140

Lets say I add an expiration date to a GPG/PGP key, then for some reason am unable to extend the expiration date of the key before its time is up.

Assuming I still have access to the private key (and the public key has only expired, not been revoked) can I still renew it?

4
  • 2
    Note: This would be quick and easy to test by simply creating a new key that expires in five minutes. However, I'm looking for answers such as "Yes, you can renew it in GPG, but some PGP clients will throw errors." or "No, if key's don't have an updated version when they expire, GPG will stop checking if a newer version is available on the keyserver." or "It's bad practice, create a new key pair instead."
    – IQAndreas
    Commented Sep 18, 2014 at 10:29
  • 3
    It's important to state that setting an expiration date for your key is no protection against it being compromised. A malicious attacker could, if he gets hold of your private key, still prolong the validity of the key. Therefore having a revocation certificate is still heavily recommended.
    – David
    Commented Dec 2, 2016 at 13:56
  • Conforming software should treat an expired certificate as just that and complain. An expired PGP key pair should be treated the similarly by conforming software. Yes, technically they could still be used, but for certain operations you'll even want to extend the validity for convenience reasons. For certificates however, I am not aware of a way to extend the validity after the fact. It may technically be possible with the help of the CA that issued the certificate and signed it, but the usual way is renewal. For PGP key pairs you may unilaterally extend validity and announce it through ... Commented Jan 2, 2023 at 0:00
  • ... an updated public key which you distribute whichever way you please. Commented Jan 2, 2023 at 0:00

4 Answers 4

189

Yes, you can renew it at any time. Here's how to do it:

gpg --list-keys
gpg --edit-key (key id)

Now you're in the gpg console. (By default, you're working on the primary key.) If you need to update a sub-key:

gpg> key 1

Now you can set the expiration for the selected key:

gpg> expire
(follow prompts)
gpg> save

Now that you've updated your key, you can send it out:

gpg --keyserver pgp.mit.edu --send-keys (key id)

And, yes, having an expiration date for your keys is a very good idea. You should never really have a key with no expiration date. If it's compromised, it could be used forever.

4
  • 12
    If it's compromised and the attacker renew the expiration, how?
    – fikr4n
    Commented Sep 27, 2017 at 13:06
  • @BornToCode, I can guess that in this case the real key owner has to revoke the key... game over for a hacker...
    – drew1kun
    Commented May 2, 2018 at 5:34
  • After extending the primary key, it says "your encryption subkey expires soon, you can also modify it". Is there a way to extend all subkeys at once? Commented May 23, 2022 at 15:59
  • Also very good read about security added by expiration dates and revocation certificate: security.stackexchange.com/a/79386/113888
    – Taylan
    Commented Apr 7 at 7:34
60

According OpenPGP Best Practices on Riseup.net (archived)1, yes, it is possible, and there don't seem to be any recommendations against it:

People think that they don’t want their keys to expire, but you actually do. Why? Because you can always extend your expiration date, even after it has expired! This “expiration” is actually more of a safety valve or “dead-man switch” that will automatically trigger at some point. If you have access to the secret key material, you can untrigger it. The point is to setup something to disable your key in case you lose access to it (and have no revocation certificate).


[1]: The link now points to an Internet Archive entry as the original one is dead.

17

Since I don't want to hijack the excellent answer by Sauce McBoss, here's a quicker way that corresponds to the method shown there:

  1. gpg -Kv --with-subkey-fingerprints (= gpg --list-secret-keys --verbose --with-subkey-fingerprints), since you can only change the expiry of keys you own anyway
    • Note down the primary key fingerprints you want to change
  2. for each fingerprint recorded above do:
    gpg --quick-set-expire $KEYID $DURATION
    gpg --quick-set-expire $KEYID $DURATION '*'
    
    • first command changes primary key expiry, second one the expiry for all subkeys (use a subkey fingerprint instead of '*' if desired)
    • $KEYID is the ID that unambiguously identifies a key
    • $DURATION is a number of days (default), 0 for no expiration or a number directly followed by w, m, or y to mean weeks, months and years respectively.

Hint: If like me you prefer some "clean" expiry dates, you can use the faketime utility to invoke gpg --quick-set-expire to control the exact time of day for the expiry. Otherwise this will be governed by your current time of day.

Note: may only work reliably if your primary key and subkeys haven't been expired and are deemed valid.

Tested with gpg (GnuPG) 2.2.19.


Respective part from the man page gpg(1):

--quick-set-expire fpr expire [*|subfprs]

With two arguments given, directly set the expiration time of the primary key identified by fpr to expire. To remove the expiration time 0 can be used. With three arguments and the third given as an asterisk, the expiration time of all non-revoked and not yet expired subkeys are set to expire. With more than two arguments and a list of fingerprints given for subfprs, all non-revoked subkeys matching these fingerprints are set to expire.

1
  • 2
    quick-set-expire will ignore expired keys in 2.2.40 ("With three arguments and the third given as an asterisk, the expiration time of all non-revoked and not yet expired subkeys are set to expire.")
    – sanmai
    Commented Jan 1 at 14:41
2

Under Ubuntu, it seems you can manage your keys with a graphical interface by searching for the Keys and Passwords application (Press the super key and type "keys" or etc).

Once it launches, click on "GnuPG keys" on the left, and then on the key you wish to update. You can now click on the calendar icon if it's expired to update the expiration date.

It seems this GUI can also be launched from the command line by typing seahorse.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .