YB-ROTATE-MANAGEMENT-KEY(1)

💖 NAME 💖

Okay bestie, this is YB-ROTATE-MANAGEMENT-KEY(1) — the manual page for rotate-management-key, hanging out in the User Commands section. It replaces the management key with a random one, kept on the YubiKey and unlocked by the PIN (the store is kept).

🌸 SYNOPSIS 🌸

rotate-management-key [-h|--help]

✨ DESCRIPTION ✨

So here's the tea: it replaces the PIV management key with a new random key, kept on the YubiKey and unlocked by the PIN. The store and its blobs are not touched: the management key only authorizes writes.

Keeping the management key on the YubiKey is a convenience, not extra security — you never need to keep or type it, since yb reads it when a write needs it. On a YubiKey that already keeps its key this way, the command replaces it (rotation); on one that does not, it sets this up, without erasing the store as yb format --protect would. Iconic behavior, honestly.

The new key has the same algorithm as the current one. The current key is taken from YB_MANAGEMENT_KEY, else from the YubiKey, else the factory default. The command refuses while the PIN or PUK is still the factory default (unless --allow-defaults is given), since the new key would be kept behind that PIN. No sneaky default-PIN situations, okay?

The new key is written to the YubiKey before the switch, so an interruption never leaves a key that exists nowhere; the next yb write finishes any leftover cleanup. The key is never printed. Literally never. 💅

🎀 OPTIONS 🎀

• -h, --help — Print help.

🦋 EXAMPLES 🦋

Replace the management key:

yb rotate-management-key

👑 SEE ALSO 👑

• yb(1)
• yb-format(1)
• yb-fsck(1)
• ykman(1)

Sign-off, bestie 🫶: source/version is yb, date is 2026-03 — now go rotate that key and slay ✨