Key rollover is the planned replacement of an existing cryptographic key with a new one. The transition is typically coordinated so systems that rely on the key can learn and trust its successor before the old key is retired.
Rollovers limit the risk of long-lived keys being exposed or becoming outdated, but they can cause failures when dependent systems are not updated. In DNSSEC, for example, a validating resolver needs the current root trust anchor to verify signed DNS data. If it misses a root Key Signing Key rollover, validation may fail and cause lookup or application errors. Defenders should identify systems using the key, enable managed updates where available, and monitor for errors during the transition.