Create a revocation certificate in advance for an OpenPGP key so it can be revoked after loss or compromise.
Store the certificate offline.
Which command is appropriate?
gpg --generate-revocation KEYID creates a certificate containing revocation information. Keep it on a separate medium and import it when necessary.
Detailed explanation
gpg --delete-key KEYIDIncorrect. Deleting a local public key does not notify others that it is revoked.
Incorrect. Deleting a local public key does not notify others that it is revoked.
gpg --export KEYIDIncorrect. --export exports a key rather than generating a revocation certificate.
Incorrect. --export exports a key rather than generating a revocation certificate.
gpg --refresh-keys KEYIDIncorrect. --refresh-keys retrieves updated key data.
Incorrect. --refresh-keys retrieves updated key data.
gpg --generate-revocation KEYIDCorrect. It generates a revocation certificate for the key.
Correct. It generates a revocation certificate for the key.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '--generate-revocation KEYID -> create revocation certificate'Expected result
--generate-revocation KEYID -> create revocation certificateKey points
- Generate in advance
- Store offline
- Local deletion is not revocation
Notes
- Environment: GnuPG revocation command対応表
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.