// Module included in the following assemblies:
//
// security/nbde-implementation-guide.adoc

:_mod-docs-content-type: PROCEDURE
[id="nbde-rekeying-tang-servers_{context}"]
= Rekeying Tang servers

This procedure uses a set of three Tang servers, each with unique keys, as an example.

Using redundant Tang servers reduces the chances of nodes failing to boot automatically.

Rekeying a Tang server, and all associated NBDE-encrypted nodes, is a three-step procedure.

.Prerequisites

* A working Network-Bound Disk Encryption (NBDE) installation on one or more nodes.

.Procedure

. Generate a new Tang server key.
. Rekey all NBDE-encrypted nodes so they use the new key.
. Delete the old Tang server key.
+
[NOTE]
====
Deleting the old key before all NBDE-encrypted nodes have completed their rekeying causes those nodes to become overly dependent on any other configured Tang servers.
====

.Example workflow for rekeying a Tang server
image::179_OpenShift_NBDE_implementation_0821_4.png[Rekeying a Tang server]
