If your Debian server uses the DEB.SURY.ORG PHP repository (standard on ISPConfig "perfect server" builds), you may encounter the following error when running apt-get update:
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://packages.sury.org/php bookworm InRelease: The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 DEB.SURY.ORG Automatic Signing Key <[email protected]> W: Failed to fetch https://packages.sury.org/php/dists/bookworm/InRelease The following signatures were invalid: EXPKEYSIG B188E2B695BD4743 DEB.SURY.ORG Automatic Signing Key <[email protected]> W: Some index files failed to download. They have been ignored, or old ones used instead.
This article explains what the error means and how to resolve it correctly on a modern Debian system.
What the Error Means
The DEB.SURY.ORG repository, maintained by Debian PHP maintainer Ondřej Surý, is the de facto source for current PHP versions on Debian. Like all APT repositories, its packages are cryptographically signed, and your server verifies every update against the repository's public signing key.
EXPKEYSIG means the signing key has expired. GPG keys carry built-in expiry dates as a security practice, and the repository periodically rotates to a fresh key. When that happens, every server still holding the old key fails signature verification until the new key is installed.
Two important things to understand before fixing it:
- This is not a compromise or an attack. The repository is fine; your server simply holds an out-of-date copy of its public key.
- Your server is not broken, but it is no longer updating PHP. APT ignores the unverifiable repository and uses stale index files, which means no new PHP packages, including security updates, will be installed until the key is refreshed. Do not leave this unresolved.
Step 1: Verify the Environment
Before changing anything, confirm how the repository is configured on this particular server. Check which sources file references the Sury repository:
grep -r "sury" /etc/apt/sources.list /etc/apt/sources.list.d/
Typical output on an ISPConfig Debian 12 (Bookworm) server:
/etc/apt/sources.list.d/php.list:deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ bookworm main
Note the signed-by= path: that is the keyring file holding the expired key. Yours may differ slightly depending on how and when the repository was originally added. If there is no signed-by= option, the key was added to the legacy global keyring instead, which the fix below also handles.
Step 2: Apply the Official Fix
The repository maintainer publishes a setup script that configures the repository and installs the current signing key. Re-running it on an existing installation refreshes the key:
curl -sSL https://packages.sury.org/php/README.txt | bash -x
The script detects your Debian version, installs the current signing keyring package, and rewrites the repository sources entry to reference it. The -x flag prints each command as it executes, so you can see exactly what the script does to the system.
Then refresh the package index:
apt-get update
The Sury repository line should now complete without GPG warnings.
Alternative: Manual Key Installation
If you prefer not to pipe a remote script into a root shell (a reasonable position for any administrator), the signing key can be installed manually. The repository distributes its current keys as a Debian package:
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb dpkg -i /tmp/debsuryorg-archive-keyring.deb
After installing the keyring package, check where it placed the key:
dpkg -L debsuryorg-archive-keyring | grep gpg
If the keyring path shown differs from the signed-by= path in your sources file (from Step 1), update the sources file to reference the new path, then run:
apt-get update
Step 3: Verify the Fix
A successful apt-get update with no GPG warnings on the Sury lines confirms the new key is in place. To confirm pending PHP updates are now visible again:
apt list --upgradable 2>/dev/null | grep -i php
If PHP updates appear after a period of the repository being ignored, install them at the next maintenance window, as they may include security fixes that were silently skipped while the key was expired.
What Not to Do
- Do not use
apt-key. Older guides for this exact error recommend commands likeapt-key adv --fetch-keys https://packages.sury.org/php/apt.gpg. Theapt-keyutility is deprecated and has been removed from Debian 12 (Bookworm). These instructions no longer work and date the guides that contain them. - Do not disable signature verification (for example with
[trusted=yes]in the sources file or--allow-unauthenticated). This silences the error by removing the security check entirely, leaving the server installing unverified packages indefinitely. - Do not simply remove the repository to make the warning disappear. The installed PHP packages came from it; removing the repository freezes PHP at its current version with no further security updates.
Why This Happens Periodically
Signing keys with expiry dates are deliberate: a key that expires limits the damage window if it is ever leaked, and forces regular rotation. The Sury repository has rotated its signing key several times over the years, and each rotation produces a wave of this exact error across every Debian server using the repository. It is routine maintenance, not an incident, but it does need to be actioned promptly on every affected server, since PHP security updates are silently skipped until the new key is installed.
Administrators managing multiple servers should apply the fix fleet-wide when it occurs, as every Debian server using this repository will be affected at the same time.
Related Articles
- How to Fix a Blank White Screen in ISPConfig After a Sury PHP Upgrade (Read-Only Temp Folder) - another issue originating from the deb.sury.org PHP repository.
Need Help?
If the error persists after following the steps above, or the output of the verification steps differs from what is described, contact the Noiz support team with the full output of apt-get update and the contents of your Sury sources file. Note that assistance on self-managed servers may be billable depending on your support plan.
