# Set new expire date for a GPG key John Simpson `` 2020-03-14 Part of how I manange my GPG keys is by giving each one an expiration date, and then "renewing" them (changing their expiration dates) as time goes by. This means that every so often, I have to update the expiration dates. # Procedure ## Secure workstation For my day-to-day purposes, my PGP secret keys are stored on [YubiKey](https://yubico.com) devices (see [my web site](https://jms1.net/yubikey/) for details). I create keys with encryption, signature, and authentication keys which are all different from the primary key, and only store the secret sub-keys on the Yubikey. This allows me to most day-to-day PGP operations, the only things I can't do are adding, changing, or revoking sub-keys (this includes changing their expiration dates), or signing other peoples' keys. I don't do either of these things on a regular basis anyway, so I think the added security of keeping my keys on a YubiKey is worth it. I use [Tails](https://tails.boum.org/) with an [encrypted persistent storage](https://tails.boum.org/doc/first_steps/persistence/index.en.html) partition, running on a netbook which has no network connectivity (i.e. it doesn't have an ethernet interface, and I have physically removed the wifi/bluetooth card), to create and maintain PGP keys, as well as load the secret keys into my YubiKeys. I have multiple copies of this Tails stick, stored in different locations, so that if one of them is ever damaged or lost, I can still get access to the secret keys. When I wrote this document, I was updating the expiration date on two of my keys. I'll use one of them below as an example of what I did. ### Identify the key Get the key's fingerprint. ``` $ gpg --list-keys jms1 ... pub rsa4096/0x49B9FD3BB4422EBB 2019-03-21 [SC] [expires: 2020-03-21] E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB <----- uid [ full ] John Simpson uid [ full ] John Simpson uid [ full ] John Simpson sub rsa4096/0x795C2CF824364755 2019-03-21 [E] [expires: 2020-03-21] sub rsa4096/0xE9E44ED30E2F2445 2019-03-21 [S] [expires: 2020-03-21] sub rsa4096/0x36823233F8D09EB7 2019-03-21 [A] [expires: 2020-03-21] ``` ### Change the expire date You can use "`gpg --edit-key`" for this, however it involves multiple steps and only allows you to enter the new expire date as "relative to now", such as "6 months from now" or "one year from now". I prefer to enter an absolute date, so I use the "`gpg --quick-set-expire`" command instead. ``` $ gpg --quick-set-expire E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB 2021-01-01 $ gpg --list-keys jms1 ... pub rsa4096/0x49B9FD3BB4422EBB 2019-03-21 [SC] [expires: 2021-01-01] <----- E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB uid [ full ] John Simpson uid [ full ] John Simpson uid [ full ] John Simpson sub rsa4096/0x795C2CF824364755 2019-03-21 [E] [expires: 2020-03-21] sub rsa4096/0xE9E44ED30E2F2445 2019-03-21 [S] [expires: 2020-03-21] sub rsa4096/0x36823233F8D09EB7 2019-03-21 [A] [expires: 2020-03-21] ``` You will note that this changed the primary key's expiration date, but did not change the sub-keys. The same command can be used to change each sub-key by adding the sub-key number, or if you use '`*`' as the sub-key number, it will change all of the sub-keys' dates at once. ``` $ gpg --quick-set-expire E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB 2021-01-01 \* $ gpg --list-keys jms1 ... pub rsa4096/0x49B9FD3BB4422EBB 2019-03-21 [SC] [expires: 2021-01-01] E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB uid [ full ] John Simpson uid [ full ] John Simpson uid [ full ] John Simpson sub rsa4096/0x795C2CF824364755 2019-03-21 [E] [expires: 2021-01-01] <----- sub rsa4096/0xE9E44ED30E2F2445 2019-03-21 [S] [expires: 2021-01-01] <----- sub rsa4096/0x36823233F8D09EB7 2019-03-21 [A] [expires: 2021-01-01] <----- ``` ### Export the new public key After updating the expiration date, you need to send the public key out to the world again. Because we're running on an isolated machine, we need to export the public key to a second USB stick, this one not encrypted, and then use another machine to send it out. Assuming the second USB stick is mounted as "`/mnt/usb`", we can export the key like so: ``` $ gpg -a --export E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB \ > /mnt/usb/E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB.pub.asc ``` After doing this, you can un-mount the second USB stick. ## On a normal machine ### Import the new public key Insert the USB stick. Depending on the machine's operating system, you may need to mount it, or the OS may mount it for you. In my case the machine was running macOS, so the stick was automatically mounted as "`/Volumes/scratch`". ``` $ gpg --import /Volumes/scratch/E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB.pub.asc ``` ``` $ gpg --list-keys jms1 ... pub rsa4096/0x49B9FD3BB4422EBB 2019-03-21 [SC] [expires: 2021-01-01] E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB uid [ full ] John Simpson uid [ full ] John Simpson uid [ full ] John Simpson sub rsa4096/0x795C2CF824364755 2019-03-21 [E] [expires: 2021-01-01] sub rsa4096/0xE9E44ED30E2F2445 2019-03-21 [S] [expires: 2021-01-01] sub rsa4096/0x36823233F8D09EB7 2019-03-21 [A] [expires: 2021-01-01] ``` ### Send out the new public key Once this file has been imported, you can then send the public key, with the new expire date, to the GPG keyserver network. ``` $ gpg --send-keys E3F7F5F76640299C5507FBAA49B9FD3BB4422EBB ``` The file itself can also be shared using whatever other method you like, such as storing it on a web site. For example, I uploaded the file I used while writing this document to my web site as [`https://jms1.net/49B9FD3BB4422EBB.pub.asc`](https://jms1.net/49B9FD3BB4422EBB.pub.asc).