SeanOMik
/
YubiKey-Guide
mirror of https://github.com/SeanOMik/YubiKey-Guide.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #177 from apiraino/revoke-cert 

Add instructions to create a revoke certificate
This commit is contained in:
drduh 2020-05-03 18:11:37 +00:00 committed by GitHub
parent afd3fafcc5 2698cecd4c
commit a1a4a303f9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
README.md
View File

@ -27,6 +27,7 @@ If you have a comment or suggestion, please open an [Issue](https://github.com/d
* [Authentication](#authentication) * [Authentication](#authentication)
* [Add extra emails](#add-extra-emails) * [Add extra emails](#add-extra-emails)
- [Verify](#verify) - [Verify](#verify)
- [Create a revoke certificate](#create-a-revoke-certificate)
- [Export](#export) - [Export](#export)
- [Backup](#backup) - [Backup](#backup)
- [Configure Smartcard](#configure-smartcard) - [Configure Smartcard](#configure-smartcard)
@ -858,6 +859,20 @@ $ gpg -o \path\to\dir\mastersub.gpg --armor --export-secret-keys $KEYID
$ gpg -o \path\to\dir\sub.gpg --armor --export-secret-subkeys $KEYID $ gpg -o \path\to\dir\sub.gpg --armor --export-secret-subkeys $KEYID
``` ```
# Create a revoke certificate
Although we will backup and store the master key in a safe place, it is best practice to never rule out the possibility of losing it or having the backup fail. Without the master key it will be impossible to renew or rotate subkeys or generate a revoke certificate, our keychain will be basically useless.
Even worse, we cannot advertise this fact in any way to those that are using our keys. It is therefore safe to assume that at some point in the future this *will* happen and the only thing that will allow us to deprecate our *orphan* keys is a revoke certificate.
In order to create the revoke certificate:
``` console
gpg --output revoke.asc --gen-revoke $KEYID
```
The newly created `revoke.asc` file should be stored (or printed) in a place that allows us to retrieve it in case our backup strategy fails.
# Backup # Backup
Once keys are moved to YubiKey, they cannot be moved again! Create an **encrypted** backup of the keyring and consider using a [paper copy](https://www.jabberwocky.com/software/paperkey/) of the keys as an additional backup measure. Once keys are moved to YubiKey, they cannot be moved again! Create an **encrypted** backup of the keyring and consider using a [paper copy](https://www.jabberwocky.com/software/paperkey/) of the keys as an additional backup measure.