After creating an OpenPGP key pair in GnuPG, if I list keys with gpg --list-keys, I get (GnuPG default):

pub   2048R/BC589B05 2015-07-15
uid                  Some One
sub   2048R/3dd81C42 2015-07-15

Consisting the primary public key with ID BC589B05, and sub key with ID 3dd81C42.

Is it necessary to create a revocation certificate for each of these, or just the pub key? In especially, is it sufficient to just do

gpg --gen-revoke BC589B05 > BC589B05.revoke.asc

and backup BC589B05.revoke.asc somewhere, or am I supposed to repeat this for the sub key, too?

1 Answer 1


Revoking the primary key is sufficient. OpenPGP clients will refuse to use subkeys of revoked primary keys. Revoking primary and subkeys is different: primary key revocations are special self-certifications (self-signatures) containing revocation information, while subkey revocations are issued by the primary key they belong to.

Using GnuPG, it is not possible to generate a revocation certificate for subkeys anyway. From man gpg:

--gen-revoke name

   Generate a revocation certificate for the complete key. To revoke a
   subkey or a signature, use the --edit command.
  • How exactly does the subkey revocation work? If I understand correctly, the private subkey is used to "self-sign" its corresponding public subkey which could then be uploaded to the keyserver? I ask because I'm trying to figure out the minimal information required in my key backup. Sep 8, 2015 at 23:12
  • 1
    A subkey revocation is a special revocation signature issued by the (private) primary key. You do not need access to the private subkey to revoke it, access to the private primary key is enough.
    – Jens Erat
    Sep 9, 2015 at 8:56
  • 1
    How to revoke a sub-key using gpg --edit-key?
    – eli
    May 20, 2020 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.