Certificate rotation

Certificate rotation means replacing certificates regularly, before they expire and before anyone has reason to suspect them. A stolen or leaked certificate is only useful until it’s replaced, so frequent rotation limits the damage. Doing it by hand across many machines is slow and error-prone, so it’s usually automated.

Rotation in Managed Nebula

Every host on a Managed Nebula network identifies itself with a certificate signed by the network’s certificate authority, and Defined Networking rotates both for you.

DNClient picks up each new host certificate from Defined Networking’s API. Other hosts check certificates against the CA instead of keeping a copy of each one, so a host’s new certificate doesn’t have to be sent anywhere else. During the next handshake, its peers verify the new certificate against a CA they already trust, and there’s nothing for them to update.

Defined Networking also creates several CAs for each account and rotates them periodically, sending the new CA certificates to every host so they trust certificates it signs.

Rotation vs revocation

Rotation replaces certificates on a schedule. Revocation cuts a host off right away. In Managed Nebula you revoke a host by blocking it in the admin panel or the API, and within 60 seconds every host that can reach Defined Networking stops trusting its certificate (see Zero trust networking).

API keys used to automate Managed Nebula aren’t rotated automatically. See Rotating API keys. For how certificates and keys fit together, see PKI.