Comparison
Certificate rotationvsSecret rotation
Certificate rotation
everything worked for a year and then stopped at once on a Sunday, because a certificate nobody owned had expired.
Replacing TLS certificates before they expire, ideally automatically. Expiry is a uniquely predictable outage that keeps happening because it is invisible until the day, the owner has often left, and internal certificates are excluded from the external monitoring that would have caught it. Short-lived automatically-renewed certificates are strictly safer, because a renewal path exercised daily is one you know works.
Full entry →Secret rotation
you replace the API key on a schedule, which means the system must tolerate two valid keys at once during the changeover.
Periodically replacing credentials so that an undetected leak has a bounded lifetime. The mechanism that makes it possible is overlap: accept both old and new during a window, or every rotation is an outage. A secret that cannot be rotated without downtime will not be rotated.
Full entry →