// Module included in the following assemblies:
//
// security/nbde-implementation-guide.adoc

:_mod-docs-content-type: PROCEDURE
[id="nbde-deleting-old-tang-server-keys_{context}"]
= Deleting old Tang server keys

.Prerequisites

* A root shell on the Linux machine running the Tang server.

.Procedure

. Locate and access the directory where the Tang server key is stored. This is usually the `/var/db/tang` directory:
+
[source,terminal]
----
# cd /var/db/tang/
----

. List the current Tang server keys, showing the advertised and unadvertised keys:
+
[source,terminal]
----
# ls -A1
----
+
.Example output
[source,terminal]
----
.36AHjNH3NZDSnlONLz1-V4ie6t8.jwk
.gJZiNPMLRBnyo_ZKfK4_5SrnHYo.jwk
Bp8XjITceWSN_7XFfW7WfJDTomE.jwk
WOjQYkyK7DxY_T5pMncMO5w0f6E.jwk
----

. Delete the old keys:
+
[source,terminal]
----
# rm .*.jwk
----

. List the current Tang server keys to verify the unadvertised keys are no longer present:
+
[source,terminal]
----
# ls -A1
----
+
.Example output
[source,terminal]
----
Bp8XjITceWSN_7XFfW7WfJDTomE.jwk
WOjQYkyK7DxY_T5pMncMO5w0f6E.jwk
----

.Verification

At this point, the server still advertises the new keys, but an attempt to decrypt based on the old key will fail.

. Query the Tang server for the current advertised key thumbprints:
+
[source,terminal]
----
# tang-show-keys 7500
----
+
.Example output
+
[source,terminal]
----
WOjQYkyK7DxY_T5pMncMO5w0f6E
----

. Decrypt the test file created earlier to verify decryption against the old keys fails:
+
[source,terminal]
----
# clevis decrypt </tmp/encryptValidation
----
+
.Example output
+
[source,terminal]
----
Error communicating with the server!
----

If you are running multiple Tang servers behind a load balancer that share the same key material, ensure the changes made are properly synchronized across the entire set of servers before proceeding.
