| name | recreate-private-keys |
| description | Recreate private key shares for a Charon cluster while keeping the same validator public keys |
| user-invokable | true |
Recreate Private Keys
Warning: This is an alpha feature and is not yet recommended for production use.
Refresh private key shares held by operators while keeping the same validator public keys. Validators stay registered on the beacon chain - only the operator key shares change. All operators must participate simultaneously.
Use Cases
- Security concerns: private key shares may have been compromised
- Key rotation: regular security practice
- Recovery: after a security incident
Prerequisites
Before running, verify:
.env file exists with NETWORK and VC variables set.charon directory with cluster-lock.json and validator_keys- Docker is running
jq installed
Read scripts/edit/recreate-private-keys/README.md for full details if needed.
Execution
Ask the user whether they want to run with --dry-run first to preview the operation.
./scripts/edit/recreate-private-keys/recreate-private-keys.sh [--dry-run]
Set WORK_DIR env var to override the repository root directory if running from a custom location.
The script will:
- Validate prerequisites
- Stop the VC container and export the anti-slashing database
- Run a P2P ceremony (all operators must participate simultaneously)
- Update ASDB pubkeys to match new key shares
- Stop containers
- Backup
.charon/ to ./backups/
- Install new key shares
- Import updated ASDB
- Print commands to start containers manually
After completion, remind the user to wait ~2 epochs before starting containers.
Remind the user that all operators must run this script at the same time for the P2P ceremony to succeed.
