Add support for key rotation [#3563227]

Problem/Motivation

https://symfony.com/doc/current/configuration/secrets.html#rotating-secrets

Key rotation can be considered and "advanced technical feature" so only supporting that as a Drush command could be fine. :tm:

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork 3562833-3563227

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3563227-secret-rotation changes, plain diff MR !5
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

15 December 2025 at 13:41

mxr576 created an issue. See original summary.

Comment #2

mxr576

Hungarian

Hungary

commented 16 December 2025 at 09:24

For this we have to be able store and identify multiple public/private key pairs and we have to introduce the notion of "active key".

The active key pair id could be stored in configuration.

Comment #3

mxr576

Hungarian

Hungary

commented 16 December 2025 at 09:41

The system also needs to know which encryption key (key pair) was used to create an encrypted key value. This information could be stored by the easy encrypted key provider.