I know that I can create a GPG keypair from the CentOS 7 terminal by typing gpg --gen-key and following the resulting steps, but how can I make sure that the resulting public key is self-signed? And how can I send the resulting key via email to a remote computer?

I know that I can send an email with an attachment using mailx from the command line as follows:

echo "this is the body of the email" | mailx -s"Subject" -a public.key Someone@Domain.com

But the mailx code snipped assumes that the key is available in a file. In reality, the key is locked up in a keyring and needs other syntax in order for it to be accessed.


I am following @HaukeLaging's advice. I have created a new key, but when I type gpg --list-sigs in the command line, I get the following results:

pub   4096R/CODE1 2015-02-04
uid                  User Name <username@domainname.com>
sig 3        CODE1 2015-02-04  User Name <username@domainname.com>
sub   4096R/CODE2 2015-02-04
sig          CODE1 2015-02-04  User Name <username@domainname.com>

Which of these key codes is the public key? And Which is the private key? I do not want to accidentally send the private key to anyone.


As per @HaukeLaging's response to EDIT#1, I tried:

`sudo gpg --armor --export CODE1 >/home/username/my_public_cert.asc`  

but the result is an empty file when I then cd /home/username/ and ls -al.


gpg --list-packets /home/username/my_public_cert.asc

resulted in gpg: processing message failed: Unknown system error

Why is gpg --armor --export CODE1 >/home/username/my_public_cert.asc producing an empty file?

  • The pub line refers to the mainkey, the sub line to the subkey. Both are key pairs consisting of an public key and a private key. You need --export-secret-keys or --export-secret-subkeys to export a private key. You can check the exported file with gpg --list-packets file.asc – Hauke Laging Feb 5 '15 at 0:28

First, find the public key you want to export:

gpg --list-public-keys

Look at the line marked 'pub'; it displays your public key type and number. For instance:

pub  1024D/5000280F 2009-07-10

Use the number to do your export:

gpg --armor --export 5000280F > klaatu_pubkey.asc

Check to make sure it worked:

cat klaatu_pubkey.asc

As long as it's not empty, you can send that file to your friends.

Since the PGP model is based on a web of trust, it is beneficial to get your public key out there into the world so people can start using it. The easiest way to do that is to post it to a key server:

gpg --export send-keys 5000280F --keyserver keys.fedoraproject.org

Key-servers mirror one another periodically, so your key will propagate and people who receive signed emails from you can just download/import your pub key from the network of key servers.



OpenPGP certificates consist of several components.


  • exactly one mainkey
  • at least one user ID (UID)


  • at least one subkey

All components except for the mainkey become part of the certificate by being signed by the mainkey. You cannot create a certificate (with GnuPG) which contains components without self-signature. You have to delete the self-signature afterwards to reach such a situation.

You can see the signatures by running

gpg --list-sigs


gpg --with-colons --list-sigs

attaching a certificate to an email

If you want to attach the certificate you have to export it to a file first:

gpg --armor --export $key_id >my_cert.asc


gpg --armor --output my_cert.asc --export $key_id
  • Please see EDIT I just added to the end of my OP. Which key_id do I use to output the public key? Thank you and +1 for your time so far. – CodeMed Feb 5 '15 at 0:03
  • @CodeMed CODE1 is the key ID. – Hauke Laging Feb 5 '15 at 0:25
  • I tried sudo gpg --armor --export CODE1 >/home/username/my_public_cert.asc, but the result is an empty file when I then cd /home/username/ and ls -al. Any suggestions? – CodeMed Feb 5 '15 at 0:34
  • @CodeMed Why sudo? That isn't some magic software you need for everything... – Hauke Laging Feb 5 '15 at 0:35
  • Because nano alone opened an empty file, so I was double checking with sudo. In other situations, sudo nano shows contents in a file when nano alone opens an empty file. – CodeMed Feb 5 '15 at 0:37

As far as I know self-signed have sense in PKI. PGP/GPG use different idea - web of trust. So you should have signed your public key from your correspondent and sign his/her key too

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.