Deprecations and retirements¶

Deprecation notices are included within the release announcement pages. The pages within this section provide more detailed guidance, when applicable—for example processes for migrating workflows to support the new functionality.

November 2026: Specific private key formats no longer supported¶

To ensure that DataRobot is providing a secure and reliable platform, security measures are kept in compliance with the latest security standards. Review stored credentials in the credential manager to ensure all passwords encode to at least 14 bytes (112 bits) and that any user-supplied private keys are FIPS compliant. Compliance requires a FIPS-approved cipher and a salt length of at least 16 bytes (128 bits).

After November 2026, DataRobot will no longer support the following private keys:

• Keys encrypted with Triple DES (3DES), ARIA, or Camellia.
• Keys in the PBES1 format.
• Legacy PEM keys (files beginning with BEGIN RSA PRIVATE KEY).

Keys with a salt shorter than 16 bytes or a passphrase shorter than 14 characters remain unsupported. Security support has ended for the OpenSSL version behind DataRobot's FIPS-validated cryptography, so this change aligns the platform with NIST FIPS-approved algorithms.

What you need to do¶

Check the private key in each of your Snowflake key-pair credentials. If a key is affected, re-encrypt it and update the credential.

1. Check whether your key is affected.

   1. Check the private key file's first lines with head -2 rsa_key.p8. If it shows BEGIN RSA PRIVATE KEY followed by Proc-Type: 4,ENCRYPTED, the key is a legacy PEM key and is affected. Skip to step 2.
   2. Check the cipher and format with openssl asn1parse -in rsa_key.p8 | grep -iE 'des|aria|camellia|pbeWith'. Any output means the key is affected.
   3. Check the salt length with openssl asn1parse -in rsa_key.p8 | grep -A2 PBKDF2. If the OCTET STRING line shows l= 8, the salt is too short.
   4. Check the passphrase length. If it's shorter than 14 characters, the key is affected.

2. Re-encrypt the key.

   Use OpenSSL 3.2 or later and a passphrase of at least 14 characters to run:

   openssl pkcs8 -topk8 -v2 aes-256-cbc -saltlen 16 -in rsa_key.p8 -out rsa_key_aes.p8
   

   This command also converts PBES1 and legacy PEM keys. Earlier OpenSSL versions can't generate a 16-byte salt. On macOS, the built-in openssl is LibreSSL and doesn't support -saltlen, so install OpenSSL 3.2 or later to run the command. You can check which version you have with openssl version.

3. Update the credential in DataRobot.

   In Credential management, edit the credential and replace the private key with rsa_key_aes.p8. You don't need to change anything in Snowflake. Re-encrypting the private key does not change the underlying key pair, so the registered public key remains the same.

Deprecations and retirements¶

See the following pages for more information.