Mailing List Archive: How to revoke a secret key and certificate?

How to revoke a secret key and certificate?

Mar 9, 2004, 6:09 PM

Post #1 of 5 (890 views)

Hi,

I am using gpgsm (0.9.4), dirmngr (0.4.4), libgpgme6 (0.3.15),
cryptplug (0.3.15), newpg (0.9.4), libcrypt (1.1.12) and
kgpgcertmanager (0.9), all this with KDE 3.2 and KMail 1.6 on
Debian/woody (Aegypten from www.opensides.be and KDE from
downloads.kde.org).

I have got CAcert assurer to certify my identity, so I revoked my
previous key and I would like to get rid of it from my keyring
(or it least how to say to GPGSM machinery that the key and
certificate are revoked)? When tried to import revoke.crl CRL
list from http://www.cacert.org/revoke.crl with kgpgcertmanager
I got error shown in the attached screenshot.

Thanks for any advice,

Matej Cepl

--
Matej Cepl, http://www.ceplovi.cz/matej
GPG Finger: 89EF 4BC6 288A BF43 1BAB 25C3 E09F EF25 D964 84AC
138 Highland Ave. #10, Somerville, Ma 02143, (617) 623-1488

The state is the great fictitious entity by which everyone seeks
to live at the expense of everyone else.
-- Frederick Bastiat

Re: How to revoke a secret key and certificate? [ In reply to ]

wk at gnupg

Mar 12, 2004, 4:14 AM

Post #2 of 5 (881 views)

Permalink

On Tue, 9 Mar 2004 20:09:46 -0500, Matej Cepl said:

> previous key and I would like to get rid of it from my keyring
> (or it least how to say to GPGSM machinery that the key and
> certificate are revoked)? When tried to import revoke.crl CRL
> list from http://www.cacert.org/revoke.crl with kgpgcertmanager
> I got error shown in the attached screenshot.

You don't have the issuer's certificate and dirmngr was not able to
retrieve it. We fixed a lot of things in the last months, thus an
upgrade to the new backend is advisable - you may keep the old KMail
along with the cryptplugin and gpg 0.3.16.

Deleting the key is a mere

gpgsm --delete-key USERID

if you also want to delete the private key, you need to do this prior:

gpgsm -k --with-key-data USERID

Then look for a line like

grp:::::::::42EA1A8F1061AE86C6B2F4BE42704FA953EF0777:

and do

rm ~/.gnupg/private-keys-v1.d/42EA1A8F1061AE86C6B2F4BE42704FA953EF0777.key

Note, that in future versions the same private key may be used for
several certificates or OpenPGP keys; thus it is in general not
advisable to delete the private key if you don't know how it is used.
This is also the reason why there is no --delete-secret-key command
for gpgsm.

Werner

Re: How to revoke a secret key and certificate? [ In reply to ]

wk at gnupg

Mar 12, 2004, 4:36 AM

Post #3 of 5 (880 views)

Permalink

On Tue, 9 Mar 2004 20:09:46 -0500, Matej Cepl said:

> certificate are revoked)? When tried to import revoke.crl CRL
> list from http://www.cacert.org/revoke.crl with kgpgcertmanager
> I got error shown in the attached screenshot.

I checked it and it works after manually installing the root
certificate first. I am not sure why cacert uses an "https:" scheme
in the cRLDistributionPoint of their root certificate; after all the
CRL is signed by them and https won't help detecting a root ca
comprimse. Dirmngr does not support https access to CRLs because this
increases the complexity and burdens the admin to take care of another
set of certificates for the TLS connection.

Werner

Re: How to revoke a secret key and certificate? [ In reply to ]

wk at gnupg

Mar 12, 2004, 7:15 AM

Post #4 of 5 (880 views)

Permalink

On Fri, 12 Mar 2004 12:36:18 +0100, Werner Koch said:

> certificate first. I am not sure why cacert uses an "https:" scheme
> in the cRLDistributionPoint of their root certificate; after all the

They are going to change this for new certificates and I will add a
hack to dirmngr to try http instead of https - this should work in
many cases.

Werner

Re: How to revoke a secret key and certificate? [ In reply to ]

bernhard at intevation

Mar 12, 2004, 7:34 AM

Post #5 of 5 (884 views)

Permalink

On Fri, Mar 12, 2004 at 03:15:09PM +0100, Werner Koch wrote:
> On Fri, 12 Mar 2004 12:36:18 +0100, Werner Koch said:
>
> > certificate first. I am not sure why cacert uses an "https:" scheme
> > in the cRLDistributionPoint of their root certificate; after all the
>
> They are going to change this for new certificates and I will add a
> hack to dirmngr to try http instead of https - this should work in
> many cases.

Should we make this a configuration option?

Mailing List Archive

Mailing List Archive

Attached Files: