ARTIFACTORY: How to Retrieve an Uploaded Private GPG Key in Self-Hosted JFrog Artifactory

Introduction

This article describes how to retrieve a private GPG key that was previously uploaded to JFrog Artifactory. Because Artifactory encrypts sensitive credentials and keys at rest, you cannot export the key directly in plain text from the UI.

To retrieve the key, you must temporarily decrypt Artifactory’s configuration file, extract the key, and immediately re-encrypt the system to maintain security compliance.

Note:

This process applies only to Self-Hosted (On-Premises) Artifactory deployments. It is not applicable to or supported on JFrog Cloud instances.

Important:

Before performing decrytion process we recommend to take a back up of artifactory.config.latest.xml file located in the path $ARTIFACTORY_HOME/artifactory/var/etc/artifactory/artifactory.config.latest.xml.



Procedure:

Step 1: Decrypt Artifactory Key Encryption

To reveal sensitive configuration values in plain text, disable Artifactory's at-rest encryption via the REST API.

API Reference: Deactivate Artifactory Key Encryption

Run the following command using an administrative access token:

Shell

# curl -H "Authorization: Bearer <ADMIN_ACCCESS_TOKEN>" -X POST
https://<ARTIFACTORY_URL>/artifactory/api/system/decrypt

Expected Response:
# DONE

Once the DONE response is returned, sensitive values (including GPG keys) are written in plain text to the disk configuration file. Do not leave the system in this state longer than strictly necessary. Proceed immediately to Step 2.



Step 2: Locate the Private Key in the Configuration File

```
SSH into the Artifactory server host.
```

Open the primary configuration file located at: $ARTIFACTORY_HOME/artifactory/var/etc/artifactory/artifactory.config.latest.xml.

Locate the <keyPairs> section in the XML file.

Copy your private GPG key block (including the -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- headers) and store it in a secure location.

Please refer to the following for reference:

 <keyPairs>
      <keyPair>
          <key>test</key> 
          <alias>test</alias>
          <keyType>GPG</keyType>
          <privateKey>-----BEGIN PGP PRIVATE KEY BLOCK-----

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX



Step 3: Re-encrypt Artifactory Key Encryption

Immediately after retrieving and securely saving the private key, re-enable key encryption to restore system security.

API Reference: Activate Artifactory Key Encryption

Run the following REST API call:

Shell

# curl -H "Authorization: Bearer <ADMIN_ACCCESS_TOKEN>" -X POST
https://<ARTIFACTORY_URL>/artifactory/api/system/encrypt

Expected Response:
# DONE



Step 4: Verify Re-encryption

Re-open artifactory.config.latest.xml and verify that the <keyPairs> section once again displays encrypted string values instead of raw PGP key blocks.