Import and export a GPG secring
A GPG secring (or secret keyring) stores private keys used for decrypting messages and signing data. In modern GPG versions, private keys are securely managed within the same keyring structure as public keys, providing enhanced protection and ease of use.
Import a GPG secring
Sign in to DigiCert ONE.
Select the Manager menu (top right) > Software Trust.
Navigate to: Keypairs > GPG keypairs.
Above the table of keys, select the options button (three dots). In the dropdown menu, select Import secring.
Drag the keyring file to the import box, or select the box to choose the file from your local environment.
Enter the password protecting the secring. Select Next.
Enter an alias for each master key and subkey. Select Import.
Note
Supported formats include .gpg and .asc.
Supported algorithms include ECDSA NIST P-384, ECDSA NIST P-256, EdDSA25519, RSA-3072, RSA-4096, and RSA-2048.
Maximum file size for a secring is 100KB.
Secrings are imported as Open access, Production category, and Offline status. Once a secring is imported, you can change these settings.
Secrings may not be imported if the master keypair is revoked or expired; if the file contains multiple secrings; if the master private key is empty; the user ID for the master key does not include the person's name and email address; or if the key size, algorithm, or curve is not supported.
Subkeys will be imported with reduced permission if they have any permissions not supported by DigiCert® Software Trust Manager. The import system will ignore subkeys that are not valid.
Export a GPG secring
Tip
We recommend keeping your GPG secrings in Software Trust Manager. Exporting a secring adds a layer of risk that your key will be compromised. If you must export a GPG secring, be sure you can store it securely.
To export a GPG secring:
Sign in to DigiCert ONE.
Select the Manager menu (top right) > Software Trust.
Navigate to Keypairs > GPG keypairs.
Identify the Master key associated with the secring you want to export.
Hover over the desired alias, and then select the vertical ellipses.
Select ⁝ > Export secring.
Optional: Enter a reason for the export.
Select Next.
Once the approvers make a decision, you will receive an email telling you whether your request was approved or rejected.
The approver for this keypair receives your request for export. If a team manages this keypair, you may need multiple approvals before exporting it.
In the approval email, select Download. A browser window will open with a passcode on it.
Select Download.
Warning
WARNING: If you lose your passcode, then you must begin this process (including approvals) from the start.