<p>If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", first create an empty directory, then tell gpg to use that dir as its home:</p>

<pre><code>mkdir projectB-gpg
gpg --homedir ./projectB-gpg --gen-key
</code></pre>

<p>That will do what you want, although you will now have the problem of distributing the private keys and passwords securely to each environment.</p>

CC BY-SA 4.0
2020-03-01T07:47:11.497Z
2020-03-01T07:47:11.497Z
Marty Pauley
<p>After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys.</p>

<p>I have a project that needs unique GPG Keys per environment and each user has their own GPG Key. Thus each server (environment) needs unique GPG keys.</p>

<p>I would envision the most secure and best practice is for each environment would have its own <code>gpg --gen-key</code> results for which to base its own private and public keys. From there an admin could add a user to each environment as needed.</p>

<p>Or am I just missing the point all together?</p>

CC BY-SA 4.0
2019-12-11T03:09:37.933Z
I'm not a GPG guru, but maybe you should look into `gpg subkeys`? You can have a `master` key and `sub` keys which are associated with the `master` one.
tftd
CC BY-SA 4.0
2019-12-14T14:07:01.027Z
I'm not sure I understand your question. If the requirement is that "each user has their own gpg key", that seems like the typical use case for gpg. Can you elaborate a bit on what you want?
larsks
CC BY-SA 4.0
2019-12-14T19:40:35.713Z
@larsks I have several environments (project A, dev, staging, production, project B, etc) that each are required to have their own GPG keys. My confusion is if I use my GPG key for my user to create a unique secret and public keys for each environment are each of these server deployments not dependent now upon my master key? Would it not be more appropriate to create a master key for each environment?
Steven K7FAQ
<security><encryption><gpg>
How to create unique GPG Keys for different environments / projects
Steven K7FAQ
# How to create unique GPG Keys for different environments / projects

(Asked by: username_0 on 2019-12-10)

After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys.

I have a project that needs unique GPG Keys per environment and each user has their own GPG Key. Thus each server (environment) needs unique GPG keys.

I would envision the most secure and best practice is for each environment would have its own `gpg --gen-key` results for which to base its own private and public keys. From there an admin could add a user to each environment as needed.

Or am I just missing the point all together?

**Tags:** security, encryption, gpg

> **Comments:**
> **username_1**: I'm not a GPG guru, but maybe you should look into `gpg subkeys`? You can have a `master` key and `sub` keys which are associated with the `master` one.  
> **username_2**: I'm not sure I understand your question. If the requirement is that "each user has their own gpg key", that seems like the typical use case for gpg. Can you elaborate a bit on what you want?  
> **username_0**: @username_2 I have several environments (project A, dev, staging, production, project B, etc) that each are required to have their own GPG keys. My confusion is if I use my GPG key for my user to create a unique secret and public keys for each environment are each of these server deployments not dependent now upon my master key? Would it not be more appropriate to create a master key for each environment?  

---

## 1 answers

### Answer by username_3 on 2020-03-01. Score: 1

If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", first create an empty directory, then tell gpg to use that dir as its home:
mkdir projectB-gpg
gpg --homedir ./projectB-gpg --gen-key

That will do what you want, although you will now have the problem of distributing the private keys and passwords securely to each environment.


---

