36

I cannot update my Kali Linux, when trying to execute apt-get update I get this error message:

# apt-get update

Get:1 http://kali.mirror.garr.it/mirrors/kali kali-rolling InRelease [30.5 kB]
Err:1 http://kali.mirror.garr.it/mirrors/kali kali-rolling InRelease
  The following signatures were invalid: EXPKEYSIG ED444FF07D8D0BF6 Kali Linux Repository <[email protected]>
Reading package lists... Done
W: GPG error: http://kali.mirror.garr.it/mirrors/kali kali-rolling InRelease: The following signatures were invalid: EXPKEYSIG ED444FF07D8D0BF6 Kali Linux Repository <[email protected]>
E: The repository 'http://kali.mirror.garr.it/mirrors/kali kali-rolling InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

If you need my kernel version:

# uname -a
4.13.0-kali1-amd64 #1 SMP Debian 4.13.10-1kali2 (2017-11-08) x86_64 GNU/Linux

How can I fix this?

Improve this question
0

7 Answers 7

Reset to default
47

Add the gpg key:

gpg --keyserver keyserver.ubuntu.com --recv-key 7D8D0BF6

Check the fingerprint:

gpg --fingerprint 7D8D0BF6

Sample output:

pub   rsa4096 2012-03-05 [SC] [expires: 2021-02-03]
      44C6 513A 8E4F B3D3 0875  F758 ED44 4FF0 7D8D 0BF6
uid           [ unknown] Kali Linux Repository <[email protected]>
sub   rsa4096 2012-03-05 [E] [expires: 2021-02-03]

then :

gpg -a --export 7D8D0BF6 | apt-key add -
apt update

Debian : SecureApt

update : 8 Feb , 2018.

Answer from the official documentation :

Note that if you haven’t updated your Kali installation in some time (tsk2), you will like receive a GPG error about the repository key being expired (ED444FF07D8D0BF6). Fortunately, this issue is quickly resolved by running the following as root:

wget -q -O - https://archive.kali.org/archive-key.asc | apt-key add

Kali docs: how to deal with APT complaining about Kali's expired key

The easiest solution is to retrieve the latest key and store it in place where apt will find it:

sudo wget https://archive.kali.org/archive-key.asc -O /etc/apt/trusted.gpg.d/kali-archive-keyring.asc
Improve this answer
2
  • 2
    In some cases (like when you install a distro on android, ex:rootfs...), you can't find wget and you can't even install it (apt install wget doesn't work).
    – Ibrahim.H
    May 29, 2021 at 13:10
  • if this key cannot be ultimately trusted, please follow trog.qgl.org/20091030/… to trust it ultimately.
    – markroxor
    Sep 10, 2022 at 12:43
25

Download the key of the kali package repository with this command:

wget -q -O - https://archive.kali.org/archive-key.asc | apt-key add

then run the update.

Improve this answer
0
22

This is built in. If you already use Kali's repos, you don't need to get it from an external source:

$ sudo apt install kali-archive-keyring

I'm using a system that adds Kali to a Debian base, so I had to specify the release. You can check that as follows:

$ apt policy kali-archive-keyring
  Installed: 2015.2
  Candidate: 2015.2
  Version table:
     2018.1 1
          1 http://http.kali.org/kali kali-rolling/main amd64 Packages
          1 http://http.kali.org/kali kali-rolling/main i386 Packages
 *** 2015.2 100
        100 /var/lib/dpkg/status

$ sudo apt install kali-archive-keyring/kali-rolling

This way, you don't have to blindly trust that you're importing the right key in order to prevent a man-in-the-middle attack since the new key is signed by the old one within the repository.

Update: Here's an /etc/apt/sources.list.d/kali.list and /etc/apt/preferences.d/kali-repos.pref, designed to be secondary to another distribution (like Debian), that'll avoid this issue in the future.

If you don't already have this repository and therefore can't get this update, you have two choices:

1: Go to https://http.kali.org/kali/pool/main/k/kali-archive-keyring/, download the .deb file, and install it via dpkg -i kali-archive-keyring*.deb

2: Add it via the repository anyway (it's "insecure" until you add it, though you're at least protected by the HTTPS download in the prior step):

$ sudo apt update -oAcquire::AllowInsecureRepositories=true
$ sudo apt install kali-archive-keyring
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  kali-archive-keyring
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 7,008 B of archives.
After this operation, 17.4 kB of additional space will be used.
Do you want to continue? [Y/n] 
WARNING: The following packages cannot be authenticated!
  kali-archive-keyring
Install these packages without verification? [y/N] y
…

You're now synced with the first part of this answer. Consider using the kali.list and kali-repos.pref I linked there so you don't repeat this problem.

Improve this answer
4
  • 7
    This is the only answer which works with Windows WSL2 Kali Linux, since it doesn't have gpg installed by default, and cannot execute the apt-key add command.
    – kilves76
    Feb 25, 2021 at 17:17
  • 1
    ** FOR WSL2: As mentioned above, this is the only working solution at this time. ** -- Note: I didn't see the above comment from @kilves76 until I had already tried all the other solutions -- I'm hoping someone sees my comment in addition and saves some time. --
    – Joe Johnson
    Aug 2, 2021 at 22:40
  • I had to use this solutionfor 2022 for WSL 2: wget -O --no-check-certificate kali-archive-keyring_2022.1_all.deb sudo apt install ./kali-archive-keyring_2022.1_all.deb -- original youtube.com/watch?v=g0p9IM_dgR4
    – Curtis White
    Jun 18, 2022 at 7:55
  • ** For WSL 2: Actually you may want to disregard the fix as more problems show up-- you must download from Windows store only and update from Windows store only. No other builds are likely to work.
    – Curtis White
    Jun 18, 2022 at 8:26
7

As Kali Linux published in Twitter, your archive-keyring package is outdated. You need to update it by executing this (as root):

wget -q -O - https://archive.kali.org/archive-key.asc  | apt-key add
Improve this answer
2

Old question, but the top result when searching for ED444FF07D8D0BF6 here.

Folks attempting to use Microsoft's instructions for installing Kali manually in Windows Subsystem for Linux (WSL or WSL2) will currently run into this issue. The Kali distribution linked on that page is 2019.2, so the signatures are already outdated as soon as it's installed.

The other answers here look to be outdated at this point, referencing older keyring packages. At this time, the correct update package/process is:

wget https://http.kali.org/kali/pool/main/k/kali-archive-keyring/kali-archive-keyring_2022.1_all.deb
sudo dpkg -i kali-archive-keyring_2022.1_all.deb
Improve this answer
1
  • wget --no-check-certificate http....
    – Kim Steinhaug
    Jun 25 at 15:33
2

Execute these commands as root to fix your issue:

wget https://http.kali.org/kali/pool/main/k/kali-archive-keyring/kali-archive-keyring_2022.1_all.deb
apt install ./kali-archive-keyring_2022.1_all.deb
Improve this answer
1
  • 1
    This is tethered to the version of that package and therefore no longer works. See the second part of my answer for how to perform this method more reliably.
    – Adam Katz
    Oct 2, 2019 at 20:38
0

(The point is not only solving the problem but also knowing why it is giving problem).

If you haven’t updated your Kali installation in some time (tsk2), you will like receive a GPG error about the repository key being expired (ED444FF07D8D0BF6). Fortunately, this issue is quickly resolved by running the following as root:

wget -q -O - https://archive.kali.org/archive-key.asc | apt-key add

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .