Package org.acemq.amqp.crypto

Interface Keyring

All Known Implementing Classes:
Keyring.StaticKeyring
public interface Keyring
The keys a service can write with and the keys it can read with.

Those are not the same set, and that asymmetry is the whole of key rotation. A service writes with exactly one key — the current one — and must be able to read with every key any message still in flight was written with. Rotating means adding a key and making it current, while the old ones stay readable until nothing written with them is left. 


 Keyring keys = Keyring.builder()
         .add("orders-2026-06", june)     // still on some queue somewhere
         .current("orders-2026-09", now)  // everything new
         .build();

Two methods, so a real one backed by a key management service is a small class. Implement it against AWS KMS, Vault, or whatever already holds your secrets; builder() is for keys that arrive as configuration.

Implementations should cache. keyFor(String) is called for every message decoded, and a key management service charged per call will notice.

  • Method Details

    • current

      EncryptionKey current()
      Returns:
      the key to write with. Consulted per message, so a keyring that reloads from a secret store can change what this returns and the next message uses the new key

    • keyFor

      SecretKey keyFor(String keyId)
      Parameters:
      keyId - an identifier read out of a message
      Returns:
      the key it names
      Throws:
      AceMqException - if this keyring does not hold it. That is the normal shape of "a key was retired too early", so the message should say which identifier was missing

    • of

      static Keyring of(String id, SecretKey key)
      Parameters:
      id - what messages will name the key
      key - the key
      Returns:
      a keyring holding one key, which both writes and reads

    • builder

      static Keyring.Builder builder()
      Returns:
      a builder for a keyring whose keys are known up front