Answers: <p>If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", first create an empty directory, then tell gpg to use that dir as its home:</p>
  
  <pre><code>mkdir projectB-gpg
  gpg --homedir ./projectB-gpg --gen-key
  </code></pre>
  
  <p>That will do what you want, although you will now have the problem of distributing the private keys and passwords securely to each environment.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-03-01T07:47:11.497Z
Answers: 2020-03-01T07:47:11.497Z
Answers: Marty Pauley
Body: <p>After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys.</p>
  
  <p>I have a project that needs unique GPG Keys per environment and each user has their own GPG Key. Thus each server (environment) needs unique GPG keys.</p>
  
  <p>I would envision the most secure and best practice is for each environment would have its own <code>gpg --gen-key</code> results for which to base its own private and public keys. From there an admin could add a user to each environment as needed.</p>
  
  <p>Or am I just missing the point all together?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-12-11T03:09:37.933Z
Comments: I'm not a GPG guru, but maybe you should look into `gpg subkeys`? You can have a `master` key and `sub` keys which are associated with the `master` one.
Comments: tftd
Comments: CC BY-SA 4.0
Comments: 2019-12-14T14:07:01.027Z
Comments: I'm not sure I understand your question. If the requirement is that "each user has their own gpg key", that seems like the typical use case for gpg. Can you elaborate a bit on what you want?
Comments: larsks
Comments: CC BY-SA 4.0
Comments: 2019-12-14T19:40:35.713Z
Comments: @larsks I have several environments (project A, dev, staging, production, project B, etc) that each are required to have their own GPG keys. My confusion is if I use my GPG key for my user to create a unique secret and public keys for each environment are each of these server deployments not dependent now upon my master key? Would it not be more appropriate to create a master key for each environment?
Comments: Steven K7FAQ
Tags: <security><encryption><gpg>
Title: How to create unique GPG Keys for different environments / projects
UserDisplayName: Steven K7FAQ
ThreadText: # How to create unique GPG Keys for different environments / projects
  
  (Asked by: username_0 on 2019-12-10)
  
  After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys.
  
  I have a project that needs unique GPG Keys per environment and each user has their own GPG Key. Thus each server (environment) needs unique GPG keys.
  
  I would envision the most secure and best practice is for each environment would have its own `gpg --gen-key` results for which to base its own private and public keys. From there an admin could add a user to each environment as needed.
  
  Or am I just missing the point all together?
  
  **Tags:** security, encryption, gpg
  
  > **Comments:**
  > **username_1**: I'm not a GPG guru, but maybe you should look into `gpg subkeys`? You can have a `master` key and `sub` keys which are associated with the `master` one.  
  > **username_2**: I'm not sure I understand your question. If the requirement is that "each user has their own gpg key", that seems like the typical use case for gpg. Can you elaborate a bit on what you want?  
  > **username_0**: @username_2 I have several environments (project A, dev, staging, production, project B, etc) that each are required to have their own GPG keys. My confusion is if I use my GPG key for my user to create a unique secret and public keys for each environment are each of these server deployments not dependent now upon my master key? Would it not be more appropriate to create a master key for each environment?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2020-03-01. Score: 1
  
  If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", first create an empty directory, then tell gpg to use that dir as its home:
  
  ```
  mkdir projectB-gpg
  gpg --homedir ./projectB-gpg --gen-key
  
  ```
  
  That will do what you want, although you will now have the problem of distributing the private keys and passwords securely to each environment.
  
  
  ---
  
  