21

I understand that keyservers are using the port 11371 but in many cases you are not allowed to connect to this port and you cannot add

There a many cases when you cannot modify the firewall configuration.

Example command that fails

 gpg --keyserver keyserver.ubuntu.com --recv-keys 0A5174AF

How do you solve this issue?

19

Some key servers answer to port 80 as well:

gpg --keyserver hkp://wwwkeys.de.pgp.net:80 --recv-keys 0A5174AF

And since hkp relies on http, you should be able to use it trough a web proxy too.

4
  • 2
    Ubuntu solve this problem and now the server also responds on port 80.
    – sorin
    Sep 22 '10 at 13:58
  • 3
    wwwkeys.de.pgp.net:80 does not work anymore.
    – BuZZ-dEE
    Feb 23 '17 at 12:22
  • 1
    hkp://p80.pool.sks-keyservers.net:80 works. Feb 26 '18 at 13:06
  • also hkp://keys.gnupg.net:80 Dec 11 '19 at 16:46
17

Something like

gpg --keyserver hkp://p80.pool.sks-keyservers.net:80 \
    --keyserver-options "timeout=40 http-proxy=$http_proxy" \
    --recv-keys B0F4253373F8F6F510D42178520A9993A1C052F8

The decisive part is http-proxy=$http_proxy, which can be replaced with http-proxy=http://corporate.proxy.test:8765 for example.


BTW: https://askubuntu.com/a/102505/519948

2
  • 3
    Important to note that the order of the flags is important here. If you put --recv-keys before --keyserver-options, you'll get an error that looks like: gpg: Note: '--keyserver-options' is not considered an option gpg: "--keyserver-options" not a key ID: skipping gpg: "timeout=10 http-proxy=http://fooproxy:8080" not a key ID: skipping
    – Mani
    May 23 '18 at 9:01
  • 1
    The manual page states that keyserver-options can be comma or space delimited, but I found the comma necessary whilst space-delimiting resulting in a gpg usage error. gpg version 2.0.22. Like: --keyserver-options "timeout=10,http-proxy=${http_proxy}"
    – Ed Randall
    Jan 9 '20 at 9:15
3

try this

sudo apt-key adv --keyserver-options http-proxy="http://<username>:<password>@<proxy_server_addr>:<proxy_port>" --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys <key_to_import>
1
  • 1
    Welcome to Server Fault! Whilst this may theoretically answer the question, please provide context around commands so others will have some idea what it is supposed to do and why it’s a solution. - Using a proxy is often a good solution though.
    – HBruijn
    Oct 15 '15 at 11:54
2

Just wanted to add a few notes here.

The manual page for gpg notes that the --keyserver-options "http-proxy=foo" will override the http_proxy environment variable, but at least for...

gpg --version gpg (GnuPG) 2.1.15 libgcrypt 1.7.9

It fails to pick up the http_proxy environment variable (or HTTP_PROXY) but does accept the --keyserver-options solution.

2
  • Can you please provide a link to this site? I suspect that the options switch overwrites the proxy variable, but only for this one command. The http_proxy variable is then unchanged to the old one. However, it is not perfectly programmed if the http_proxy and no_proxy variables are ignored.
    – uav
    Oct 11 '19 at 20:21
  • 1
    I don't understand why apt, Java and gpg need their own proxy definitions anyway. They should, in my opinion, use the default environment variables! There is a trick for apt. Just create an empty /etc/apt/apt.conf. LOL, who makes this up?
    – uav
    Oct 11 '19 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.