all of the data. The encryption.config file is only updated on the node you are connected to when you click the Rotate Encryption Keys button, so, depending on whether you have clustered servers, pick one of the following procedures:

    If you are not running a cluster of On-Premises servers:

    1. When prompted to restart the IIS application, run iisreset to stop and restart the IIS server.
    2. Open Secret Server to restart it.

    If you are running a cluster of On-Premises servers:

    1. When prompted to restart the IIS server, run command iisreset /stop on all nodes in an elevated command prompt. This stops but does not restart IIS on the nodes.

    2. Copy the encryption.config file from the updated node to all other nodes.

      Note: If you are not sure which node performed the rotation, check the "modified time" of the encryption.config files.

    3. Run iisreset /start on all nodes. This restarts IIS on the nodes.

    4. Open Secret Server to restart it. The first Secret Server node you run continues the rotation process.

  12. The new MEK takes effect, and any new records encrypted use the new key. Any data still using the old key continues to work until the rotation fully finishes.

  13. Secret Server's background worker (Secret Server-BWSR.log) enables maintenance mode, preventing changes to secrets and other configuration settings, and continues the rotation process.

  14. Secret Server marks the data needing an update in the database and begins rotating everything. A progress bar appears on the Security tab.

  15. After all data is rotated except for session recording videos, maintenance mode is disabled.

  16. Secret Server's session recording role (Secret Server-SRWSR.log) starts rotating any existing session recording videos encrypted by the MEK. The Last Master Encryption Key Rotation Status text changes to Pending - Encrypting Session Data. Depending on the number of videos, this may take some time. This only applies to the first MEK rotation—further rotations do not update the recordings again.

  17. Once the process finishes, the Last Master Encryption Key Rotation Status text changes to Completed - Master Encryption Keys Rotated.

Because we only track the current and previous MEK, the MEK rotation must be fully successful before you can run another one. A Retry button appears if the process times out or needs restarting. Monitor the rotation status and contact support if it fails to complete. Failure to do so could cause extensive permanent data loss.

Cloud and Delinea Platform MEK Rotation

The following are instructions on how to rotate the Master Encryption Key (MEK) and AWS Key Management Service (AWS KMS) key when AWS KMS is enabled in Secret Server Cloud.

Do not rotate the AWS KMS key access credentials while Secret Server Cloud is using them. It will completely lock you out of Secret Server Cloud.

Steps:

  1. Navigate to the Administration > Key Management page of Secret Server Cloud.

  2. Click Edit, set the Key Management Type to None, then wait for the process to complete.

  3. Perform the MEK rotation as per the documentation below and wait for it to complete successfully.

  4. Rotate the AWS KMS key while it is turned off in Secret Server Cloud by doing either of the following:

    • Turn off key management within Secret Server, wait for the process to complete, change the credential in Amazon, then turn key management back on within Secret Server using the updated credentials.

    • Create a new account in Amazon that can also access the key, change the credentials within Secret Server to be the new account's credentials, wait for the process to complete, rotate the original account, then change the account back to the rotated original account.

  5. Once it is successfully rotated, re-enable AWS KMS within Secret Server using the new key that was just created.