I had setup a working smart card setup, where the local key ring solely contained public subkeys and secret keys resided on a smart card.
Conservatively I set the expiration date to 1 year.
Setup worked nicely and as the keys approached there expiration date, I proceeded as follows to attempt to extend their expiration date:
Kill running gpg-agent
:
pkill gpg-agent
Import offline master key (backup):
gpg --import <KEYID>.master.key
Edit expiry of subkeys (pubkey):
gpg --expert --edit-key <KEYID>
toggle
keys 1, 2, 3 (sign, encrypt, authentication) expire
: 1ysave
Remove secret master keys:
gpg --delete-secret-keys <KEYID>
As a result the keys remain unavailable (expired?) to all means I intent to use them with (kmail/kgpg/kleopatra, evolution/seahorse, etc.).
Where did I go wrong and how may I recover?
As evident from the comments above, I noted, that the secret keys were (no longer?) listed by gpg --list-secret-keys
.
That was remedied by explicitly querying the reader-inserted smart card using gpg --card-status
, followed by a now successful gpg --list-secret-keys
.
After having pointed evolution
at the now available secret key and removing the smart card from its reader, the mail client now (again) asks for insertion of the card when requesting signatures/encryption.
Works again. considered solved.