TIL: How to renew GPG subkeys on a smartcard
Written by Sebastian Dümcke on
Tags: TIL
The subkeys on my OpenPGP smartcard expired. I had set them to expire around Christmas each year. I created all keys in 2017 and successfully renewed then in 2018. This time, I changed the expiry on my public key and thought that would be enough. Sure enough when I wanted to sign some messages soon after, the program complained. I still do not fully understand the relationship between the master key (to which the public key is associated) and the subkeys for signing, encryption and authentication that I have moved to the smartcard. This weekend, I spent way too much time figuring out how to change the expiry of the subkeys without rotating them, even though I did it just one year ago. This time I will write the steps down:
#set gpg home to persistent storage on Tails #(my airgapped system containing the master key) export GNUPGHOME=~/Persistent/gnupg #get stubs from card gpg2 --card-status #edit keys gpg2 --edit-key keyid #select keys key 1 key 2 key 3 #renew subkeys expire 3y y #(enter private master key password) save #export public key gpg2 --armor --output publickey.txt --export keyid