How to Fix “MySQL Repository Key Expired” Error in Ubuntu/Debian Apt-Get Update


2 views

When running apt-get update on Ubuntu/Debian systems with MySQL repositories, you might encounter:

W: GPG error: http://repo.mysql.com/apt/ubuntu xenial InRelease: 
The following signatures were invalid: KEYEXPIRED 1550412832 KEYEXPIRED 1550412832
E: The repository 'http://repo.mysql.com/apt/ubuntu xenial InRelease' is not signed.

MySQL regularly rotates their GPG signing keys as a security measure. The error occurs when:

  • The existing key in /etc/apt/trusted.gpg or /usr/share/keyrings/ has expired
  • The package manager can't verify repository metadata integrity
  • Your system cache still references old key fingerprints

First, remove all existing MySQL keys:

sudo apt-key list | grep -i mysql
sudo apt-key del <key-id-from-previous-command>
# Alternatively for newer Ubuntu versions:
sudo rm /usr/share/keyrings/mysql-archive-keyring.gpg

Then import the new key:

# For Ubuntu 16.04/Xenial and newer:
wget -O - https://repo.mysql.com/RPM-GPG-KEY-mysql-2022 | sudo gpg --dearmor -o /usr/share/keyrings/mysql-archive-keyring.gpg

# For Debian systems:
wget -O - https://repo.mysql.com/RPM-GPG-KEY-mysql-2022 | sudo apt-key add -

After adding the key, verify its fingerprint matches MySQL's current signing key:

gpg --show-keys /usr/share/keyrings/mysql-archive-keyring.gpg
# Should show:
# pub   rsa4096 2022-04-14 [SC]
#       A119 8702 FC0D 3568 1D7F  7BCA 3D06 A59D 730D 1967
# uid           MySQL Release Engineering <mysql-build@oss.oracle.com>

For production systems, consider setting up a cron job to check key expiration:

#!/bin/bash
if apt-key list | grep -q "expired: "; then
    wget -O - https://repo.mysql.com/RPM-GPG-KEY-mysql | sudo apt-key add -
    apt-get update
fi

For more stable setups, use MySQL's official repo configuration:

# /etc/apt/sources.list.d/mysql.list
deb [signed-by=/usr/share/keyrings/mysql-archive-keyring.gpg] http://repo.mysql.com/apt/ubuntu/ $(lsb_release -cs) mysql-8.0

If you're seeing errors like this when running apt-get update:

W: GPG error: http://repo.mysql.com/apt/ubuntu xenial InRelease: 
The following signatures were invalid: KEYEXPIRED 1550412832 KEYEXPIRED 1550412832

This typically happens when MySQL's repository signing key has expired. As a developer managing production databases, this can break your deployment pipelines and prevent critical security updates.

MySQL/Oracle periodically rotates their package signing keys for security reasons. The public key in your system's keyring eventually becomes outdated. Unlike some other repositories, MySQL doesn't always provide seamless key rotation.

First, remove the expired key:

sudo apt-key del 5072E1F5

Then download and install the new key:

wget -q -O - https://repo.mysql.com/RPM-GPG-KEY-mysql | sudo apt-key add -

For Debian/Ubuntu systems, you might need to use this alternative approach:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 467B942D3A79BD29

To prevent future occurrences, create a key update script:

#!/bin/bash
# mysql_key_update.sh
KEY_ID="467B942D3A79BD29"
if ! apt-key list | grep -q "$KEY_ID"; then
  echo "Adding MySQL repository key..."
  sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "$KEY_ID"
fi

Add this to your weekly cron jobs:

0 0 * * 0 /path/to/mysql_key_update.sh

After applying the fix, verify with:

sudo apt-get update 2>&1 | grep -i mysql
apt-key list | grep -A1 "MySQL"

You should see clean output without expiration warnings and the new key should show valid dates.

If you're still experiencing issues:

  1. Check your repository configuration in /etc/apt/sources.list.d/mysql.list
  2. Ensure no duplicate entries exist
  3. Try clearing the apt cache: sudo rm -rf /var/lib/apt/lists/*

For Docker users, add this to your Dockerfile:

RUN wget -q -O - https://repo.mysql.com/RPM-GPG-KEY-mysql | apt-key add - \
    && apt-get update