> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-rolling-keys-on-cards-issu.md).

# Roll keys on cards for a new SSK site

Migrate cards encoded with Gallagher Default keys to a new site's Site Specific Key.

When Command Centre is installed fresh from vEL8.20 onwards, a Site Specific Key is generated for that system. If cards were ordered from Gallagher Sales before that SSK was provided, the order is processed and the cards are encoded with the Gallagher Default keys. Those cards will not work on the site.

This procedure rolls the keys on those cards from the Default keys to the site's SSK.

### Export and save the SSK

> **Note.** This is critical. Save a copy before making any changes, because you will need it afterwards. Send the exported file to Gallagher Sales, separately from the password, so future card orders can be encoded correctly.

1. In Configuration Client, go to Server Properties > Card Security. The site shows the key seed masked with X characters.
2. Click **Export Keys…**.
3. Enter a strong password when prompted.

![Rolling keys step 2](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-be4a9b9f86f1dd9583b8766f140c43dbb3214e4d%2FSECHUB-CREDENTIALS-ROLLING-02.png?alt=media)

4. Save the exported file somewhere safe.

![Rolling keys step 3](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-994d1fc190a77742279245b3d4b4f59b2ac571cf%2FSECHUB-CREDENTIALS-ROLLING-03.png?alt=media)

5. Send the file to Gallagher Sales. Do not send the password with the file.

![Rolling keys step 4](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-8de5b90d55df7bea2d4367bf4336bcb91f96d74b%2FSECHUB-CREDENTIALS-ROLLING-04.png?alt=media)

### Revert to Gallagher Default keys

Now that the keys are safely stored, revert to the Default keys that the cards were encoded with.

6. Click **Set To Default** and confirm the warning dialog with Yes.
7. Click Apply and confirm the second warning dialog with Yes.
8. The system enters migration mode. Since no cards have been issued under the SSK yet, click **Manage Card Migration**, then **Stop Migration**.
9. Confirm the warning with Yes, then OK, then click Apply.

![Rolling keys step 8](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-ceeb2501974d41987feff8563382d9c7b0129985%2FSECHUB-CREDENTIALS-ROLLING-08.png?alt=media)

10. The system is now running Default keys, and the pre-encoded cards can be read by any configured T-series HBUS reader.

### Re-import the SSK and roll keys on cards

Re-import the SSK you saved, so the system can roll the keys on the cards.

11. Click **Import Keys…** and select the previously saved key file.
12. Enter the strong password and click OK, then confirm the warning dialog with Yes.

![Rolling keys step 10](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-c9e451c0d3ed15c72796e5fbe303f29f740e1f1f%2FSECHUB-CREDENTIALS-ROLLING-10.png?alt=media)

![Rolling keys step 11](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-da8ac4170a90c1f0adcb512f4c8a8457aebac62e%2FSECHUB-CREDENTIALS-ROLLING-11.png?alt=media)

13. Confirm the Default Application Key warning dialog with Yes.

![Rolling keys step 12](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-3bf8aa1844cb57cd3b3d5c4d9a5e3b241b2b005f%2FSECHUB-CREDENTIALS-ROLLING-12.png?alt=media)

14. Present each card to a configured reader, one at a time. Cards give Access Denied if they are not assigned access, but the key rolling still happens on presentation.
15. Once all the cards have been migrated, click **Manage Card Migration** and select **Stop Migration**. Confirm the warning with Yes, then OK.

![Rolling keys step 14](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-88f8155759009457f0ccef7db9f88ced53e69280%2FSECHUB-CREDENTIALS-ROLLING-14.png?alt=media)

### Confirm the migration

16. Click Apply. All cards are now migrated from the Gallagher Default keys to the SSK.

***

🔗 **Related**

* [Credentials - Site Specific Key (SSK) vs Default Site Key](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-site-specific-key-ssk-vs-d.md). What to do when the site has already issued cards under its SSK.
* [Credentials - SSK Migration and the 2 Modes](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-ssk-migration-and-the-2-mo.md). Choosing between an all-readers migration and a choke-point migration.
* [Credentials - Fault Finding Cards with Site Specific Keys](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-fault-finding-cards-with-s.md). Confirming that the single beep really is a key mismatch.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-rolling-keys-on-cards-issu.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.