docs: def RotateServerKey(cn=u"grr", keylength=4096):
    """This function creates and installs a new server key.
  
    Note that
  
    - Clients might experience intermittent connection problems after
      the server keys rotated.
  
    - It's not possible to go back to an earlier key. Clients that see a
      new certificate will remember the cert's serial number and refuse
      to accept any certificate with a smaller serial number from that
      point on.
  
    Args:
      cn: The common name for the server to use.
      keylength: Length in bits for the new server key.
  
    Raises:
      ValueError: There is no CA cert in the config. Probably the server
                  still needs to be initialized.
    """
    ca_certificate = config.CONFIG["CA.certificate"]
    ca_private_key = config.CONFIG["PrivateKeys.ca_key"]
  
    if not ca_certificate or not ca_private_key:
      raise ValueError("No existing CA certificate found.")
  
    # Check the current certificate serial number
    existing_cert = config.CONFIG["Frontend.certificate"]
  
    serial_number = existing_cert.GetSerialNumber() + 1
    EPrint("Generating new server key (%d bits, cn '%s', serial # %d)" %
           (keylength, cn, serial_number))
  
    server_private_key = rdf_crypto.RSAPrivateKey.GenerateKey(bits=keylength)
    server_cert = key_utils.MakeCASignedCert(
        str(cn),
        server_private_key,
        ca_certificate,
        ca_private_key,
        serial_number=serial_number)
  
    EPrint("Updating configuration.")
    config.CONFIG.Set("Frontend.certificate", server_cert.AsPEM())
    config.CONFIG.Set("PrivateKeys.server_key", server_private_key.AsPEM())
    config.CONFIG.Write()
  
    EPrint("Server key rotated, please restart the GRR Frontends.")