Keys and Certificates
First of all, OpenPGP has a different wording than X.509. What you describe as certificates is usually called "key" in OpenPGP, while only signatures on other keys are called a certification.
"Not valid before"
Furthermore, there is no defined "not valid before" parameter. There is the creation timestamp, but there is no defined behavior for dates in the future -- implementations of OpenPGP might issue a warning, completely deny using the key or simply ignore the fact at all.
Faking the Creation Time
GnuPG does not know an option to set the creation time, but the system time is used. The easiest and most general way is to change the system time to the desired date.
For Linux, there is the very helpful tool faketime
, which can be used to start other commands with arbitrary dates:
faketime '2008-12-24 08:15:42' gpg2 --gen-key
You might have to terminate gpg-agent
so it gets restarted, if it does not see (but use) the faked time.
GnuPG also has a --faketime
parameter, but it does only work if --debug
is also set, which requires some compile options that are not always applied for production builds.
2Why would you want this? Also, you could wait a week before exporting the public key, so none is able to use it untill then. Or create the key next week? – BadSkillz – 2016-02-26T15:22:45.717
2I think setting your computer's clock forward one week will do the trick. – Neil Smithline – 2016-02-26T15:27:12.943
1PGP doesn't use "certificates". Do you mean a public/private key pair? ("Certificate" is often the term used for the signed X.509 public key portion.) – a CVn – 2016-02-26T15:43:52.813
Thank you all! Every X days we need to create our keys, share PublicKey with our partner and agree on the date we will start to use the it. The time between we create the Keys and our Partner import it in its system could be log. So we need a kind of "StartValidityDate". If i understand well, we have 2 ways: