How to solve an expired key (KEYEXPIRED) with apt

41 comments

• Ruslan

  2016-09-08

  12:17 PM

  You a little misteken. Command that update key must look like this:

  apt-key adv –keyserver keys.gnupg.net –recv-keys [KEY]

  Reply
  • Michael Boelen

    2016-09-09

    4:51 PM

    Thanks, updated!

    Reply
  • Fred

    2018-04-09

    2:31 PM

    Hi I cant seem to figure out which one is the Key from the list, for example this is what comes up on my machine

    ” pub 4096R/518E17E1″

    Reply
• Eddie Dunn

  2016-09-12

  11:50 AM

  Thanks for the guide; it solved my problem.

  However, the line “apt-key adv –keyserver keys.gnupg.net –recv-keys [KEY]” is broken, since the double dashes before keyserver and recv-keys are replaced by “–”.

  Reply
  • Michael Boelen

    2016-09-12

    11:54 AM

    Thanks, I’ve changed it to a code block. WordPress and the use of dashes/minus signs gets messed up easily.

    Reply
• GeoJulien

  2016-10-23

  11:53 AM

  Thanks for your help.
  I’ve been facing a trouble where the keyserver is unreachable and I’m not behind a proxy. I’ve found the solution: sudo apt-key adv –keyserver hkp://keyserver.ubuntu.com:80 –recv 7F0CEB10

  Reply
  • zhongkang

    2021-10-10

    11:01 AM

    thanks for your advice, it’s working for me

    Reply
• Carlos Alvarez

  2016-10-25

  12:21 AM

  Many thanks for your article. It solved my expired key problem. !!!
  Congratulations from Santiago, Chile.

  Reply
  • Michael Boelen

    2016-10-25

    8:34 PM

    Good to hear that :)

    Reply
• prcek

  2017-02-18

  10:43 AM

  Little addon:

  apt-key list | grep -A 1 expired

  will show expired keys and its next line with uid for better view.

  Reply
  • Michael Boelen

    2017-02-18

    11:16 AM

    Thanks for the feedback!

    Reply
• Peter Kandemalm

  2017-02-20

  11:49 AM

  Great! This solved my problem
  Thanks!!

  Reply
  • Michael Boelen

    2017-02-20

    11:58 AM

    You are very welcome

    Reply
• Mike

  2017-04-21

  6:19 PM

  I don’t get it. What is aktualy the in that update command? Tried everything and I get always failed, because that’s not correct key identifier.

  For example, I have:

  pub 1024D/1A77B3E9 2005-10-29 [wygasł: 2011-01-22]

  So how my “sudo apt-key adv –keyserver keys.gnupg.net –recv-keys [KEY]” command should look like?

  Reply
  • Michael Boelen

    2017-04-22

    6:11 PM

    Hi Mike. Typically you use the part after the slash (1A77..). But this only works if you (or the key owner) uploaded it before. Does that makes sense?

    Reply
• Conny

  2017-08-25

  9:04 AM

  Hi Mike,
  this is what I get when I asked for expired:

  Warning: apt-key output should not be parsed (stdout is not a terminal)

  And that’s all – although there is an expired key …

  I’m using Ubuntu 17.04

  Reply
  • Michael Boelen

    2017-08-26

    10:26 AM

    Run the command without grep and see what it does then.

    Reply
• Nahomi

  2017-10-01

  1:00 AM

  Thanks!

  Reply
• Allen

  2017-11-25

  8:31 PM

  could someone dumb this way down. Sorry but i have no idea what to do. I really shouldn’t be running linux when i know nothing about computers but my brother set this up and i’m stuck. Please help.

  Reply
  • Michael Boelen

    2017-11-28

    1:28 PM

    Some subjects are not easy to further dumb down. Why not ask your brother for guidance?

    Reply
• t

  2017-12-30

  12:56 AM

  “`

  apt-key list |awk ‘/expired/{ print $2 }’ |while read k; do apt-key adv –keyserver keys.gnupg.net –recv-keys ${k#*/}; done

  “`

  Reply
  • bsw

    2020-09-29

    9:25 PM

    KEY=`(LC_ALL=C apt-key list | grep expired | gawk ‘BEGIN { FS=” ” } { print substr($2, length($2)-7, 8) }’ | xargs)`; apt-key adv –keyserver keys.gnupg.net –recv-keys $KEY

    Reply
• Sujan barman

  2018-02-03

  11:16 AM

  Thank you so much sir,
  This article was really very helpful to me.

  Reply
• mrv90

  2018-02-05

  6:39 PM

  Dear Michael! Thanks for your great post.
  One little comment .. i just struggling on “extract” expired key, using step 1, and suddenly, i remembered the key i saw, when i trying to update! (e.g: apt-get update)

  Best regard.

  Reply
• Andru

  2018-02-15

  1:05 PM

  hello help me please

  apt-key list | grep -A 1 expired
  Warning: apt-key output should not be parsed (stdout is not a terminal)
  pub rsa4096 2012-03-05 [SC] [expired: 2018-02-02]
  44C6 513A 8E4F B3D3 0875 F758 ED44 4FF0 7D8D 0BF6
  uid [ expired] Kali Linux Repository

  What is key for this command
  apt-key adv –keyserver keys.gnupg.net –recv-keys [KEY]

  Reply
• USN

  2018-03-17

  12:31 AM

  Keep your keys updated. Run the following one liner:

  apt-key list |grep “expired” | awk ‘{print $2}’ |sed ‘s/\// /g’ |awk ‘{print $2}’ |xargs apt-key adv –keyserver keys.gnupg.net –recv-keys

  Put this in your crontab and you shouldn’t have to worry about expired keys.

  Reply
  • Michael Boelen

    2018-03-22

    8:08 PM

    Thanks, seems like a good tip for those who experience it now and then :)

    Reply
  • pavlos

    2018-04-06

    5:16 PM

    you could combine the first grep in the awk like, apt-key list | awk ‘/expired/{ print $2 }’

    maybe you could explain the sed part …

    Reply
• BlerimJ

  2018-04-12

  2:03 PM

  Thank you. Very clear.

  Reply
• Brian Levinsen

  2018-06-17

  10:47 AM

  Nice one, thanks.
  I had a bunch of them to update so wrote a short one liner.

  for i in `apt-key list | grep “expired:” | awk ‘{print $2}’ | awk -F “/” ‘{print $2}’`; do sudo apt-key adv –keyserver keys.gnupg.net –recv-keys $i; done

  Reply
  • Michael Boelen

    2018-06-17

    3:00 PM

    Thanks for sharing Brian!

    Reply
• Kan

  2018-08-31

  11:55 AM

  Can somebody help me please ? The apt-get update continue ending with error. I’m on Debian Squeeze.

  root@xxx:apt-key list |grep “expired” | awk ‘{print $2}’ |sed ‘s/\// /g’ |awk ‘{print $2}’ |xargs apt-key adv –keyserver keys.gnupg.net –recv-keys
  Executing: gpg –ignore-time-conflict –no-options –no-default-keyring –secret-keyring /etc/apt/secring.gpg –trustdb-name /etc/apt/trustdb.gpg –keyring /etc/apt/trusted.gpg –primary-keyring /etc/apt/trusted.gpg –keyserver keys.gnupg.net –recv-keys F42584E6 6D849617 B98321F9
  gpg: requesting key F42584E6 from hkp server keys.gnupg.net
  gpg: requesting key 6D849617 from hkp server keys.gnupg.net
  gpg: requesting key B98321F9 from hkp server keys.gnupg.net
  gpg: key F42584E6: “Lenny Stable Release Key ” not changed
  gpg: key 6D849617: “Debian-Volatile Archive Automatic Signing Key (5.0/lenny)” not changed
  gpg: key B98321F9: “Squeeze Stable Release Key ” not changed
  gpg: Total number processed: 3
  gpg: unchanged: 3

  root@xxx:/etc/apt# apt-get update
  Hit http://download.proxmox.com squeeze Release.gpg
  Ign http://download.proxmox.com/debian/ squeeze/pve Translation-en
  Ign http://download.proxmox.com/debian/ squeeze/pve Translation-en_US
  Get:1 http://archive.debian.org squeeze Release.gpg [1,655 B]
  Ign http://archive.debian.org/debian/ squeeze/contrib Translation-en
  Ign http://archive.debian.org/debian/ squeeze/contrib Translation-en_US
  Ign http://archive.debian.org/debian/ squeeze/main Translation-en
  Ign http://archive.debian.org/debian/ squeeze/main Translation-en_US
  Hit http://download.proxmox.com squeeze Release
  Get:2 http://archive.debian.org squeeze Release [96.0 kB]
  Ign http://archive.debian.org squeeze Release
  Ign http://download.proxmox.com squeeze/pve amd64 Packages
  Ign http://archive.debian.org squeeze/main amd64 Packages/DiffIndex
  Hit http://download.proxmox.com squeeze/pve amd64 Packages
  Ign http://archive.debian.org squeeze/contrib amd64 Packages/DiffIndex
  Hit http://archive.debian.org squeeze/main amd64 Packages
  Hit http://archive.debian.org squeeze/contrib amd64 Packages
  Fetched 1,656 B in 0s (15.0 kB/s)
  Reading package lists… Done
  W: GPG error: http://archive.debian.org squeeze Release: The following signatures were invalid: KEYEXPIRED 1520281423 KEYEXPIRED 1501892461

  Reply
• Chris

  2018-09-03

  11:08 AM

  same Problem for me.
  pls help

  Reply
• Linux Hacker

  2018-11-27

  11:54 PM

  What if an update key is actually not available (repository maintainer has not updated the keys to sign the repository)? How can then I FORCE apt to continue even without having an updated key? Seems like none of “allow insecure repositories”, “allow downgrade to insecure repositories”, and [trusted=yes] in sources.list actually work – it still refuses to download the updated package list from that repository. How to FORCE it to ignore all safety, disable any and all security and update the repository anyway?
  Don’t tell me that one is hardcoded in apt source code and impossible to bypass!?

  Reply
• Darlene Graham

  2019-03-26

  11:39 AM

  This what mine looks like. What can I do to fix this please help me.

  (trusty)darlenegraham@localhost:~$ sudo apt-key adv-keyserver keys.gnupg.net-recv-key 75E52366
  [sudo] password for darlenegraham:
  Executing: gpg –ignore-time-conflict –no-options –no-default-keyring –homedir /tmp/tmp.TF2m8sWXjL –no-auto-check-trustdb –trust-model always –keyring /etc/apt/trusted.gpg –primary-keyring /etc/apt/trusted.gpg keys.gnupg.net-recv-key 75E52366
  usage: gpg [options] [filename]

  Reply
• automata

  2019-08-24

  8:32 PM

  This will solve the problem

  apt-key adv –keyserver hkp://keys.gnupg.net –recv-keys 7D8D0BF6

  Reply
  • Shay Ben-Sasson

    2019-10-02

    11:04 AM

    Just for completeness (concatenated a few comments):
    apt-key list |grep “expired” | awk ‘{print $2}’ |sed ‘s/\// /g’ |awk ‘{print $2}’ |xargs sudo apt-key adv –keyserver hkp://keyserver.ubuntu.com:80 –recv-keys

    NOTE: html might screw some chars such as: “,’,– (double minus)
    be sure to replace them

    Good luck

    Reply
• Shivdas Kanade

  2019-10-17

  7:27 PM

  I was install MySQL 8 version, got key expired error. I was searching for solution. your article helped to renew expired key.

  Reply
• Tobias Fischer

  2019-11-13

  12:32 AM

  Hi,
  if you have more tha x keys …

  apt-key list | grep “expired” | awk ‘{print $2;}’ | awk -F “/” ‘{print $2;}’ | while read a; do echo $a; apt-key adv –keyserver keys.gnupg.net –recv-keys $a; done

  THX

  Reply
• Raja Gandharaw (GRajaMca)

  2020-02-17

  8:14 AM

  Please use the below command, it should resolve your problems.

  apt-key list | awk ‘/expired/’ RS=”nn” | awk ‘NR==2’| awk ‘{ gsub(/^[ t]+|[ t]+$/, “”); print $9$10}’ | while read a; do echo $a; apt-key adv –recv-key $a; done

  Reply
• Kot

  2021-02-17

  8:48 AM

  Or you can use this command (eliminate problem Warning: apt-key output should not be parsed):

  apt-key list > keys.tmp;cat keys.tmp |grep -v ‘pub\|uid\|gpg\|–\|sub’|awk ‘{print $9$10}’|while read “L”;do [ -n “$L” ] && sudo apt-key adv –keyserver keys.gnupg.net –recv-keys “$L”;done;rm keys.tmp

  After copy please change ” and ‘ because this webform changes them to incorrect forms.

  Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.