🧭
How to Guides for Coincashew Method Cardano SPOs
  • Maintenance and Daily Operations
    • How to Guides for SPOs using Coincashew Method
      • Adjust Node.Counter for KES
      • Renew KES Keys
      • Update Node and CLI to 8.0.0
      • Update Node to 9.1.1
      • Update cardano-submit-api
      • Update Mithril Signer
      • P2P Topology File Explained
      • How to Secure Pledge with Hardware Wallet
      • How to submit a vote as an SPO for Governance Actions
      • How to Delegate your SPO Wallet to a dRep
      • How to Add Pool Data from Cexplorer to your Grafana Dashboard
      • Answering SPO On-Chain Polls
      • Set up Blockfrost Ice Breakers
      • Update Blockfrost Ice Breaker
Powered by GitBook
On this page
  • Step 1 - Find the starting KES period
  • Step 2 - Look up Operational Certificate Numbers
  • Step 3 - Make a new KES pair
  • Step 4 - Verify the current value of your node.counter is valid.
  • Step 5 - Create the new node.cert
  • Step 6 - Copy node.cert and kes.skey back to your block producer node.
  • Step 7 - Restart Node on block producer
  • Step 8 - Check if correct
  • Congratulations you did it!
  • Step 10 - Back up
  • Contributors
  1. Maintenance and Daily Operations
  2. How to Guides for SPOs using Coincashew Method

Renew KES Keys

Typical procedure for renewing KES keys

PreviousAdjust Node.Counter for KESNextUpdate Node and CLI to 8.0.0

Last updated 5 months ago

UPDATED: 12/12/24 to include conway CLI comands

Credits to for documenting the procedure.

Please note: paths in this guide are based on guide on how to build a stake pool. Please adjust paths as necessary.

Step 1 - Find the starting KES period

On node run the following commands:

slotNo=$(cardano-cli conway query tip --mainnet | jq -r '.slot')
slotsPerKESPeriod=$(cat $NODE_HOME/${NODE_CONFIG}-shelley-genesis.json | jq -r '.slotsPerKESPeriod')
kesPeriod=$((${slotNo} / ${slotsPerKESPeriod}))
startKesPeriod=${kesPeriod}
echo startKesPeriod: ${startKesPeriod}

Write down this number you will need it when you run the steps on your Air Gapped Machine.

Step 2 - Look up Operational Certificate Numbers

There are two different methods you can use, please review and select your preferred method.

When it's time to update your KES you can run the following command on your block producer to confirm you have the correct Operational Certificate Numbers

Note path to node.cert and adjust if needed. Path in example is based off guide for setting up a stake pool.

cardano-cli conway query kes-period-info --mainnet  \
  --op-cert-file $NODE_HOME/node.cert

Results should look similar to the following:

✓ The operational certificate counter agrees with the node protocol state counter
✓ Operational certificate's kes period is within the correct KES period interval
{
    "qKesNodeStateOperationalCertificateNumber": 4,
    "qKesCurrentKesPeriod": 505,
    "qKesOnDiskOperationalCertificateNumber": 4,
    "qKesRemainingSlotsInKesPeriod": 6832926,
    "qKesMaxKESEvolutions": 62,
    "qKesKesKeyExpiry": "2022-09-22T21:44:51Z",
    "qKesEndKesInterval": 558,
    "qKesStartKesInterval": 496,
    "qKesSlotsPerKesPeriod": 129600
}

This line is the Operational Certificate that your pool used to mint its last block "qKesNodeStateOperationalCertificateNumber": 4,

This line is the counter number of your current Operational Certificate: "qKesOnDiskOperationalCertificateNumber": 4,

If these number are NOT the same, as for the example above NodeState=4 and OnDisk=5 then you need to rollback your counter. In this case the node counter would need to be rolled back from 5 to 4

Also If you have never made a block then you will need to rollback your counter to 0

Before you move to your air gapped machine, with Vasil upgrade your node.counter for KES must be just one count higher than the last OpCertC value for your last block. You can find this value on resources like adapool.org under blocks tab.

Write down this number you will need it when you run the steps on your Air Gapped Machine.

Step 3 - Make a new KES pair

KES files in this example with be created to our $NODE_HOME directory. Adjust if needed.

In this step we will create a new KES pair (kes.vkey and kes.skey)

cd $NODE_HOME
cardano-cli conway node key-gen-KES \
    --verification-key-file kes.vkey \
    --signing-key-file kes.skey

Step 4 - Verify the current value of your node.counter is valid.

cat $HOME/cold-keys/node.counter

For example, if your OpCertC value is 4 for your last block, then your node.counter should read "Next certificate issue number: 5" Likewise if you used CLI method if "qKesNodeStateOperationalCertificateNumber": 4, our node.counter should read "Next certificate issue number: 5"

Step 5 - Create the new node.cert

cd $NODE_HOME
cardano-cli conway node issue-op-cert \
    --kes-verification-key-file kes.vkey \
    --cold-signing-key-file $HOME/cold-keys/node.skey \
    --operational-certificate-issue-counter $HOME/cold-keys/node.counter \
    --kes-period <startKesPeriod> \
    --out-file node.cert

Step 6 - Copy node.cert and kes.skey back to your block producer node.

Copy your new node.cert and kes.skey file to your block producer node

Step 7 - Restart Node on block producer

Now restart cardano node on your block producer with following command

sudo systemctl restart cardano-node

Step 8 - Check if correct

Once you update your KES you can run the following command on your block producer to confirm you have the correct OpCertC

cardano-cli conway query kes-period-info --mainnet  \
  --op-cert-file $NODE_HOME/node.cert

Results should look similar to the following:

✓ The operational certificate counter agrees with the node protocol state counter
✓ Operational certificate's kes period is within the correct KES period interval
{
    "qKesNodeStateOperationalCertificateNumber": 4,
    "qKesCurrentKesPeriod": 505,
    "qKesOnDiskOperationalCertificateNumber": 5,
    "qKesRemainingSlotsInKesPeriod": 6832926,
    "qKesMaxKESEvolutions": 62,
    "qKesKesKeyExpiry": "2022-09-22T21:44:51Z",
    "qKesEndKesInterval": 558,
    "qKesStartKesInterval": 496,
    "qKesSlotsPerKesPeriod": 129600
}

The first line after checks should show last node counter. For our example the last OpCertC number for our last block was 4. So it should read: "qKesNodeStateOperationalCertificateNumber": 4,

The third line should match the next certificate issue number that we wanted. So, for our example it needed to be 5, ONE number higher than the OpCertC of 4. So it should look like: "qKesOnDiskOperationalCertificateNumber": 5,

Make note of "qKesKesKeyExpiry": date.

Congratulations you did it!

Step 10 - Back up

If update successful:

Best practice recommendation: It's now a good time to make a new backup of your new node.counter file and cold-keys directory to another USB drive or other offline location.

Contributors

Thanks to the following pools for helping to put together these guides. Please consider delegating to their pools to support them. Are you a pool? Consider buying them a coffee

To rollback your counter see our guide If, for example, NodeState and OnDisk =4, then you are all set and can proceed.

Navigate to your pool on . Once on your pool page click on the blocks tab and look at your last block. Look at the OpCertC column and make note of the number.

ON AIR GAPPED MACHINE: run the following commands:

STILL ON AIR GAPPED MACHINE:

navigate to where your node.counter file is. In this example it's located in our home directory in a folder called: cold-keys. So we run this command to output node.counter information.

Take note that "Next certificate issue number: x"

node.counter MUST be ONE greater than the most recently created block's OpCertC or "qKesNodeStateOperationalCertificateNumber" value. Depending which method you used in

If your "Next certificate issue number" is one higher you are all set and can continue to the

If it's not one higher you will need to adjust your node.counter see our guide If you just rolled back your node.counter then "description" will be blank. This is okay, it will correct itself after you run the .

STILL ON AIR GAPPED MACHINE: Create a new node.cert file with the following command.

Update <startKesPeriod> with the value from above from

Then run this command by replacing "<startKesPeriod>" with correct number from Example: --kes-period 503 \

Note path to node.cert and adjust if needed. Path in example is based off guide for setting up a stake pool.

⚠️
⚠️
📁
✍️
⚠️
here
Coincashew
Step 2
Step 5.
Step 1
Step 1
⚠️
⚠️
next step
Earn Coin Pool
Coincashew
Coincashew
adapools.org
Apex Cardano Pool - Ticker: APEX
Earn Coin Pool - Ticker: ECP
Envy Stake Pool - Ticker ENVY
PGWAD
xSPO Alliance
here