Sourced guide

Tailscale key expiry: never get locked out of your own servers

A node whose key expires drops off your tailnet — and if it is the box you reach everything else through, you are locked out. For always-on servers, disable key expiry deliberately.

What goes wrong

Every device on a tailnet authenticates with a node key that expires on a schedule. That default is sensible for laptops and phones. It is dangerous for a server you must always reach: when its key expires, the node drops off the network, and if it was your path in, you have no way back.

The fix

In the Tailscale admin console, open the machines list, find the always-on server, and disable key expiry for that node. With expiry off it stays reachable indefinitely.

Do this for the specific servers that must never drop — a bastion host, a rescue console, the box other machines route through — not for every device. Expiry is a real security control; turn it off only where being locked out is the bigger risk.

If you are already locked out

Reach the machine over an out-of-band path first — a provider rescue console or physical access — re-authenticate it, then disable key expiry so it cannot happen again. Make disabling expiry part of provisioning: do it the moment you add a permanent server, not the day its key drops.