--- title: "How to Fix the DEB.SURY.ORG Expired Signing Key Error (EXPKEYSIG) on Debian" description: "Fix the EXPKEYSIG expired signing key error from the DEB.SURY.ORG PHP repository on Debian so apt can install PHP security updates again." url: "https://docs.noiz.ie/ispconfig/how-to-fix-the-debsuryorg-expired-signing-key-error-expkeysig-on-debian/" section: "ISPConfig" categories: - "Control Panels > ISPConfig > ISPConfig Troubleshooting" last_reviewed: "1 August 2026" --- # How to Fix the DEB.SURY.ORG Expired Signing Key Error (EXPKEYSIG) on Debian If your Debian server uses the DEB.SURY.ORG PHP repository (standard on ISPConfig "perfect server" builds), you may encounter the following error when running `apt-get update`: ``` W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.sury.org/php bookworm InRelease: The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 DEB.SURY.ORG Automatic Signing Key W: Failed to fetch https://packages.sury.org/php/dists/bookworm/InRelease The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 DEB.SURY.ORG Automatic Signing Key W: Some index files failed to download. They have been ignored, or old ones used instead. ``` This article explains what the error means and how to resolve it correctly on a modern Debian system. **Last reviewed:** 1 August 2026. Key expiry dates change, but the re-fetch procedure below is the same for any DEB.SURY.ORG key expiry on Debian. ### Official Documentation Reference - [DEB.SURY.ORG PHP repository setup script](https://packages.sury.org/php/README.txt): the maintainer's own script, which installs the current keyring package and writes the repository entry. - [Debian `sources.list(5)` manual](https://manpages.debian.org/bookworm/apt/sources.list.5.en.html): the `Signed-By` option referred to throughout this guide. - [Debian `apt-key(8)` manual](https://manpages.debian.org/bookworm/apt/apt-key.8.en.html): the deprecation notice for `apt-key`, and why it should not be used for this fix. ## What the Error Means The DEB.SURY.ORG repository, maintained by Debian PHP maintainer Ondřej Surý, is the de facto source for current PHP versions on Debian. Like all APT repositories, its packages are cryptographically signed, and your server verifies every update against the repository's public signing key. `EXPKEYSIG` means **the signing key has expired**. GPG keys carry built-in expiry dates as a security practice, and the repository periodically rotates to a fresh key. When that happens, every server still holding the old key fails signature verification until the new key is installed. Two important things to understand before fixing it: - **This is not a compromise or an attack.** The repository is fine; your server simply holds an out-of-date copy of its public key. - **Your server is not broken, but it is no longer updating PHP.** APT ignores the unverifiable repository and uses stale index files, which means no new PHP packages, including security updates, will be installed until the key is refreshed. Do not leave this unresolved. ## Step 1: Verify the Environment Before changing anything, confirm how the repository is configured on this particular server. Check which sources file references the Sury repository: ``` grep -r "sury" /etc/apt/sources.list /etc/apt/sources.list.d/ ``` Typical output on an ISPConfig Debian 12 (Bookworm) server: ``` /etc/apt/sources.list.d/php.list:deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ bookworm main ``` Note the `signed-by=` path: that is the keyring file holding the expired key. Yours may differ slightly depending on how and when the repository was originally added. If there is no `signed-by=` option, the key was added to the legacy global keyring instead, which the fix below also handles. ## Step 2: Apply the Official Fix The repository maintainer publishes a setup script that configures the repository and installs the current signing key. Re-running it on an existing installation refreshes the key: ``` curl -sSL https://packages.sury.org/php/README.txt | bash -x ``` The script detects your Debian version, installs the current signing keyring package, and rewrites the repository sources entry to reference it. The `-x` flag prints each command as it executes, so you can see exactly what the script does to the system. The script only writes `/etc/apt/sources.list.d/php.list`. If Step 1 showed the Sury repository in any other file as well (for example `sury-php.list`, or a line in `/etc/apt/sources.list`), remove those older entries before the next step. Two entries for the same repository with different `signed-by=` paths make apt stop with "Conflicting values set for option Signed-By". Then refresh the package index: ``` apt-get update ``` The Sury repository line should now complete without GPG warnings. ## Alternative: Manual Key Installation If you prefer not to pipe a remote script into a root shell (a reasonable position for any administrator), the signing key can be installed manually. The repository distributes its current keys as a Debian package: ``` curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb dpkg -i /tmp/debsuryorg-archive-keyring.deb ``` After installing the keyring package, check where it placed the key: ``` dpkg -L debsuryorg-archive-keyring | grep gpg ``` If the keyring path shown differs from the `signed-by=` path in your sources file (from Step 1), update the sources file to reference the new path, then run: ``` apt-get update ``` ## Step 3: Verify the Fix A successful `apt-get update` with no GPG warnings on the Sury lines confirms the new key is in place. To confirm pending PHP updates are now visible again: ``` apt list --upgradable 2>/dev/null | grep -i php ``` If PHP updates appear after a period of the repository being ignored, install them at the next maintenance window, as they may include security fixes that were silently skipped while the key was expired. ## What Not to Do - **Do not use `apt-key`.** Older guides for this exact error recommend commands like `apt-key adv --fetch-keys https://packages.sury.org/php/apt.gpg`. The `apt-key` utility is deprecated on Debian 11 and 12 and has been removed from Debian 13 (Trixie). Where it still exists it adds keys to a global keyring trusted for every repository, which is the practice `signed-by=` replaces. - **Do not disable signature verification** (for example with `[trusted=yes]` in the sources file or `--allow-unauthenticated`). This silences the error by removing the security check entirely, leaving the server installing unverified packages indefinitely. - **Do not simply remove the repository** to make the warning disappear. The installed PHP packages came from it; removing the repository freezes PHP at its current version with no further security updates. ## Why This Happens Periodically Signing keys with expiry dates are deliberate: a key that expires limits the damage window if it is ever leaked, and forces regular rotation. The Sury repository has rotated its signing key several times over the years, and each rotation produces a wave of this exact error across every Debian server using the repository. It is routine maintenance, not an incident, but it does need to be actioned promptly on every affected server, since PHP security updates are silently skipped until the new key is installed. Administrators managing multiple servers should apply the fix fleet-wide when it occurs, as every Debian server using this repository will be affected at the same time. ## Related Articles - [How to Fix a Blank White Screen in ISPConfig After a Sury PHP Upgrade (Read-Only Temp Folder)](/ispconfig/how-to-fix-a-blank-white-screen-in-ispconfig-after-a-sury-php-upgrade-read-only-/) - another issue originating from the deb.sury.org PHP repository. ## Need Help? If the error persists after following the steps above, or the output of the verification steps differs from what is described, contact the Noiz support team with the full output of `apt-get update` and the contents of your Sury sources file. Note that assistance on self-managed servers may be billable depending on your support plan. --- Source: https://docs.noiz.ie/ispconfig/how-to-fix-the-debsuryorg-expired-signing-key-error-expkeysig-on-debian/