Sebastian's personal website

TIL: How to renew GPG subkeys on a smartcard

Written by Sebastian Dümcke on
Tags:

The subkeys on my OpenPGP smartcard expired. I had set them to expire around Christmas each year. I created all keys in 2017 and successfully renewed then in 2018. This time, I changed the expiry on my public key and thought that would be enough. Sure enough when I wanted to sign some messages soon after, the program complained. I still do not fully understand the relationship between the master key (to which the public key is associated) and the subkeys for signing, encryption and authentication that I have moved to the smartcard. This weekend, I spent way too much time figuring out how to change the expiry of the subkeys without rotating them, even though I did it just one year ago. This time I will write the steps down:

#set gpg home to persistent storage on Tails 
#(my airgapped system containing the master key)
export GNUPGHOME=~/Persistent/gnupg
#get stubs from card
gpg2 --card-status
#edit keys
gpg2 --edit-key keyid
#select keys
key 1
key 2
key 3
#renew subkeys
expire
3y
y #(enter private master key password)
save
#export public key
gpg2 --armor --output publickey.txt --export keyid