When I generated by PGP key using GnuPG, I created a revocation certificate, in case I lost control of the master private key.

Will this revocation certificate be valid for my PGP key, regardless of modifications made to it in future? Or, are there changes to the key which require regeneration of a revocation certificate (e.g. extension of expiry date, addition/removal of subkeys, changing user IDs)?

  • 1
    Protect your revocation certificate, as someone could use it as denial of service against your key. Best to keep it offline on a USB key or burnt on a CD. But it is wise to generate one in advance, as you say, in case you lose your private key and want to keep people from continuing to encrypt messages for that key.
    – nbering
    Jul 27, 2018 at 22:57

1 Answer 1


The revocation certificate is for your Certify ("master") key, which does not change regardless of any subkeys or identities you add.

  • Okay thanks, that makes sense. After posting the question I gave this some more thought and realized that revocation certificates would be useless if they only worked for the key in a specific state. In this case, all an attacker in possession of your private master key would need to do to invalidate a revocation certificate would be to do some operation on the key (e.g. add a new identity or subkey). Jul 28, 2018 at 8:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .