Credential rotation with overlap window
Separates preparation, compatibility overlap, migration verification and irreversible old-key revocation. Original worked design example; adapt responsibilities, thresholds and assumptions to your system.
Rendering…
What this template contains
- Diagram type
- State diagram
- Source
- 11 lines
Make it your own.
stateDiagram-v2
[*] --> Active
Active --> Prepared: generate replacement
Prepared --> DualValid: deploy readers accepting both
DualValid --> Migrating: switch writers to new credential
Migrating --> Verified: observe all clients migrated
Migrating --> DualValid: unmigrated client detected
Verified --> Revoked: revoke old credential
Revoked --> Active: retire old material
Prepared --> Active: abort before distribution
DualValid --> Active: rollback before revocation