Using CH-J Keys

Use https://keys.ch-j.de for public OpenPGP V4/V6 certificates. The web service supports IPv4 and IPv6. Keep HTTPS certificate verification enabled.

Publish a public certificate

  1. Create or select a key in your OpenPGP client. Keep its private material locally.
  2. Export its public certificate, including public subkeys and signatures. The usual ASCII-armored header is -----BEGIN PGP PUBLIC KEY BLOCK-----.
  3. Open Upload and submit that public file. Uploading does not by itself publish or verify email identities.
  4. Select an address from the uploaded certificate and request verification.
  5. Open the message from keys@ch-j.de, follow its HTTPS verification link, and submit the confirmation form. The confirmed address then becomes discoverable.

You need access to every mailbox you wish to publish. Confirmation proves mailbox access, not a person's legal identity.

Find and download a key

Use Search with an exact full fingerprint, long key ID or confirmed email address. This is an exact-match service, not a directory of partial names. Prefer the full fingerprint when choosing a particular certificate.

Before trusting a downloaded key, compare its full fingerprint with one obtained through a channel you trust. Availability on this server is not an identity certification.

GnuPG examples

Replace YOUR_FULL_FINGERPRINT with the complete fingerprint of the intended key. These commands require a GnuPG version that supports that certificate's format. Server-side V6 support does not make a V4-only client V6-capable.

Export a public certificate for the web upload:

gpg --armor --output public-key.asc --export YOUR_FULL_FINGERPRINT

Fetch a certificate from this specific server:

gpg --keyserver hkps://keys.ch-j.de --recv-keys YOUR_FULL_FINGERPRINT

Refresh a key already in your local keyring:

gpg --keyserver hkps://keys.ch-j.de --refresh-keys YOUR_FULL_FINGERPRINT

Inspect a downloaded file before importing it:

gpg --show-keys --with-fingerprint public-key.asc
gpg --import public-key.asc

HKP-compatible clients may also upload with --send-keys, but an HKP upload alone does not complete email verification. Use the web upload or the VKS verification workflow for publication of addresses.

For command details see the official GnuPG manual.

Update subkeys, expiration or revocation

Make changes in your OpenPGP client, export the updated public certificate and upload it again. The private primary key and its passphrase are never needed by this server.

To revoke, use a valid revocation certificate or create the revocation locally, then upload the resulting public certificate containing the revocation signature. For the JSON API, use the same upload endpoint. Deleting a key from a local keyring does not publish a revocation.

Unpublish an email address

Open Manage and enter a published email address. Follow the private management link sent to that mailbox and remove the address you no longer want listed.

Unpublishing an address is different from revoking a key. Fingerprint lookup and non-identity certificate or revocation information remain available. It cannot recall copies downloaded elsewhere.

CH-J Server Manager

The development Keychain integration can publish and check public V4/V6 certificates, and publish local revocations. It currently connects over IPv6. To verify an email address, export the public certificate and use this site's web upload; automatic email verification is not yet part of the desktop publish action. These are development features, not a promise that every published installer includes them.

Troubleshooting