After creating an OpenPGP key pair in GnuPG, if I list keys with gpg --list-keys, I get (GnuPG default):

pub   2048R/BC589B05 2015-07-15
uid                  Some One
sub   2048R/3dd81C42 2015-07-15

Consisting the primary public key with ID BC589B05, and sub key with ID 3dd81C42.

Is it necessary to create a revocation certificate for each of these, or just the pub key? In especially, is it sufficient to just do

gpg --gen-revoke BC589B05 > BC589B05.revoke.asc

and backup BC589B05.revoke.asc somewhere, or am I supposed to repeat this for the sub key, too?

1 Answer 1


Revoking the primary key is sufficient. OpenPGP clients will refuse to use subkeys of revoked primary keys. Revoking primary and subkeys is different: primary key revocations are special self-certifications (self-signatures) containing revocation information, while subkey revocations are issued by the primary key they belong to.

Using GnuPG, it is not possible to generate a revocation certificate for subkeys anyway. From man gpg:

--gen-revoke name

   Generate a revocation certificate for the complete key. To revoke a
   subkey or a signature, use the --edit command.
  • How exactly does the subkey revocation work? If I understand correctly, the private subkey is used to "self-sign" its corresponding public subkey which could then be uploaded to the keyserver? I ask because I'm trying to figure out the minimal information required in my key backup. Commented Sep 8, 2015 at 23:12
  • 1
    A subkey revocation is a special revocation signature issued by the (private) primary key. You do not need access to the private subkey to revoke it, access to the private primary key is enough.
    – Jens Erat
    Commented Sep 9, 2015 at 8:56
  • 1
    How to revoke a sub-key using gpg --edit-key?
    – eli
    Commented May 20, 2020 at 22:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .