keyserver timed out when trying to add a GPG public key

Question

I am trying to add a public key for installing a program with CPG. But I am pretty new to this but every command I found gave me the same error:

gpg --keyserver keyserver.ubuntu.com --recv-keys 94558F59
gpg: requesting key 94558F59 from hkp server keyserver.ubuntu.com
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error

How is this possible it seems that the I am behind some kind of blockade which makes it impossible to establish a connection to the key server. I looked into many OP questions and tried all commands I could find but nothing worked. Anyone had this problem before?

Answer 1

This is usually caused by your firewall blocking the port 11371. You could unblock the port in your firewall. In case you don't have access to the firewall you could:

Force it to use port 80 instead of 11371

$ sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 94558F59

-or alternatively omitting the port-

$ sudo gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 94558F59

Alternatively

• Find and open the key from the key server.
• Copy it's contents into a text file.
• Go to System Tool > Preferences > Software Sources > Authentication > Add key, and select the text file created. Ubuntu 14.04 and later try: Software Center -> Edit -> Software Sources -> Authentication -> Import key file

Answer 2

$ sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys SOMEKEY

Answer 3

I encountered same problem when I was trying to add a GPG key behind a proxy. The solution to my problem was to add the --keyserver-options in the command:

$ sudo apt-key adv \
     --keyserver-options http-proxy=http://USER:PASSWORD@PROXY_URL:PORT/ \
     --keyserver keyserver.ubuntu.com --recv-keys GPG_KEY

Answer 4

This worked for me:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com --recv-keys AKEYXXX

Answer 5

Try getting your key from another server (worked for me):

$ sudo gpg --keyserver hkp://keys.gnupg.net --recv-keys 94558F59

or

$ sudo gpg --keyserver hkp://pgp.mit.edu --recv-keys 94558F59

Answer 6

I fixed my problem by running the following command:

$ sudo apt-key adv \
   --keyserver hkp://p80.pool.sks-keyservers.net:80 \
   --recv-keys *somekey*

Answer 7

The accepted answer is excellent and after almost 8 year (a long time in security and cryptography), it still works. I thought I’d suggest another alternative that offers greater privacy and security:

Use HKPS (HKP over TLS)

This encrypts the connection to the keyserver and helps prevent man-in-the-middle attacks. Also, TCP Port 443 is just as unlikely to be blocked by a corporate firewall as Port 80 (unlike Port 11371).

$ sudo gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 94558F59

Note: the URIs, https://keyserver.ubuntu.com, hkps://keyserver.ubuntu.com, hkps://keyserver.ubuntu.com:443 are all equivalent.

Configuring this as the default server

Since the release of GnuPG 2.1.9 (2015-10-09), the --keyserver option for gpg has been deprecated and users are recommended to “use the --keyserver in dirmngr.conf instead”. The user’s default keyserver can be configured permanently by editing ~/.gnupg/dirmngr.conf:

keyserver hkps://keyserver.ubuntu.com

If the dirmngr daemon is already running, you’ll need to run gpgconf --reload dirmngr for the new configuration to take effect.

System default keyservers

Currently (since versions 2.2.29 and 2.3.2, released in July/August 2021), the GnuPG project has keyserver.ubuntu.com configured as its default keyserver if none is specified by the user while Debian (and Ubuntu) packages of gnupg2 have configured hkps://keys.openpgp.org as the default keyserver since gnupg2 2.2.17-1 (released in 2019).

Note: other answers suggest using SKS keyserver pools. Unfortunately, these have suffered privacy and abuse problems and, as of June 2021, are no longer operating.

Answer 8

I'm seeing this on one of two identical boxes running ansible deployments against an ubuntu 14.04 image. In fact, it had previously worked for app-infra-1 but at some point it began to fail. The fact that it succeeded on app-infra-2 freshly recreated suggests it is a corruption on app-infra-1 or a bug in the detection and reporting of apt-key adv.

I tried deleting the key using apt-key del but I continue to get the same error.

changed: [app-infra-2] => {"changed": true, "item": "", "repo": "ppa:webupd8team/java", "state": "present"}
failed: [app-infra-1] => {"cmd": "apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 7B2C3B0889BF5709A105D03AC2518248EEA14886", "failed": true, "item": "", "rc": 2}
stderr: gpg: requesting key EEA14886 from hkp server keyserver.ubuntu.com
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error

stdout: Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.2zqQuFdBjg --no-auto-check-trustdb --trust-model always --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/puppetlabs-keyring.gpg --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 7B2C3B0889BF5709A105D03AC2518248EEA14886

msg: gpg: requesting key EEA14886 from hkp server keyserver.ubuntu.com
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error

In the end, since it's a vm, my solution was to re-build it with vagrant.

Answer 9

For me it was required to add ENV statements into my docker file. E.g.

ENV  http_proxy "http://[yourproxy]:[port]/"
ENV  https_proxy "http://[yourproxy]:[port]/"