|
| 1 | +--- |
| 2 | +kind:change |
| 3 | +title:Replace older SSH keys created by your application |
| 4 | +created_at:2014-12-12 |
| 5 | +author_name:jasonrudolph |
| 6 | +--- |
| 7 | +Back in February, we[improved the security audit trail for SSH keys](/changes/2014-02-24-finer-grained-scopes-for-ssh-keys/#keys-are-now-immutable). Soon, organizations will be able to block access for SSH keys that were created prior to those improvements. If your application relies on[deploy keys](/guides/managing-deploy-keys/#deploy-keys) or[user keys](/v3/users/keys/) for repository access, we recommend replacing any keys created before February 24, 2014. |
| 8 | + |
| 9 | +To ensure that your application is not affected by organizations blocking access to these keys,**you should replace the affected keys by January 15, 2015**. |
| 10 | + |
| 11 | +##How should you replace these keys? |
| 12 | + |
| 13 | +We recommend the following steps for identifying and replacing the affected keys. |
| 14 | + |
| 15 | +###1. Identify the affected keys |
| 16 | + |
| 17 | +You only need to replace keys that your application created prior to February 24, 2014. If you don't know when your app created a given key, you can get the creation timestamp from the API. The`created_at` property is available for[deploy keys](/v3/repos/keys/) and for[user keys](/v3/users/keys/#list-your-public-keys). |
| 18 | + |
| 19 | +###2. Inform the affected users |
| 20 | + |
| 21 | +Once you know which keys you need to replace, we recommend that you inform the affected users. |
| 22 | + |
| 23 | +For security, GitHub automatically sends an email to a user whenever a new SSH key is added to their account. Similarly, when a new deploy key is added to a repository, GitHub sends an email to the repository's administrators. When you replace your application's old keys with new ones, GitHub will email the affected users. To avoid surprising those users, you should alert them that you'll be replacing your keys. You may want to include a link to this post in your message. |
| 24 | + |
| 25 | +###3. Add a new key |
| 26 | + |
| 27 | +Use the API to add the new[deploy key](/v3/repos/keys/#create) or[user key](/v3/users/keys/#create-a-public-key). |
| 28 | + |
| 29 | +###4. Delete the old key |
| 30 | + |
| 31 | +Once your application is using the new key, use the API to delete the old one. There's an[API for deleting deploy keys](/v3/repos/keys/#delete) and an[API for deleting user keys](/v3/users/keys/#delete-a-public-key). |
| 32 | + |
| 33 | +##We're here to help |
| 34 | + |
| 35 | +As always, if you have any questions or concerns, please[get in touch][contact]. |
| 36 | + |
| 37 | +[contact]:https://github.com/contact?form[subject]=Replace+SSH+keys+created+by+application |