Revocation certificate.
A signed statement that invalidates a PGP key. Published on keyservers and via WKD, it tells the world to stop encrypting new content to this key. Required for clean key retirement; critical if a key is compromised. Best practice: generate one at key creation and store it offline before you need it.
A revocation certificate is a self-signed OpenPGP statement asserting that a specific key (or subkey) is no longer valid. Publishing it makes the key visible as revoked on keyservers, in WKD records, and to any OpenPGP tool that checks revocation status.
What it is.
Revocation in OpenPGP is forward-looking: a revocation certificate doesn't undo past operations (signatures from before the revocation remain valid, encrypted messages from before the revocation can still be decrypted with the secret key). What it does is tell everyone going forward that this key shouldn't be used for new operations.
A revocation certificate includes:
- The fingerprint of the key being revoked.
- A reason code (compromised, superseded, no longer used, key invalid).
- Optional human-readable explanation.
- A signature from the key itself, proving the holder of the secret key authorized the revocation.
Once distributed, keyservers attach it to the public key record. Tools looking up the key see the revocation status and warn before performing operations.
Why it matters.
Without revocation, retired and compromised keys live forever in keyserver indexes and contacts' keyrings. Someone with stale information might encrypt new sensitive content to a compromised key. Someone updating their records won't know your old key shouldn't be used. Revocation is what closes the loop.
Best practice: generate a revocation certificate at key-creation time, even though you don't need it yet. Store it on durable, offline media — encrypted USB in a safe, paper backup with paperkey, password manager attachment. Then if you ever lose access to the secret key (forgotten passphrase, device wiped without backup) you can still revoke the key. Without a pre-generated revocation, a lost secret key means the public key stays "alive" indefinitely.
Related terms
Related guide
Get PGPony
Free OpenPGP encryption for iOS and Android. No accounts, no tracking.