Rotation advice is usually given as a frequency with no reasoning attached. The frequency is the least interesting part; what matters is which risks rotation addresses, because two of the three it is usually credited with are not among them.
What rotation does
- It bounds the value of a key you do not know is stolen. This is the real one. An exfiltrated key is silent — nothing in your monitoring changes — so the only thing limiting the damage is how long that key stays valid. Rotation turns an indefinite compromise into a bounded one.
- It proves the process works. A rotation you have rehearsed is one you can perform in an hour under pressure. A rotation nobody has ever done is a plan, and plans fail the first time at the least convenient moment.
- It retires weak keys. A scheduled rotation is how a 1024-bit key becomes a 2048-bit key without a separate project.
What it does not do
- It does not invalidate signatures already made. Messages signed with the old key keep verifying until you revoke the selector. Rotation without revocation extends the key set rather than replacing it.
- It does not respond to a known compromise. If you know a key is exposed, the answer is immediate revocation, not a scheduled rotation.
- It does not improve deliverability. There is no reputation credit for fresh keys, and any advice claiming otherwise is selling something.
How often
Six months is the usual recommendation for keys you control and is a defensible default. The honest position is that the interval matters much less than these three things:
- The key is 2048-bit RSA.
- The private key is not sitting in a repository, a wiki or a backup that leaves the building.
- Old selectors are revoked rather than abandoned.
A quarterly rotation on a key stored in a shared drive
…is worse than an annual rotation on a key in a secrets manager, and takes four times the effort. Rotation frequency is the last variable to tune, not the first. Where the key lives is the first.