You can securely export your GnuPG private keys from Kleopatra by using the built-in certificate manager to create a password-protected .gpg file. This process ensures that your encryption and signing capabilities are preserved when migrating to a new operating system or hardware setup, allowing you to decrypt old messages and sign new ones without losing access to your identity.
Exporting Keys via the Certificate Manager
The most reliable method for backing up private keys in Kleopatra involves exporting them through the graphical interface. This approach handles the necessary encoding and encryption of the private material automatically, reducing the risk of human error compared to manual file copying.
Open Kleopatra on your source computer. If you do not see the main window, navigate to the menu bar and select
Crypto > Manage Certificates. Alternatively, many versions allow you to right-click directly on your key pair in the main list and choose
Export.... This opens the Certificate Manager dialog where all your trusted identities are listed.
Locate the specific certificate containing the private key you wish to back up. Ensure that the column indicating "Private Key" shows a checkmark or icon, confirming the secret portion is present locally. Select the certificate and click the
Export button located at the bottom of the window.
In the export dialog, you will be prompted to set a password for the exported file. This step is critical; it encrypts the private key so that only someone with this password can import it later. Choose a strong passphrase and confirm it. Save the resulting
.gpg file to a secure location, such as an encrypted USB drive or a cloud storage service with end-to-end encryption. Do not send this file over unencrypted email channels.
Importing Keys on the New Computer
Once you have transferred the
.gpg backup file to your new machine, you must restore the keys into Kleopatra. Start Kleopatra on the destination computer and ensure it is running the same version if possible, though newer versions generally support older key formats.
Navigate to
Crypto > Import Certificates and Files from the top menu. You can also drag and drop the
.gpg file directly into the Kleopatra window. When prompted, enter the password you created during the export process. Kleopatra will decrypt the archive and add the private key to your local store.
Verify the import by checking the Certificate Manager again. The certificate should now appear with the private key indicator. Test the functionality by attempting to sign a small text document or decrypt a test message. If the operation succeeds, your migration is complete.
Security Best Practices for Key Management
Handling private keys requires strict adherence to security protocols to prevent unauthorized access. Never store the backup file on a public server or share it via insecure messaging platforms. Always use strong, unique passwords for both the export encryption and the import process.
Consider creating multiple backups stored in different physical locations. Hardware security modules or smart cards offer superior protection but require additional configuration steps not covered here. For most users, a password-protected
.gpg file stored on an encrypted external drive provides sufficient security.
If you suspect your private key has been compromised, immediately revoke the certificate using Kleopatra’s revocation wizard and generate a new key pair. Distribute the new public key to your contacts to ensure future communications remain secure.
For more information on managing disk partitions that might store these sensitive files, see
Deleting Partitions: Best Practices for /dev/sda with Three Partitions.
Troubleshooting Common Issues
Users often encounter errors when the password is incorrect or the file is corrupted. If Kleopatra rejects the password, double-check for typos and case sensitivity. Ensure the file was not altered during transfer by verifying its checksum if available.
Some antivirus software may flag
.gpg exports as suspicious due to their encrypted nature. Add an exception for your backup directory if the import fails silently. Additionally, ensure that the GnuPG agent is running on the new system, as Kleopatra relies on it for cryptographic operations.
Frequently Asked Questions
Can I export only the public key?
Yes, you can export just the public key if you only need to share your identity with others. However, to use your private key for decryption or signing on a new computer, you must export the full certificate including the private component.
What happens if I lose my export password?
If you forget the password used to encrypt the
.gpg backup file, there is no way to recover the private key. The encryption is designed to be irreversible without the passphrase, so always keep your backup passwords in a secure password manager.
Does Kleopatra support exporting to ASCII armor?
Kleopatra typically exports in binary format by default, but you can choose ASCII armored output in some versions. Binary format is smaller and preferred for storage, while ASCII armor is easier to copy-paste into text emails or documents.
How do I revoke a compromised key?
Use the
Revoke Certificate option within the Certificate Manager. Generate a revocation certificate beforehand and publish it to a key server or distribute it manually to inform your contacts that the key is no longer valid.
Is it safe to store the backup on a USB drive?
Storing the backup on a USB drive is safe provided the drive is encrypted and kept in a physically secure location. Avoid leaving the drive plugged into computers when not in active use to minimize exposure to malware.