1

After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys.

I have a project that needs unique GPG Keys per environment and each user has their own GPG Key. Thus each server (environment) needs unique GPG keys.

I would envision the most secure and best practice is for each environment would have its own gpg --gen-key results for which to base its own private and public keys. From there an admin could add a user to each environment as needed.

Or am I just missing the point all together?

3
  • I'm not a GPG guru, but maybe you should look into gpg subkeys? You can have a master key and sub keys which are associated with the master one. – tftd Dec 11 '19 at 3:09
  • I'm not sure I understand your question. If the requirement is that "each user has their own gpg key", that seems like the typical use case for gpg. Can you elaborate a bit on what you want? – larsks Dec 14 '19 at 14:07
  • @larsks I have several environments (project A, dev, staging, production, project B, etc) that each are required to have their own GPG keys. My confusion is if I use my GPG key for my user to create a unique secret and public keys for each environment are each of these server deployments not dependent now upon my master key? Would it not be more appropriate to create a master key for each environment? – Steven K7FAQ Dec 14 '19 at 19:40
1

If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", first create an empty directory, then tell gpg to use that dir as its home:

mkdir projectB-gpg
gpg --homedir ./projectB-gpg --gen-key

That will do what you want, although you will now have the problem of distributing the private keys and passwords securely to each environment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.