📖 ~1 min read
Table of contents
Symptom & Impact
apt update fails with NO_PUBKEY or EXPKEYSIG, blocking installs and routine security maintenance.
Environment & Reproduction
Seen after mirror migration, key rotation, or stale third-party repository definitions on Debian 11.
Root Cause Analysis
Repository signing keys are missing, expired, or not referenced through signed-by keyring paths.
Quick Triage
Map each apt error line to its repository entry and confirm the expected key fingerprint.
Step-by-Step Diagnosis
Audit /etc/apt/sources.list.d files, keyring locations, and apt-secure warnings in full output.
Solution – Primary Fix
Install refreshed vendor keys into /usr/share/keyrings and update source entries to use signed-by explicitly.
Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.
Solution – Alternative Approaches
Temporarily disable untrusted repositories while restoring valid signing configuration.
Verification & Acceptance Criteria
apt update runs cleanly with no GPG trust warnings and all configured repositories available.
Rollback Plan
Revert modified source files from backup if a key was assigned to the wrong repository.
Prevention & Hardening
Track key expiry dates and store repository definitions in configuration management with checksum controls.
Related Errors & Cross-Refs
NO_PUBKEY, EXPKEYSIG, The repository is not signed, and apt-secure validation failures.
Related tutorial: View the step-by-step tutorial for Debian 11.
View all Debian 11 tutorials on the Tutorials Hub →
Browse all common problems & solutions on the Tutorials Hub.
References & Further Reading
Debian apt-secure, sources.list, and trusted keyring guidance for Bullseye systems.
Need Expert Help?
If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.
