Generate Pool Keys

Dingo Node - Block Production Keys

We will now generate the pool keys needed for block production on the Preview network.

Key	Purpose	Where it lives
Cold key (node.skey / node.vkey)	Authorizes pool registration and KES rotation	Air-gapped machine only — never transferred
KES key (kes.skey / kes.vkey)	Signs blocks; rotated before KES expiration	kes.skey - Block producer
VRF key (vrf.skey / vrf.vkey)	Proves slot leadership	vrf.skey - Block producer
Operational certificate (node.cert)	Binds KES key to cold key for the node	Block producer

For background on what these keys do, see Cardano Key Pairs.

⚠️ The following guide assumes you have already completed the following 3 steps. If not please complete them first and return here when you are done.

1. Complete the Quick Start guide.

2. Create Startup Service

3. Install Cardano CLI

✅ This guide assumes your files are in the $HOME/dingo folder. Adjust paths below if necessary.

Step 1 - Generate KES key pair

cd ~/dingo
cardano-cli conway node key-gen-KES \
--verification-key-file kes.vkey \
--signing-key-file kes.skey

Step 2 - Make a directory to store your cold keys

⚠️ On an air-gapped machine

mkdir $HOME/dingo/cold-keys
pushd $HOME/dingo/cold-keys

Step 3 - Generate a set of cold keys and create the cold counter file

⚠️ On an air-gapped machine

cardano-cli conway node key-gen \
--cold-verification-key-file node.vkey \
--cold-signing-key-file node.skey \
--operational-certificate-issue-counter node.counter

Step 4 - Find the starting KES period

We need the Shelley Genesis json file to run our CLI command

We will create a directory to store our Cardano configuration files. For this example, we will use the following directory structure /config/cardano/preview/ by running the following command in our dingo directory:

cd ~/dingo
mkdir -p config/cardano/preview

Next, navigate to the config/cardano/preview folder and download the Cardano Shelley Genesis file.

cd config/cardano/preview

To download the Shelley Genesis file, run:

wget https://book.play.dev.cardano.org/environments/preview/shelley-genesis.json

💡 Tip: Cardano Configuration Files can be found at https://book.play.dev.cardano.org/environments.html

Now we can find the starting KES period by running:

slotNo=$(cardano-cli conway query tip --testnet-magic 2 | jq -r '.slot')
slotsPerKESPeriod=$(cat $HOME/dingo/config/cardano/preview/shelley-genesis.json | jq -r '.slotsPerKESPeriod')
kesPeriod=$((${slotNo} / ${slotsPerKESPeriod}))
startKesPeriod=${kesPeriod}
echo startKesPeriod: ${startKesPeriod}

📝 WRITE DOWN THIS NUMBER

Step 5 - Generate the operational certificate for your pool

✅ Change the value you wrote down in the previous step.

⚠️ On an air-gapped machine once you have copied kes.vkey to your cold environment.

cd ~/dingo
cardano-cli conway node issue-op-cert \
--kes-verification-key-file kes.vkey \
--cold-signing-key-file $HOME/dingo/cold-keys/node.skey \
--operational-certificate-issue-counter $HOME/dingo/cold-keys/node.counter \
--kes-period <startKesPeriod> \
--out-file node.cert

Step 6 - Copy node.cert to your hot environment

Copy your node.cert file to your Block Producer.

Step 7 - Generate a VRF key pair

cd ~/dingo
cardano-cli conway node key-gen-VRF \
--verification-key-file vrf.vkey \
--signing-key-file vrf.skey

Step 8 - Update VRF key permissions to read-only. You must also copy vrf.vkey to your cold environment.

chmod 400 vrf.skey

Reminder
Section titled “Reminder”

Block-producing Node The only stake pool keys and certs that should be stored on the block producer, are the following three files:
###
### On block producer node
###
KES = kes.skey
VRF = vrf.skey
CERT = node.cert
All other keys must remain offline in your air-gapped cold environment.

Relay Nodes Relay nodes must NOT store any operational certificates, VRF keys, signing keys or cold keys.