From https://console.cloud.google.com/iam-admin/serviceaccounts?project=[id], a user with the right permissions can provision a service account key. Nowadays, they hand it to you in JSON format, but they used to give you the option to receive a P12 (of which the JSON is just the P12 base64'd, with metadata). I have inherited an older project to maintain, and I have a P12 to authenticate with.

However, there are multiple key IDs listed for the given service account. I'd like to rotate them all out and delete everything except for a newly provisioned key. I can't create a new one, because the max is already reached (10). But I can't delete at random, because the application still needs to run unhindered. Only one is needed, and short of roulette, I can't figure out a way to determine WHICH key I have.

I am able to authenticate:

[~/scratch]$ gcloud auth activate-service-account x@developer.gserviceaccount.com --key-file=x.p12 --prompt-for-password
WARNING: .p12 service account keys are not recomended unless it is necessary for backwards compatability. Please switch to a newer .json service account key for this account.
Activated service account credentials for: [x@developer.gserviceaccount.com]

and then run commands. But I can't find a way, either through Gcloud, or trickery, to get Google to tell me WHICH key I have. I've tried a bunch of gcloud commands. Is there anything in GCP logging, straight API calls, undocumented commands, or something obvious I've missed?

  • There's no way you can determine the ID from the key itself (regardless it being Json or p12). You have to dig into you apps and check which is using which key - it's a tedious task but there's no other way. But you may also try Google Support to get a proper help - I can't tell though it's feasible what you're asking. – Wojtek_B Aug 18 '20 at 10:13

The key ID is the SHA1 fingerprint of the accompanying certificate. You can extract the SHA1 fingerprint from the pkcs12 file with the following command:

openssl pkcs12 -in /your/pkcs12/file.p12 -nodes | openssl x509 -noout -fingerprint

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.