Configure and Check dirmngr Without Losing Track of Its Daemon

A GnuPG key fetch hangs, and you have no idea which dirmngr is answering or what it thinks its keyserver is. You will configure the per-user GnuPG network daemon, check which instance is running, and reload or replace it without guessing who owns the socket. The examples use dirmngr 2.4.4 from Ubuntu package dirmngr 2.4.4-2ubuntu17.6. Allow about fifteen minutes, or longer if a proxy or certificate service is involved.

dirmngr normally starts on demand when a GnuPG tool needs it. It handles OpenPGP keyserver access, and it also supports CRL, certificate and OCSP network operations for GnuPG's X.509 tools. You manage it through gpgconf and inspect it through gpg-connect-agent. You do not launch a second system daemon by hand.

1. Check the installed program

Start with read-only checks. None of these needs elevated privileges:

$ command -v dirmngr
/usr/bin/dirmngr
$ dirmngr --version
dirmngr (GnuPG) 2.4.4
$ dpkg-query -W -f='${Package} ${Version}\n' dirmngr
dirmngr 2.4.4-2ubuntu17.6

The package version and program version normally agree, but record both when you diagnose a distribution-specific issue.

The default per-user home is ~/.gnupg, unless GNUPGHOME is set. Dirmngr keeps its configuration and runtime data under that GnuPG home.

2. Inspect the current daemon

Ask gpgconf to start the daemon on demand, then query it. Starting your own on-demand daemon is ordinary and does not need sudo:

$ gpgconf --launch dirmngr
$ gpg-connect-agent --dirmngr 'GETINFO version' /bye
D 2.4.4
OK
$ gpg-connect-agent --dirmngr 'GETINFO socket_name' /bye
D /run/user/1004/gnupg/S.dirmngr
OK

3. Set a keyserver deliberately

On this installation, dirmngr's Debian configuration reports hkps://keys.openpgp.org as the built-in keyserver. Make an explicit choice only when your environment needs one. A keyserver URI is network-sensitive configuration, so use a host your organisation approves and prefer TLS:

$ install -d -m 700 "$GNUPGHOME" 2>/dev/null || install -d -m 700 "$HOME/.gnupg"
$ printf '%s\n' 'keyserver hkps://keys.openpgp.org' >> "$HOME/.gnupg/dirmngr.conf"

• The first command is optional if the directory already exists.
• If GNUPGHOME is set, do not copy it blindly. Edit $GNUPGHOME/dirmngr.conf instead.
• Drop the dashes. The configuration file uses option names without the leading two dashes: write keyserver, not --keyserver.

Before appending to a real configuration file, inspect it to avoid duplicate or contradictory settings:

$ test -f "$HOME/.gnupg/dirmngr.conf" && sed -n '1,160p' "$HOME/.gnupg/dirmngr.conf"
$ gpgconf --list-options dirmngr | grep '^keyserver:'
keyserver:16:0:use keyserver at URL:1:1:URL:"hkps%3a//keys.openpgp.org::

4. Reload the configuration

Reload the existing user daemon through gpgconf:

$ gpgconf --reload dirmngr
$ gpg-connect-agent --dirmngr 'GETINFO version' /bye
D 2.4.4
OK

A reload rereads dirmngr.conf and refreshes cached CRLs and certificates. The manual warns that not every option takes effect immediately: the LDAP server list file is not reread on reload, while --ldapserver entries are. If a changed setting still looks stale, stop the user daemon so GnuPG can start a fresh one:

$ gpgconf --kill dirmngr
$ gpgconf --launch dirmngr
$ gpg-connect-agent --dirmngr 'GETINFO version' /bye
D 2.4.4
OK

5. Add diagnostics without changing network policy

When a keyserver or certificate request fails, turn on a log file and verbosity temporarily in dirmngr.conf:

log-file ~/.gnupg/dirmngr.log
verbose

Then reload, or kill and relaunch the daemon, reproduce one failing request, and read the log:

$ gpgconf --reload dirmngr
$ tail -n 80 "$HOME/.gnupg/dirmngr.log"
$ gpgconf --kill dirmngr

Remove verbose and log-file when the investigation ends, then reload again. Leaving verbose logging on makes later failures harder to find, and the file can grow indefinitely.

6. Separate keyserver problems from daemon problems

Use the dirmngr Assuan interface to inspect its current keyserver session. This is diagnostic only and does not fetch or publish a key:

$ gpg-connect-agent --dirmngr 'KEYSERVER' /bye
D hkps://keys.openpgp.org
OK
$ gpg-connect-agent --dirmngr 'help keyserver' /bye
# KEYSERVER [<options>] [<uri>|<host>]
OK

If this returns OK but a key operation fails, look at DNS, proxy, TLS trust or the selected keyserver rather than restarting dirmngr over and over. The daemon can honour the http_proxy environment setting when proxy honouring is configured, or use an explicit HTTP proxy.

OCSP requests are rejected by default for privacy reasons. Enable allow-ocsp only when the application and trust policy require it.