17

I understand that keyservers are using the port 11371 but in many cases you are not allowed to connect to this port and you cannot add

There a many cases when you cannot modify the firewall configuration.

Example command that fails

 gpg --keyserver keyserver.ubuntu.com --recv-keys 0A5174AF

How do you solve this issue?

17

Some key servers answer to port 80 as well:

gpg --keyserver hkp://wwwkeys.de.pgp.net:80 --recv-keys 0A5174AF

And since hkp relies on http, you should be able to use it trough a web proxy too.

| improve this answer | |
  • 2
    Ubuntu solve this problem and now the server also responds on port 80. – sorin Sep 22 '10 at 13:58
  • 3
    wwwkeys.de.pgp.net:80 does not work anymore. – BuZZ-dEE Feb 23 '17 at 12:22
  • 1
    hkp://p80.pool.sks-keyservers.net:80 works. – irritable_phd_syndrom Feb 26 '18 at 13:06
  • also hkp://keys.gnupg.net:80 – Trevor Boyd Smith Dec 11 '19 at 16:46
12

Something like

gpg --keyserver hkp://p80.pool.sks-keyservers.net:80 \
    --keyserver-options "timeout=10 http-proxy=$http_proxy" \
    --recv-keys B0F4253373F8F6F510D42178520A9993A1C052F8

The decisive part is http-proxy=$http_proxy, which can be replaced with http-proxy=http://corporate.proxy.test:8765 for example.

| improve this answer | |
  • 2
    Important to note that the order of the flags is important here. If you put --recv-keys before --keyserver-options, you'll get an error that looks like: gpg: Note: '--keyserver-options' is not considered an option gpg: "--keyserver-options" not a key ID: skipping gpg: "timeout=10 http-proxy=http://fooproxy:8080" not a key ID: skipping – Mani May 23 '18 at 9:01
  • 1
    The manual page states that keyserver-options can be comma or space delimited, but I found the comma necessary whilst space-delimiting resulting in a gpg usage error. gpg version 2.0.22. Like: --keyserver-options "timeout=10,http-proxy=${http_proxy}" – Ed Randall Jan 9 at 9:15
3

try this

sudo apt-key adv --keyserver-options http-proxy="http://<username>:<password>@<proxy_server_addr>:<proxy_port>" --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys <key_to_import>
| improve this answer | |
  • 1
    Welcome to Server Fault! Whilst this may theoretically answer the question, please provide context around commands so others will have some idea what it is supposed to do and why it’s a solution. - Using a proxy is often a good solution though. – HBruijn Oct 15 '15 at 11:54
2

Just wanted to add a few notes here.

The manual page for gpg notes that the --keyserver-options "http-proxy=foo" will override the http_proxy environment variable, but at least for...

gpg --version gpg (GnuPG) 2.1.15 libgcrypt 1.7.9

It fails to pick up the http_proxy environment variable (or HTTP_PROXY) but does accept the --keyserver-options solution.

| improve this answer | |
  • Can you please provide a link to this site? I suspect that the options switch overwrites the proxy variable, but only for this one command. The http_proxy variable is then unchanged to the old one. However, it is not perfectly programmed if the http_proxy and no_proxy variables are ignored. – uav Oct 11 '19 at 20:21
  • 1
    I don't understand why apt, Java and gpg need their own proxy definitions anyway. They should, in my opinion, use the default environment variables! There is a trick for apt. Just create an empty /etc/apt/apt.conf. LOL, who makes this up? – uav Oct 11 '19 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.