:quality(75))
Adobe Commerce (Magento) 2.4.8 moves encryption key management out of the Admin panel and onto the command line. If key rotation currently sits with whoever has admin access, that changes.
What moved
Generating a new encryption key, rotating an existing one and re-encrypting sensitive data used to be Admin panel operations. In 2.4.8 they are CLI commands, which in practice means they belong to whoever has shell access — your infrastructure or operations team — rather than to general admin users.
Two things follow. Access to key operations narrows to a smaller, more carefully controlled group, and the operations leave a cleaner audit trail: who ran what, and when. If you hold payment card data or anything under a compliance regime, that second point is the one that matters.
Re-encryption comes with it
A new key is only half the job. Everything already encrypted in the database has to be re-encrypted with it, and 2.4.8 handles that in the same CLI process:
generates the new encryption key
identifies all encrypted data in your database
re-encrypts that data using the new key
verifies the operation completed successfully
On a large installation with a lot of encrypted data, that takes time. Treat a key rotation as scheduled work inside a maintenance window, not something you fire off between meetings.
What to change on your side
Write the procedure down. Make sure the people with shell access have actually run it. Rehearse a rotation in a non-production environment before you do it on a live store. Encryption keys are not a good place to discover your runbook was optimistic.
None of this is a large change in itself — it is a change of ownership. Key rotation stops being an admin task and becomes an operations one, so it is worth agreeing who owns it before you upgrade rather than the first time you need to rotate in a hurry.