How to fix E: Sub-process apt-key returned an error code in APT

APTINTERMEDIATEHIGHUpdated Dec 29, 2025· 158 views

This error occurs when apt cannot verify GPG signatures for package repositories because a required GPG key is missing, expired, or outdated. It prevents package updates and installations.

Quick fix

Fixes E: Sub-process apt-key returned an error code

sudo apt update 2>&1 | grep -i "apt-key\|signature\|error"
  1. Check which repository is causing the error
  2. For Kali Linux: Update the archive signing key
  3. For third-party PPAs: Re-add the PPA with the key
  4. Manually add a missing GPG key (modern method)
apt — error
sudo apt update 2>&1 | grep -i "apt-key\|signature\|error"
E: Sub-process apt-key returned an error code

What this error means

The apt package manager uses GPG (GNU Privacy Guard) cryptographic keys to verify that packages come from trusted repositories. When apt-key subprocess fails, it means the system cannot authenticate the repository's signature. This typically happens because: (1) the GPG key for a repository has expired or been rotated, (2) the key was never imported into the system, (3) the key file is corrupted or inaccessible, or (4) you're using an outdated or unsupported key management method (apt-key is deprecated as of Ubuntu 20.10/Debian 11).

Typical symptoms

  • apt update or apt install commands fail with the apt-key error
  • Warning messages about deprecated apt-key when running apt commands
  • Unable to authenticate repository signatures
  • Package installation blocked due to GPG verification failure
  • Errors specifically mentioning 'Sub-process /usr/bin/apt-key returned an error'

Common causes

  1. GPG key for a repository has expired or been rotated by the repository maintainers
  2. Third-party PPA (Personal Package Archive) key not properly imported
  3. Using deprecated apt-key method instead of modern gpg/trusted.gpg.d approach
  4. Repository key file missing or corrupted in /etc/apt/trusted.gpg or /etc/apt/trusted.gpg.d
  5. Network connectivity issues preventing key download during repository setup
  6. Conflicting or outdated archive-keyring package on the system

How to fix "E: Sub-process apt-key returned an error code"

1Check which repository is causing the error

Run sudo apt update with verbose output to identify which repository is failing:

bash
sudo apt update 2>&1 | grep -i "apt-key\|signature\|error"

This will show you which PPA or repository is causing the GPG verification failure.

2For Kali Linux: Update the archive signing key

If you're using Kali Linux, Kali periodically rotates its archive signing key. Download and install the new key:

bash
sudo curl -fsSL https://archive.kali.org/archive-key.asc | gpg --dearmor -o /etc/apt/trusted.gpg.d/kali-archive-keyring.gpg

Then retry sudo apt update.

3For third-party PPAs: Re-add the PPA with the key

If the error is from a third-party PPA, remove and re-add it:

bash
sudo add-apt-repository --remove ppa:username/ppaname
sudo add-apt-repository ppa:username/ppaname

The add-apt-repository command will automatically fetch and install the required GPG key.

4Manually add a missing GPG key (modern method)

For repositories not managed by add-apt-repository, download the key using gpg (not apt-key):

bash
wget -nc https://example.com/key.asc
cat key.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/repository-name.gpg > /dev/null

Then update your sources.list entry to reference the key:

bash
echo "deb [signed-by=/etc/apt/trusted.gpg.d/repository-name.gpg] http://repository.example.com/apt focal main" | sudo tee /etc/apt/sources.list.d/repository.list
5Reconfigure dpkg and fix broken dependencies

After updating keys, reconfigure the package manager:

bash
sudo dpkg --configure -a
sudo apt install --fix-broken
sudo apt update

These commands repair any corrupted package database state left by the failed key verification.

6Remove problematic repositories if error persists

If a specific PPA is causing persistent issues, disable it temporarily:

bash
sudo add-apt-repository --remove ppa:username/ppaname
# Or remove from sources.list.d if using manual entry:
sudo rm /etc/apt/sources.list.d/repository.list

Then retry sudo apt update. You can re-add the repository once its key issues are resolved.

Advanced notes

The apt-key tool is deprecated as of Ubuntu 20.10 and Debian 11 and will be removed in future versions. The modern approach is to store GPG keys in /etc/apt/trusted.gpg.d/ as binary .gpg files and reference them explicitly in sources.list entries using the [signed-by=] option. This improves security by limiting key trust to specific repositories rather than globally. If you see 'apt-key is deprecated' warnings (distinct from the error), they won't block operations yet but indicate you should migrate to the modern method. For system-wide key distribution, the archive-keyring package (e.g., ubuntu-keyring, debian-archive-keyring, kali-archive-keyring) should be kept up to date as it contains current repository signing keys. If keys expire on the repository side and you cannot update archive-keyring, manually downloading and installing the new key (as shown in step 4) is the workaround.

Frequently asked questions

What does "E: Sub-process apt-key returned an error code" mean?
The apt package manager uses GPG (GNU Privacy Guard) cryptographic keys to verify that packages come from trusted repositories. When apt-key subprocess fails, it means the system cannot authenticate the repository's signature. 10/Debian 11).
How do I fix "E: Sub-process apt-key returned an error code"?
This error occurs when apt cannot verify GPG signatures for package repositories because a required GPG key is missing, expired, or outdated. It prevents package updates and installations.
What causes "E: Sub-process apt-key returned an error code"?
GPG key for a repository has expired or been rotated by the repository maintainers Third-party PPA (Personal Package Archive) key not properly imported Using deprecated apt-key method instead of modern gpg/trusted.gpg.d approach
Is the "E: Sub-process apt-key returned an error code" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading