38

Lets say I add an expiration date to a GPG/PGP key, then for some reason am unable to extend the expiration date of the key before its time is up.

Assuming I still have access to the private key (and the public key has only expired, not been revoked) can I still renew it?

|improve this question
  • Note: This would be quick and easy to test by simply creating a new key that expires in five minutes. However, I'm looking for answers such as "Yes, you can renew it in GPG, but some PGP clients will throw errors." or "No, if key's don't have an updated version when they expire, GPG will stop checking if a newer version is available on the keyserver." or "It's bad practice, create a new key pair instead." – IQAndreas Sep 18 '14 at 10:29
  • Yes; I see no reason it wouldn't be possible. SSL Certificates expire all the time, and are renewed after they had expired, furthermore just because the certificate expired does not mean the certificate can no longer used. – Ramhound Sep 18 '14 at 10:48
  • 1
    It's important to state that setting an expiration date for your key is no protection against it being compromised. A malicious attacker could, if he gets hold of your private key, still prolong the validity of the key. Therefore having a revocation certificate is still heavily recommended. – David Dec 2 '16 at 13:56
46

Yes, you can renew it at any time. Here's how to do it:

gpg --list-keys
gpg --edit-key (key id)

Now you're in the gpg console. (By default, you're working on the primary key.) If you need to update a sub-key:

gpg> key 1

Now you can set the expiration for the selected key:

gpg> expire
(follow prompts)
gpg> save

Now that you've updated your key, you can send it out:

gpg --keyserver pgp.mit.edu --send-keys (key id)

And, yes, having an expiration date for your keys is a very good idea. You should never really have a key with no expiration date. If it's compromised, it could be used forever.

|improve this answer
  • 2
    If it's compromised and the attacker renew the expiration, how? – fikr4n Sep 27 '17 at 13:06
  • @BornToCode, I can guess that in this case the real key owner has to revoke the key... game over for a hacker... – Drew May 2 '18 at 5:34
  • It seems that after the --send-keys you need to add the key ID – Krenair Aug 29 '18 at 22:29
23

According OpenPGP Best Practices on Riseup.net, yes, it is possible, and there don't seem to be any recommendations against it:

People think that they don’t want their keys to expire, but you actually do. Why? Because you can always extend your expiration date, even after it has expired! This “expiration” is actually more of a safety valve or “dead-man switch” that will automatically trigger at some point. If you have access to the secret key material, you can untrigger it. The point is to setup something to disable your key in case you lose access to it (and have no revocation certificate).

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.