Provided by: sq_0.27.0-1_amd64 
NAME
certificate - Revoke a certificate
SYNOPSIS
certificate [--certificate] [--revocation-key] [--private-key-store] [-t|--time]
[--notation] [-B|--binary] [-h|--help] <REASON> <MESSAGE>
DESCRIPTION
Revokes a certificate
Creates a revocation certificate for the certificate.
If "--revocation-key" is provided, then that key is used to create the signature. If that
key is different from the certificate being revoked, this creates a third-party
revocation. This is normally only useful if the owner of the certificate designated the
key to be a designated revoker.
If "--revocation-key" is not provided, then the certificate must include a
certification-capable key.
OPTIONS
--certificate=FILE
Reads the certificate to revoke from FILE or stdin, if omitted. It is an error for
the file to contain more than one certificate.
--revocation-key=KEY
Signs the revocation certificate using KEY. If the key is different from the
certificate, this creates a third-party revocation. If this option is not
provided, and the certificate includes secret key material, then that key is used
to sign the revocation certificate.
--private-key-store=KEY_STORE
Provides parameters for private key store
-t, --time=TIME
Chooses keys valid at the specified time and sets the revocation certificate's
creation time
--notation=NAME VALUE
Adds a notation to the certification. A user-defined notation's name must be of
the form "name@a.domain.you.control.org". If the notation's name starts with a !,
then the notation is marked as being critical. If a consumer of a signature
doesn't understand a critical notation, then it will ignore the signature. The
notation is marked as being human readable.
-B, --binary
Emits binary data
-h, --help
Print help information
<REASON>
The reason for the revocation. This must be either: compromised, superseded,
retired, or unspecified:
- compromised means that the secret key material may have been
compromised. Prefer this value if you suspect that the secret
key has been leaked.
- superseded means that the owner of the certificate has replaced
it with a new certificate. Prefer "compromised" if the secret
key material has been compromised even if the certificate is also
being replaced! You should include the fingerprint of the new
certificate in the message.
- retired means that this certificate should not be used anymore,
and there is no replacement. This is appropriate when someone
leaves an organisation. Prefer "compromised" if the secret key
material has been compromised even if the certificate is also
being retired! You should include how to contact the owner, or
who to contact instead in the message.
- unspecified means that none of the three other three reasons
apply. OpenPGP implementations conservatively treat this type
of revocation similar to a compromised key.
If the reason happened in the past, you should specify that using the --time
argument. This allows OpenPGP implementations to more accurately reason about
objects whose validity depends on the validity of the certificate.
<MESSAGE>
A short, explanatory text that is shown to a viewer of the revocation certificate.
It explains why the certificate has been revoked. For instance, if Alice has
created a new key, she would generate a 'superseded' revocation certificate for her
old key, and might include the message "I've created a new certificate,
FINGERPRINT, please use that in the future."
SEE ALSO
For the full documentation see <https://docs.sequoia-pgp.org/sq/>.
sq(1) sq-armor(1) sq-autocrypt(1) sq-certify(1) sq-dearmor(1) sq-decrypt(1) sq-encrypt(1)
sq-inspect(1) sq-key(1) sq-keyring(1) sq-keyserver(1) sq-packet(1) sq-revoke(1)
sq-revoke-subkey(1) sq-revoke-userid(1) sq-sign(1) sq-verify(1) sq-wkd(1)