Esc
Certificate Rotation
Definition
Certificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise risks and ensuring continuous secure communications.
How it works
Certificate rotation should be performed when:
- Any certificate expires.
- A new CA authority is substituted for the old, thus requiring a replacement root certificate.
- New or modified constraints need to be imposed on one or more certificates.
- A security breach has occurred.
Considerations:
- Managing certificate rotation across an enterprise can be complex. Automated solutions, sold by multiple vendors, should be considered to manage this complexity.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , and .
Privilege Escalation
Access Token Manipulation
Account Manipulation
Credential Access
Brute Force
OS Credential Dumping
Steal or Forge Kerberos Tickets
Steal Application Access Token
Steal Web Session Cookie
Keychain
Unsecured Credentials
Forge Web Credentials
Steal or Forge Authentication Certificates
Defense Evasion
Access Token Manipulation
Use Alternate Authentication Material
References
All
Internet Article
The following references were used to develop the Certificate Rotation knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Password and Key Rotation
Reference Type: Internet Article Organization: SSH