Help Center/ Data Encryption Workshop/ User Guide (Ally Region)/ KPS/ Using Key Pairs/ Replacing a Key Pair
Updated on 2026-03-19 GMT+08:00
View PDF
Share

Replacing a Key Pair

If your private key is leaked, you can use a new key pair to replace the public key of the ECS through the management console. After replacing the key pair, you need to use the private key of the new key pair to log in to the ECS, and the original private key cannot be used to log in to the ECS.

This section describes how to replace a key pair on the KPS console.

Prerequisites

  • The ECS whose key pair is to be replaced uses the public image provided by the cloud.
  • To replace the key pair, you can replace the public key of the user by modifying the /root/.ssh/authorized_keys file on the server. Ensure that the file is not modified before replacing the key pair. Otherwise, replacing the public key will fail.
  • The ECS must be in the Running state.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Click . Choose Security > Data Encryption Workshop.
  4. In the navigation pane on the left, click Key Pair Service.
  5. Click the ECS List tab, locate the target ECS in the list and click Replace in the Operation column. The key pair replacement dialog box is displayed.
  6. Select a new key pair from the drop-down list box of New Key Pair.
  7. Click Select File to upload the private key (in .pem format) of the original key pair or copy the private key content to the text box.

    • The private key to be uploaded or copied to the text box must be in the .pem format. If it is in the .ppk format, convert it by referring to "How Do I Convert the Format of a Private Key File?" in Data Encryption Workshop FAQs.

  8. The default port number is 22 and can be modified.

    Before using user-defined port, ensure that:

    • The key pair can be connected to the ECS using the port. For details about how to modify the security group configuration of an ECS, see "Configuring Security Group Rules".
    • Modify the default port of the ECS and ensure that the port is enabled. For details, see "How Can I Change a Remote Login Port?".
    • Modify the default port of the ECS and ensure that the port is enabled.

  9. Click OK. The ECS key pair will be replaced in about one minute.
Parent topic: Using Key Pairs