Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

While updating my packages on a debian based system by a

sudo apt-get update

I've got that error message :

Reading package lists... Done
W: GPG error: stable/non-US Release: 
The following signatures were invalid: KEYEXPIRED 1138684904

What should I do to fix this ?

share|improve this question

5 Answers 5

You need to get the newer key and add it, at which point apt will detect it and not complain. This shouldn't normally happen, but it sometimes does. What you really need is to know the hex code of the key you need to add; once you have that, it's pretty much downhill from there.

Some examples:

share|improve this answer
up vote 2 down vote accepted

On the Debian Wiki about SecureAPT, I've found that I should remove the line containing non-us from /etc/apt/sources.list.

I actually did that and it worked.

share|improve this answer
This may have worked in one particular case but is not a generic solution – kynan Nov 4 at 20:52

I had similar error, but problem was in system time. The year was 1961 :)

I corrected system date/time and after that could update without a pro

share|improve this answer

To find any expired repository keys and their IDs, use apt-key as follows:

apt-key list | grep expired

You will get a result similar to the following:

pub   4096R/BE1DB1F1 2011-03-29 [expired: 2014-03-28]

The key ID is the bit after the / i.e. BE1DB1F1 in this case.

To update the key, run

sudo apt-key adv --recv-keys --keyserver BE1DB1F1

Note: Updating the key will obviously not work if the package maintainer has not (yet) uploaded a new key. In that case there is little you can do other than contacting the maintainer, filing a bug against your distribution etc.

share|improve this answer
that does not work for me, after the command for updating the key, the key is still expired. – Karl Forner Nov 6 '14 at 12:20
@KarlForner was adding the key successful? – kynan Nov 7 '14 at 10:18
yes it was successful. – Karl Forner Nov 7 '14 at 14:08
@KarlForner Note that if the package maintainer has not uploaded a new key this will of course have no effect and there's nothing you can do in this case (still my instructions are correct). – kynan Nov 7 '14 at 14:11
ok, kynan, thanks anyway – Karl Forner Nov 7 '14 at 14:22

You don't have to do anything. It is just a warning, you can see that from the W: prefix.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.