Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Managing digital signature key pairs

Written by
Updated at September 17, 2026
View in Markdown

You can use Key Management Service to create, update, and delete digital signature key pairs.

Creating a digital signature key pair

To create a digital signature key pair:

  1. In the management console, select the folder where you want to create your key pair.

  2. Navigate to Key Management Service.

  3. In the left-hand panel, select Asymmetric keys.

  4. Click Create key. In the window that opens:

    1. Enter a name and, optionally, a description.
    2. In the Type field, select Signature.
    3. In the Algorithm field, select the signature algorithm.
    4. Enable deletion protection, if required.
    5. Click Create.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for creating a digital signature key pair:

    yc kms asymmetric-signature-key create --help

  2. Get the ID of the folder where you want to create your key pair.

  3. Create your digital signature key pair:

    yc kms asymmetric-signature-key create \
  --name <key_pair_name> \
  --folder-id <folder_ID> \
  --signature-algorithm <signature_algorithm>

    Where:

    • --name: Name of the digital signature key pair.

    • --folder-id: ID of the folder to host the new key pair.

    • --signature-algorithm: Digital signature algorithm. The following ECDSA and RSA algorithms are available:

      • rsa-2048-sign-pss-sha-256
      • rsa-2048-sign-pss-sha-384
      • rsa-2048-sign-pss-sha-512
      • rsa-3072-sign-pss-sha-256
      • rsa-3072-sign-pss-sha-384
      • rsa-3072-sign-pss-sha-512
      • rsa-4096-sign-pss-sha-256
      • rsa-4096-sign-pss-sha-384
      • rsa-4096-sign-pss-sha-512
      • ecdsa-nist-p256-sha-256
      • ecdsa-nist-p384-sha-384
      • ecdsa-nist-p521-sha-512
      • ecdsa-secp256-k1-sha-256

    Result:

    id: abj9g2dil5sj********
folder_id: b1gt6g8ht345********
created_at: "2023-08-16T09:06:57Z"
name: sample-signature-key
status: ACTIVE
signature_algorithm: RSA_2048_SIGN_PSS_SHA_512

Updating a digital signature key pair

After creating a key pair, you can change its name, description, and labels, as well as enable or disable deletion protection.

To update a digital signature key pair:

  1. In the management console, select the folder containing the key pair.

  2. Navigate to Key Management Service.

  3. In the left-hand panel, select  Asymmetric keys.

  4. Navigate to the Signature tab.

  5. In the key pair row, click and select Edit. In the window that opens:

    1. Change the key pair attributes as appropriate.
    2. Click Save.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for updating a digital signature key pair:

    yc kms asymmetric-signature-key update --help

  2. Get the ID of the folder containing the key pair.

  3. Get the ID of the required digital signature key pair by specifying the folder ID:

    yc kms asymmetric-signature-key list \
  --folder-id <folder_ID>

    Result:

    +----------------------+----------------------+---------------------------+---------------------+--------+
|          ID          |         NAME         |    SIGNATURE ALGORITHM    |     CREATED AT      | STATUS |
+----------------------+----------------------+---------------------------+---------------------+--------+
| abj9g2dil5sj******** | sample-signature-key | RSA_2048_SIGN_PSS_SHA_512 | 2023-08-16 09:06:57 | ACTIVE |
+----------------------+----------------------+---------------------------+---------------------+--------+

  4. Update the digital signature key pair:

    yc kms asymmetric-signature-key update \
  --id <key_pair_ID> \
  --new-name <new_key_pair_name> \
  --deletion-protection

    Where:

    • --id: ID of the digital signature key pair.
    • --new-name: New name for the key pair.
    • --deletion-protection: Flag to enable deletion protection. To disable key pair deletion protection, use the --no-deletion-protection flag.

    Result:

    id: abj9g2dil5sj********
folder_id: b1gt6g8ht345********
created_at: "2023-08-16T09:06:57Z"
name: sample-new-key
status: ACTIVE
signature_algorithm: RSA_2048_SIGN_PSS_SHA_512
deletion_protection: true

    The above command renamed the digital signature key pair and enabled its deletion protection.

Deleting a digital signature key pair

To delete a digital signature key pair:

  1. In the management console, select the folder containing the key pair.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Asymmetric keys.
  4. Navigate to the Signature tab.
  5. In the key pair row, click and select Delete.
  6. Confirm the deletion.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for deleting a signature key pair:

    yc kms asymmetric-signature-key delete --help

  2. Get the ID of the folder containing the key pair.

  3. Get the ID of the required digital signature key pair by specifying the folder ID:

    yc kms asymmetric-signature-key list \
  --folder-id <folder_ID>

    Result:

    +----------------------+----------------------+---------------------------+---------------------+--------+
|          ID          |         NAME         |    SIGNATURE ALGORITHM    |     CREATED AT      | STATUS |
+----------------------+----------------------+---------------------------+---------------------+--------+
| abj9g2dil5sj******** | sample-signature-key | RSA_2048_SIGN_PSS_SHA_512 | 2023-08-16 09:06:57 | ACTIVE |
+----------------------+----------------------+---------------------------+---------------------+--------+

  4. Delete the digital signature key pair by specifying its ID:

    yc kms asymmetric-signature-key delete \
  --id <key_pair_ID>

    Result:

    done (1s)
id: abj9g2dil5sj********
folder_id: b1gt6g8ht345********
created_at: "2023-08-16T09:06:57Z"
name: sample-new-key
signature_algorithm: RSA_2048_SIGN_PSS_SHA_512
Previous
Access permissions for an asymmetric key pair
Next
Access permissions for a digital signature key pair