Generating a Revocation Certificate

Once you have created your keypair, you should create a revocation certificate for your public key. If you forget your passphrase, or if it has been compromised, you can publish this certificate to inform users that your public key should no longer be used.

	Why Revoke a Key You Just Created?
	When you generate a revocation certificate, you are not revoking the key you just created. Instead, you're giving yourself a safe way to revoke your key from public use. Let's say you create a key, then you forget your passphrase, switch ISPs (addresses), or suffer a hard drive crash. The revocation certificate can then be used to disqualify your public key.

Your signature will be valid to others who read your correspondence before your key is revoked, and you will be able to decrypt messages received prior to its revocation. To generate a revocation certificate, use the --gen-revoke option.

[newuser@localhost newuser]$ gpg --output revoke.asc --gen-revoke  <you@yourisp.net>

Note that if you omit the --output revoke.asc option from the above, your revocation certificate will be returned to the standard output, which is your monitor screen. While you can copy and paste the contents of the output into a file of your choice using a text editor, such as Pico, it is probably easier to send the output to a file in your login directory. That way, you can keep the certificate for use later, or move it to a floppy disk and store it someplace safe.

The creation of a revocation certificate will look like the following:

[newuser@localhost newuser]$ gpg --output revoke.asc --gen-revoke  <you@yourisp.net>
	
	sec  1024D/823D25A9 2000-04-26  Your Name <you@yourisp.net>
	
	Create a revocation certificate for this key? y
	
	You need a passphrase to unlock the secret key for
	user: "Your Name <you@yourisp.net>"
	1024-bit DSA key, ID 823D25A9, created 2000-04-26
	
	ASCII armored output forced.
	Revocation certificate created.

Once your revocation certificate has been created (revoke.asc), it will be located in your login directory. You should copy the certificate to a floppy diskette and store it in a secure place. (If you don't know how to copy a file to a diskette in Red Hat Linux, see the Official Red Hat Linux Getting Started Guide.)