How rotate RSA keys and how work with old encrypted data

Question

I am planning to use the RSA for encryption my data and I am wondering - I've generated the keys pair with some limited expiration time and I will use this private and public keys for the purpose of encryption and decryption and in one time the certificate will be expired.

How can I use the new certificate? What is the best scenario if my old certificate is expired and I want to have an access to my old encrypted data - do I need to re-encrypted all my old data with new certificate or what is the best practice for that?

Answer 1

I've generated the keys pair with some limited expiration time and I will use this private and public keys for the purpose of encryption and decryption and in one time the certificate will be expired

First - do you have a particular reason why would use short lifetime for the keys? Often there is no reason for that. Still, there should be a way how to replace the PKI keys when needed.

From the comments seems you are designing a new system, what gives you more flexibility. I will try to build an answer from the comments

RSA has some limitations. You can encrypt only data shorter than the key size and as someone already mentioned in another answer - RSA is good at hiding random-looking data.

How PKI (RSA) is used to encrypt data - usually a random symmetric key is generated to encrypt the data (with arbitrary length using a symmetric cipher) and RSA is used only to encrypt (wrap) the symmetric key. see the hybrid cryptosystyem

what alg do you recommend for symmetric encryption?

you have plenty to choose... try to type openssl list-cipher-algorithms something standard would be good, just don't reinvent anything own. AES-128-CBC could be good start

Is it possible decrypt the symmetric key with expired certificate (private key)?

now - a homework for you. find out what is difference between a certificate and a public key..

nothing prevents you to use the public key to en(de)crypt even the certificate is expired.