Rotating Key Pairs for Integration Credentials

Important:

This feature is currently under Public Preview. Please contact OneTrust Support to request early access.

Use key pair rotation to replace an expiring key pair for Snowflake credentials before authentication is interrupted. OneTrust also sends advance expiration notifications so you can generate a replacement key in time and maintain continuity during the transition.

Before you begin

Confirm that the credential uses key pair authentication for Snowflake
For Snowflake, add the new public key to the user configuration.

Note:

For more information, see Key-Pair Authentication for Snowflake Integration Credentials.

To rotate key pairs

On the Integrations menu, select Credentials.

The Credentials screen appears.
Select your active credential that uses a key pair.
Under the Key pair field, your current public key will be presented with the chosen expiration date.
If you have reached one of the expiration notification intervals, the current public key will note how many days are left.
If the public key has reached its expiration date, an Expired badge will be shown.
Click the Rotate key pair button to open a modal and choose a new expiration date. Click the Rotate key pair to confirm.
You will return to the screen with the new rotated key pair presented.
Copy or download the new public key.
Add it to the external system that uses the credential.
Keep the existing key active until the new key has been added and tested in the destination system.

Notification schedule

OneTrust sends notification emails before and after key expiration so you have time to generate a successor key and avoid interruptions. During the transition window, Snowflake credentials can continue using the current key first and then try the successor key if needed. This helps reduce disruption if the old key is removed from the external system before the transition is complete.


Interval	Action
90 days until expiration	Certificate expires in 90 days.
60 days until expiration	Certificate expires in 60 days.
30 days until expiration	Certificate expires in 30 days.
15 days until expiration	Certificate expires in 15 days
7 days until expiration	Certificate expires in 7 days, immediate action required.
1 day until expiration	Certificate expires tomorrow.
Expiration day	The current key is marked expired. If no replacement exists, a critical message prompts immediate action.
Days 1-7 after expiration	If no successor exists the certificate has expired with no replacement, the integration will fail.