85

I am trying to add a public key for installing a program with CPG. But I am pretty new to this but every command I found gave me the same error:

gpg --keyserver keyserver.ubuntu.com --recv-keys 94558F59
gpg: requesting key 94558F59 from hkp server keyserver.ubuntu.com
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error

How is this possible it seems that the I am behind some kind of blockade which makes it impossible to establish a connection to the key server. I looked into many OP questions and tried all commands I could find but nothing worked. Anyone had this problem before?

10
  • Have you tried using another keyserver? hkp://subkeys.pgp.net or hkp://pgp.mit.edu:11371
    – jasonwryan
    May 15, 2013 at 8:58
  • @jasonwryan Ive tried the pgp.mit.edu but without hkp:// is the use of that important? i dont believe so but its worth trying for me May 15, 2013 at 9:01
  • Use the full address, and the alternate port...
    – jasonwryan
    May 15, 2013 at 9:04
  • @jasonwryan I still got ?: pgp.mit.edu: Connection timed out gpgkeys: HTTP fetch error 7: couldn't connect: Connection timed out gpg: no valid OpenPGP data found. gpg: Total number processed: 0 May 15, 2013 at 9:09
  • 3
    gpg --keyserver hkp://pgp.mit.edu --recv-keys 94558F59 worked for me...
    – jasonwryan
    May 15, 2013 at 9:20

9 Answers 9

152

This is usually caused by your firewall blocking the port 11371. You could unblock the port in your firewall. In case you don't have access to the firewall you could:

Force it to use port 80 instead of 11371

$ sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 94558F59

-or alternatively omitting the port-

$ sudo gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 94558F59

Alternatively

  • Find and open the key from the key server.
  • Copy it's contents into a text file.
  • Go to System Tool > Preferences > Software Sources > Authentication > Add key, and select the text file created. Ubuntu 14.04 and later try: Software Center -> Edit -> Software Sources -> Authentication -> Import key file
8
  • 6
    gpg --import key.txt if you need to import via command line FYI.
    – Banjer
    Nov 4, 2014 at 18:28
  • 1
    sks-keyservers.net/i to download the key FYI Aug 17, 2015 at 20:01
  • 3
    upvote for alternative way! On Ubuntu 14.04 and later, it's added from Software Center -> Edit -> Software Sources -> Authentication -> Import key file
    – Roy Ling
    Nov 10, 2015 at 1:36
  • This fixed my issue w/ install the keys for rvm. The following call was hanging for me: requesting key D39DC0E3 from hkp server keys.gnupg.net
    – mdgrech
    Jun 8, 2016 at 17:58
  • 8
    "Find and open the key from the key server." What nobody mentions is how that's done. In my case, the key in question is on gpg.mit.edu. Okay, easy, just go to pgp.mit.edu and paste the key into the Search String field! Wrong. You must know the magic secret: prepend the key with 0x. If the key is 0F571F6C, you must search for 0x0F571F6C, which is in no way obvious. Jul 13, 2016 at 21:18
26
$ sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys SOMEKEY
10
  • 9
    sudo is not necessary and, other than that, this answer adds nothing to the poster's problem...
    – jasonwryan
    Nov 6, 2013 at 19:45
  • 4
    I was working on this just an hour ago, and adding this line solved the problem for me. There is the difference that I specify port 80 explicitly. I also specify the protocol explicitly. You may be right that sudo is not needed, but my answer does ad a bit of relevant info, don't you think? Oh and, your answer is also correct. Nov 6, 2013 at 20:31
  • 6
    Remove the sudo and the answer is correct.
    – jasonwryan
    Nov 6, 2013 at 20:55
  • 4
    Necessary to recieve keys from a public keyserver? I don't think so...
    – jasonwryan
    Nov 7, 2013 at 1:57
  • 2
    Adding the hkp:// as noted in this answer does work for me. Apr 21, 2016 at 12:11
11

I encountered same problem when I was trying to add a GPG key behind a proxy. The solution to my problem was to add the --keyserver-options in the command:

$ sudo apt-key adv \
     --keyserver-options http-proxy=http://USER:PASSWORD@PROXY_URL:PORT/ \
     --keyserver keyserver.ubuntu.com --recv-keys GPG_KEY
1
  • I ended up having to do this even though I already had http_proxy and https_proxy settings in my environment.
    – thayne
    Dec 8, 2021 at 21:50
10

This worked for me:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com --recv-keys AKEYXXX
1
  • Removing the port was the solution for me. Thanks. Feb 7, 2020 at 15:12
4

Try getting your key from another server (worked for me):

$ sudo gpg --keyserver hkp://keys.gnupg.net --recv-keys 94558F59

or

$ sudo gpg --keyserver hkp://pgp.mit.edu --recv-keys 94558F59
2

I fixed my problem by running the following command:

$ sudo apt-key adv \
   --keyserver hkp://p80.pool.sks-keyservers.net:80 \
   --recv-keys *somekey*
2

The accepted answer is excellent and after almost 8 year (a long time in security and cryptography), it still works. I thought I’d suggest another alternative that offers greater privacy and security:

Use HKPS (HKP over TLS)

This encrypts the connection to the keyserver and helps prevent man-in-the-middle attacks. Also, TCP Port 443 is just as unlikely to be blocked by a corporate firewall as Port 80 (unlike Port 11371).

$ sudo gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 94558F59

Note: the URIs, https://keyserver.ubuntu.com, hkps://keyserver.ubuntu.com, hkps://keyserver.ubuntu.com:443 are all equivalent.

Configuring this as the default server

Since the release of GnuPG 2.1.9 (2015-10-09), the --keyserver option for gpg has been deprecated and users are recommended to “use the --keyserver in dirmngr.conf instead”. The user’s default keyserver can be configured permanently by editing ~/.gnupg/dirmngr.conf:

keyserver hkps://keyserver.ubuntu.com

If the dirmngr daemon is already running, you’ll need to run gpgconf --reload dirmngr for the new configuration to take effect.

System default keyservers

Currently (since versions 2.2.29 and 2.3.2, released in July/August 2021), the GnuPG project has keyserver.ubuntu.com configured as its default keyserver if none is specified by the user while Debian (and Ubuntu) packages of gnupg2 have configured hkps://keys.openpgp.org as the default keyserver since gnupg2 2.2.17-1 (released in 2019).

Note: other answers suggest using SKS keyserver pools. Unfortunately, these have suffered privacy and abuse problems and, as of June 2021, are no longer operating.

0

I'm seeing this on one of two identical boxes running ansible deployments against an ubuntu 14.04 image. In fact, it had previously worked for app-infra-1 but at some point it began to fail. The fact that it succeeded on app-infra-2 freshly recreated suggests it is a corruption on app-infra-1 or a bug in the detection and reporting of apt-key adv.

I tried deleting the key using apt-key del but I continue to get the same error.

changed: [app-infra-2] => {"changed": true, "item": "", "repo": "ppa:webupd8team/java", "state": "present"}
failed: [app-infra-1] => {"cmd": "apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 7B2C3B0889BF5709A105D03AC2518248EEA14886", "failed": true, "item": "", "rc": 2}
stderr: gpg: requesting key EEA14886 from hkp server keyserver.ubuntu.com
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error

stdout: Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/tmp.2zqQuFdBjg --no-auto-check-trustdb --trust-model always --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyring /etc/apt/trusted.gpg.d/puppetlabs-keyring.gpg --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 7B2C3B0889BF5709A105D03AC2518248EEA14886

msg: gpg: requesting key EEA14886 from hkp server keyserver.ubuntu.com
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error

In the end, since it's a vm, my solution was to re-build it with vagrant.

0

For me it was required to add ENV statements into my docker file. E.g.

ENV  http_proxy "http://[yourproxy]:[port]/"
ENV  https_proxy "http://[yourproxy]:[port]/"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.