# Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

## I have few sub-questions

1. Do secret keys get expired, or just the public key gets expired?
2. Do I have to back up the master sec key each time I renew it?

For an example:

Let's say I generate gpg keypair and ssb for signing, encrypting, and a revoked certificate. And I backup the master sec key, revoked certificate and place them somewhere safe, and remove master sec from the key-ring.

Then the pub and sub keys get expire so, I get a copy of master sec key from the safe place and re-import it to the key-ring for the sake of key renewing process. After that, can I just safely remove and delete that copy of master sec key from the key-ring? If so, is master sec key that I saved at the first place aware of these new renewed pub and sec keys, shouldn't I re-backup the sec key after using it for renewing process? and replace to the old sec key that I saved in the safe place?

What would happen If I generate a new ssb key for authentication after that renewal process? Is my master sec key that I saved in the safe place at the first aware of the newly generated ssb key? If so, how is my revoked certificate affect to these new keys? (new ssb keys, and renewed pub keys)

3. Do I have to re-generate revoke certificates each time after I renew the secret key, or can I just use the previously generated revoke certificate after renewing the key?

For an example:

First I generate a seckey and a revoked certificate, then I generate ssb key.

Then sec and ssb both get expire and I renew it for a next 6 months, then I lose my master sec key, so Is my revoke certificate still valid? can I revoke the key by importing the revoked certificate?

For 3:

I did a simple test and the results showed that after revising the private key, the old revocation certificate can still revoke the gpg public key.

Test steps:

1. Delete a uid

2. Export private key

3. Import the old revocation certificate, the public key is revoked

• Welcome to Cryptography. You can also add the commands and outputs to improve your answer. – kelalaka May 24 '20 at 10:29

Do secret keys get expired, or just the public key gets expired?

The private key does not expire. A public key expires, but only in the sense that the certificate(s) part of it expires. The public key value does not change when a renewed public key is issued.

Do I have to back up the master sec key each time I renew it?

No. Also, only the public key (or really, the certificate(s) in it) is renewed.

Do I have to re-generate revoke certificates each time after I renew the secret key

That's a difficult question. OpenPGP revocation certificates¹ contain a date, thus if one wants a revocation certificate with an updated date in it, yes. On the other hand, an old revocation certificate remains valid and usable. Thus the only reason I see to prepare a new revocation certificate in advance (so as to publish it in case of need to revoke) when the former is still available, would be to be able to send only the newer revocation certificate, in hope of conveying to its handlers that the signatures issued before that new date remain valid. But I don't know which (if any) handler of revocation certificates has that interpretation. Thus I wouldn't bother.

¹ not "revoke certificate". That's not a thing, or even a common action. One revokes a key by communicating a revocation certificate.