32

I'm getting the following error every time I do apt-get upgrade:

GPG error: http://nginx.org trusty Release: The following signatures were invalid: KEYEXPIRED 1471427554

I just have the official nginx ppa installed the standard way, by having added the following to my sources.list

deb http://nginx.org/packages/ubuntu/ trusty nginx
deb-src http://nginx.org/packages/ubuntu/ trusty nginx

Is this an error from their end that they will eventually fix hopefully, or is there something I'm going to have to do from my end?

  • 1
    Did you download this key from NGINX, then run sudo apt-key add nginx_signing.key and still getting this error? – Thomas Ward Aug 18 '16 at 16:30
  • 2
    this happens ... sometimes. But this ("1471427554") does not look like a valid GPG key. wget http://nginx.org/keys/nginx_signing.key -O - |sudo apt-key add - will do both steps suggested by @ThomasWard in one small command. – Phillip -Zyan K Lee- Stockmann Aug 18 '16 at 16:34
  • LANG=C sudo apt-key adv --keyserver keys.gnupg.net --recv-keys 1471427554 returns the following error: Executing: /tmp/tmp.EU8uLKmT5b/gpg.1.sh --keyserver keys.gnupg.net --recv-keys 1471427554 gpg: "1471427554" not a key ID: skipping – Phillip -Zyan K Lee- Stockmann Aug 18 '16 at 16:38
  • 1
    yes, the key file is available via https as well. – Phillip -Zyan K Lee- Stockmann Aug 18 '16 at 16:52
  • 1
    @Phillip: Actually, 1471427554 is the timestamp of the expiry time for the APT signing key. Modern versions of the date command will parse it to readable format for you: date -u -d @1471427554 gives Wed Aug 17 09:52:34 UTC 2016. – BertD Aug 30 '17 at 23:02
45

After adding a third party repository to a /etc/apt/sources.list.d/* file or /etc/apt/sources.list, you need to make sure the corresponding gpg key is inserted into the apt keystore.

To be more specific for this special case of nginx.org repository: you need to add the nginx.org gpg key file used for the signing of the repository.

This can be done by either downloading the file https://nginx.org/keys/nginx_signing.key manually and issue sudo apt-key add nginx_signing.key (as suggested by nginx.org and @ThomasWard) or you can do this in one single line:

wget https://nginx.org/keys/nginx_signing.key -O - | sudo apt-key add -
  • Ok, this worked, but I must be misreading, or missing something. Why did this suddenly pop up now? I don't get that. – codenoob Aug 19 '16 at 23:31
  • 1
    @linsong described why this popped up now: the old gpg key had expired on August, 17. So you needed to download the new key. – Phillip -Zyan K Lee- Stockmann Aug 20 '16 at 5:39
9

The root cause of this problem is because the "older" Nginx signing key expired on Aug 17, 2016:

$ sudo apt-key list

pub   2048R/7BD9BF62 2011-08-19 [expired: 2016-08-17]
uid                  nginx signing key <signing-key@nginx.com>

To fix this issue, add the new signing key using the command as suggested by @phillip-zyan-k-lee-stockmann and @ThomasWard:

wget https://nginx.org/keys/nginx_signing.key -O - | sudo apt-key add -

The new key now expires in 2024:

$ sudo apt-key list

pub   2048R/7BD9BF62 2011-08-19 [expires: 2024-06-14]
uid                  nginx signing key <signing-key@nginx.com>

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.