.TH SQ 1 1.2.0 "Sequoia PGP" "User Commands"
.SH NAME
sq key subkey bind \- Bind keys from one certificate to another
.SH SYNOPSIS
.br
\fBsq key subkey bind\fR [\fIOPTIONS\fR]  
.SH DESCRIPTION
Bind keys from one certificate to another.
.PP
This command allows the user to attach a primary key or a subkey attached to one certificate to another certificate.  Say you want to transition to a new certificate, but have an authentication subkey on your current certificate that you want to keep because it allows access a server and updating its configuration is not feasible.  This command makes it easy to attach the subkey to the new certificate.
.PP
After the operation, the key is bound both to the old certificate and to the new one.  To remove secret key material from the old certificate, use `sq key subkey delete` or `sq key delete`, as appropriate.  To revoke the old subkey or key, use `sq key subkey revoke` or `sq key revoke`, respectively.
.PP


.SH OPTIONS
.SS "Subcommand options"
.TP
\fB\-\-allow\-broken\-crypto\fR
Allow adopting keys from certificates using broken cryptography
.TP
\fB\-\-can\-authenticate\fR
Set the authentication\-capable flag
.TP
\fB\-\-can\-encrypt\fR=\fIPURPOSE\fR
Set the encryption\-capable flag
.IP
Encryption\-capable subkeys can be marked as suitable for transport encryption, storage encryption, or both, i.e., universal.  [default: universal]
.IP
[possible values: \fBtransport\fR, \fBstorage\fR, \fBuniversal\fR]
.TP
\fB\-\-can\-sign\fR
Set the signing\-capable flag
.TP
\fB\-\-cannot\-authenticate\fR
Don't set the authentication\-capable flag
.TP
\fB\-\-cannot\-encrypt\fR
Don't set the encryption\-capable flag
.TP
\fB\-\-cannot\-sign\fR
Don't set the signing\-capable flag
.TP
\fB\-\-cert\fR=\fIFINGERPRINT|KEYID\fR
Add the specified subkeys on the key with the specified fingerprint or key ID
.TP
\fB\-\-cert\-email\fR=\fIEMAIL\fR
Add the specified subkeys on the key where a user ID includes the specified email address
.TP
\fB\-\-cert\-file\fR=\fIPATH\fR
Add the specified subkeys to the key read from PATH
.TP
\fB\-\-cert\-userid\fR=\fIUSERID\fR
Add the specified subkeys on the key with the specified user ID
.TP
\fB\-\-creation\-time\fR=\fICREATION_TIME\fR
Make bound subkeys have the specified creation time
.IP
Normally, the key's creation time is preserved.  The exception is if the key's creation time is the Unix epoch.  In that case, the current time is used.
.IP
This option allows setting the key's creation time to a specified value.  Note: changing a key's creation time also changes its fingerprint.  Changing the fingerprint will make it impossible to look up the key for the purpose of signature verification, for example.
.TP
\fB\-\-expiration\fR=\fIEXPIRATION\fR
Sets the expiration time
.IP
EXPIRATION is either an ISO 8601 formatted date with an optional time or a custom duration.  A duration takes the form `N[ymwds]`, where the letters stand for years, months, weeks, days, and seconds, respectively. Alternatively, the keyword `never` does not set an expiration time.
.IP
[default: \fBnever\fR]
.TP
\fB\-\-key\fR=\fIKEY\fR
Add the key or subkey KEY to the certificate
.TP
\fB\-\-output\fR=\fIFILE\fR
Write to the specified FILE
.IP
If not specified, and the certificate was read from the certificate store, imports the modified certificate into the cert store.  If not specified, and the certificate was read from a file, writes the modified certificate to stdout.
.SS "Global options"
See \fBsq\fR(1) for a description of the global options.
.SH EXAMPLES
.PP

.PP
Bind Alice's old authentication subkey to Alice's new certificate.
.PP
.nf
.RS
sq key subkey bind \\
.RE
.RS
.RS
\-\-cert=C5999E8191BF7B503653BE958B1F7910D01F86E5 \\
.RE
.RE
.RS
.RS
\-\-key=0D45C6A756A038670FDFD85CB1C82E8D27DB23A1
.RE
.RE
.PP
.fi

.PP
Bind a bare key to Alice's certificate.  A bare key is a public key
without any components or signatures.  This simplifies working with raw
keys, e.g., keys generated on an OpenPGP card, a TPM device, etc.
.PP
.nf
.RS
sq key subkey bind \-\-keyring=bare.pgp \\
.RE
.RS
.RS
\-\-cert=C5999E8191BF7B503653BE958B1F7910D01F86E5 \\
.RE
.RE
.RS
.RS
\-\-key=B321BA8F650CB16443E06826DBFA98A78CF6562F \\
.RE
.RE
.RS
.RS
\-\-can\-encrypt=universal
.RE
.RE
.fi
.SH "SEE ALSO"
.nh
\fBsq\fR(1), \fBsq\-key\fR(1), \fBsq\-key\-subkey\fR(1).
.hy
.PP
For the full documentation see <https://book.sequoia\-pgp.org>.
.SH VERSION
1.2.0 (sequoia\-openpgp 1.22.0)