revoke(1)

💅 revoke — Generates revocation certificates 💅

okay so bestie, welcome to revoke from the Sequoia manual. this is the little command that makes revocation certificates, and honestly it's giving "breaking up with your key, formally" energy. let's get into it 🫶

---

✨ SYNOPSIS ✨

revoke [-h|--help] <subcommands>

that's it. that's the whole vibe. you call revoke, you hand it a subcommand, and it does the thing. 🎀

---

🌸 DESCRIPTION 🌸

so. it generates revocation certificates. that's the job, that's the whole job.

and what even is a revocation certificate, you ask? bestie i got you. a revocation certificate is basically a formal "we are SO done" notice — it says that a certificate, a subkey, a User ID, or a signature should not be used anymore. like, do not perceive it. it's over. 💀

a revocation certificate carries two fields: a type and a human-readable explanation. the explanation is where the issuer says why the revocation certificate was issued. and the type field? okay so the type field is the one you really need to set accurately, no cap, because it lets an OpenPGP implementation reason better about artifacts whose validity depends on the revoked object.

let me give you the receipts, because this matters:

• if a certificate is retired, it's reasonable to consider signatures that it made prior to its retirement as still being valid. she served, we honor the era. 👑
• but if a certificate's secret key material is compromised, then any signatures it made should be considered potentially forged — because an attacker could have made them and backdated them. 😭 that's not a vibe, that's a crime scene.

and here's the part people forget: the whole intent of a revocation certificate is to stop others from using a certificate. so you actually have to distribute it. one effective way to do that is to upload the revocation certificate to a keyserver. periodt. if you revoke it and then hide it in a drawer, nobody got the memo, and the memo was the entire point. 🙈

---

⭐ OPTIONS ⭐

• -h, --help — Print help information. that's it, that's the option, she's simple and she's iconic. 💖

---

🦋 SUBCOMMANDS 🦋

• revoke-certificate(1) — Revoke a certificate
• revoke-subkey(1) — Revoke a subkey
• revoke-userid(1) — Revoke a User ID

---

🌈 EXAMPLES 🌈

Revoke a certificate.

sq revoke certificate --time 20220101 --certificate juliet.pgp \
  compromised "My parents went through my things, and found my backup."

Revoke a User ID.

sq revoke userid --time 20220101 --certificate juliet.pgp \
  "Juliet <juliet@capuleti.it>" retired "I've left the family."

not the family drama in the manpage examples, i'm obsessed 😭 the compromised and retired bits are the type field, and the quoted sentence after it is the human-readable explanation. don't skip the explanation bestie, it's the whole "why" and future-you will want it. 💅

---

🧚 SEE ALSO 🧚

for the full documentation see <https://docs.sequoia-pgp.org/sq/>.

sq(1) sq-armor(1) sq-autocrypt(1) sq-certify(1) sq-dearmor(1) sq-decrypt(1) sq-encrypt(1) sq-inspect(1) sq-key(1) sq-keyring(1) sq-keyserver(1) sq-packet(1) sq-revoke-certificate(1) sq-revoke-subkey(1) sq-revoke-userid(1) sq-sign(1) sq-verify(1) sq-wkd(1)

---

okay that's the whole page, and this little queen shipped as sq 0.26.0 back in July 2022. thanks for coming to my ted talk, go revoke responsibly, and remember: revocation is a love language when it's done on time. mwah 💋 ✨🌸🫶