I am using Debian wheezy and I would like to install the package apt-transport-https, which allows to access apt repositories through the https protocol.

What really puzzles me is that the apt-get gives me the following message:

$ sudo apt-get install apt-transport-https
The following NEW packages will be installed:
0 upgraded, 1 newly installed, 0 to remove and 14 not upgraded.
Need to get 109 kB of archives.
After this operation, 166 kB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
Install these packages without verification [y/N]?

I pressed N because I would like to clarify this before installing the package. Why is no authentication information for this package provided? I would expect this to be the default, especially for a package that provides a secure transfer protocol.

2 Answers 2


When running apt-get update for a https mirror without apt-transport-https installed, you probably invalidated your cached (sources) data, as a side effect invalidating the signatures - this should fix itself after running "apt-get update" again (you might have to revert to a non-https mirror temporarily).

  • I've added sury repo (packages.sury.org/php), run apt update, after which I tried to install apt-transport-https. That gave me the warning. I disabled the repo (comment out, apt update), and the warning never appeared again.
    – x-yuri
    Commented Jan 25, 2019 at 14:27

Debian adds keys that will be used to sign the packages in the future to the debian-archive-keyring package. That's why you need this package updated. If apt-get update won't work, you might have to (re)install keyrings:

sudo apt-get remove debian-keyring debian-archive-keyring

sudo apt-get clean

sudo apt-get update

sudo apt-get -y install debian-keyring debian-archive-keyring

Source: server fault

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .