subkeys.pgp.net and wwwkeys.pgp.net: what to use instead

Updated November 2026

The hosts subkeys.pgp.net, pool.subkeys.pgp.net, wwwkeys.pgp.net and the country names such as wwwkeys.de.pgp.net no longer run a keyserver. Replace them with hkps://keys.openpgp.org or hkps://keyserver.ubuntu.com, ask for keys by full fingerprint, and for APT store the key in /etc/apt/keyrings/ and point to it with Signed-By.

What stopped working

Old instructions all over the web still contain lines like these:

gpg --keyserver subkeys.pgp.net --recv-keys 0x12345678
gpg --keyserver wwwkeys.pgp.net --recv-key 12345678
sudo apt-key adv --keyserver subkeys.pgp.net --recv-keys 12345678
keyserver hkp://pool.subkeys.pgp.net

A host name without a scheme, or with hkp://, makes GnuPG connect to TCP port 11371. As of November 2026 no pgp.net name accepts connections on that port. With GnuPG 2.4 the result looks like this (tested November 2026):

$ gpg --keyserver subkeys.pgp.net --recv-keys <FINGERPRINT>
gpg: keyserver receive failed: No keyserver available

The exact wording can differ between versions and setups. The fix is the same: point the command at a keyserver that works. apt-key adv only passes its options to gpg, so it fails the same way.

Quick replacements

Old command and its modern replacement (GnuPG 2.4 and 2.5, as of November 2026)
Old	Use instead
`gpg --keyserver subkeys.pgp.net --recv-keys ID`	`gpg --keyserver hkps://keys.openpgp.org --recv-keys FINGERPRINT`
`gpg --keyserver wwwkeys.pgp.net --recv-key ID`	`gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys FINGERPRINT`
`gpg --keyserver subkeys.pgp.net --search-keys name@example.org`	`gpg --auto-key-locate clear,wkd,keyserver --keyserver hkps://keys.openpgp.org --locate-keys name@example.org`
`keyserver hkp://subkeys.pgp.net` in `gpg.conf`	`keyserver hkps://keys.openpgp.org` in `dirmngr.conf`
`sudo apt-key adv --keyserver subkeys.pgp.net --recv-keys ID`	Keyring file in `/etc/apt/keyrings/` plus `Signed-By` (see below)
`http://wwwkeys.pgp.net:11371/pks/lookup?op=get&search=0x…`	`https://keys.openpgp.org/pks/lookup?op=get&search=0x…` or the key lookup page

Which keyserver? keys.openpgp.org only gives out a name and email address after the owner has confirmed the address, so it is the better choice for people's keys. Some software-signing keys were never confirmed there and come back without a user ID; keyserver.ubuntu.com carries those. Both answer over HTTPS on port 443, which also gets through most firewalls.

Fetch a key with gpg

Old commands often use an 8-digit short key ID such as 12345678. Short IDs are easy to fake, and keys.openpgp.org rejects them. Look up the full 40-character fingerprint in the project's own documentation, then run:

gpg --keyserver hkps://keys.openpgp.org --recv-keys <FINGERPRINT>
gpg --fingerprint <FINGERPRINT>

A successful import prints something like this (here the Ubuntu archive key, fetched from keyserver.ubuntu.com):

gpg: key 871920D1991BC93C: public key "Ubuntu Archive Automatic Signing Key (2018) <ftpmaster@ubuntu.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

If keys.openpgp.org answers No data, the key is not there or was asked for by short ID. Try hkps://keyserver.ubuntu.com with the same fingerprint. Then check that the fingerprint gpg --fingerprint shows is exactly the one the publisher gives.

Fix gpg.conf and dirmngr.conf

In current GnuPG a helper program, dirmngr, does all keyserver access. The keyserver option in gpg.conf still works in GnuPG 2.4 but is deprecated; the GnuPG manual says to put it in dirmngr.conf. Find old entries first:

grep -n -E 'pgp\.net|sks-keyservers|keys\.gnupg\.net' ~/.gnupg/gpg.conf ~/.gnupg/dirmngr.conf

Delete the old keyserver lines from both files. Then put one line in ~/.gnupg/dirmngr.conf:

keyserver hkps://keys.openpgp.org

Also delete any hkp-cacert line that points to sks-keyservers.netCA.pem. keys.openpgp.org notes that this old line stops normal certificates from working; without hkp-cacert, dirmngr uses the system's certificate authorities. Reload dirmngr and check the setting:

gpgconf --reload dirmngr
gpgconf --list-options dirmngr | grep '^keyserver'

The second command should show hkps%3a//keys.openpgp.org (the colon is percent-encoded). To list more than one server, give one keyserver line per server.

Default keyserver. Upstream GnuPG has had no built-in default keyserver since version 2.5.3. Debian's GnuPG 2.4 packages use hkps://keys.openpgp.org by default; upstream 2.4 used keyserver.ubuntu.com. If you never set one, your result depends on your version and distribution, so pass --keyserver or set it in dirmngr.conf. As of November 2026 the current upstream release is GnuPG 2.5.24 (September 23, 2026); upstream support for the 2.4 branch ended on June 30, 2026, although distributions such as Debian 13 still ship and patch 2.4.7.

Find keys by email address

Many old scripts used --search-keys against subkeys.pgp.net and picked a key from a list. Today, look up the address directly. This tries the Web Key Directory of the address's domain first, then the keyserver:

gpg --auto-key-locate clear,wkd,keyserver --keyserver hkps://keys.openpgp.org --locate-keys alice@example.org

To refresh a key you already have from those sources, use --locate-external-keys in place of --locate-keys. Without the option, gpg's default is local,wkd. See Web Key Directory for publishing your own key that way.

Replace apt-key adv

apt-key put keys into one shared keyring, /etc/apt/trusted.gpg. Any key in it could sign any repository. Where things stand as of November 2026:

Debian 12 and Ubuntu 24.04 LTS: apt-key is still installed but deprecated, and APT warns when it uses trusted.gpg (a warning added in APT 2.4).
Debian 13 (APT 3.0) and Ubuntu 26.04 LTS (APT 3.2): apt-key is gone. APT 2.9.24 and later no longer trust /etc/apt/trusted.gpg, and source entries without Signed-By are deprecated.

The replacement is a separate keyring file per repository. First choice: download the key file the vendor publishes on its HTTPS site. If the vendor only gives a keyserver command, do this, using a throwaway GnuPG home so your own keyring stays clean:

export GNUPGHOME="$(mktemp -d)"
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys <FINGERPRINT>
gpg --fingerprint <FINGERPRINT>        # compare with the vendor's documentation
sudo install -d -m 0755 /etc/apt/keyrings
gpg --export-options export-minimal --export <FINGERPRINT> | sudo tee /etc/apt/keyrings/example.gpg > /dev/null
sudo chmod 0644 /etc/apt/keyrings/example.gpg
gpgconf --kill all
rm -rf "$GNUPGHOME"; unset GNUPGHOME

A binary keyring needs the .gpg extension. An ASCII-armored key needs .asc. Without a temporary GnuPG home, download the armored key to a temporary file, check it, and only then copy it into /etc/apt/keyrings/:

curl -fsSL -o /tmp/example.asc 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x<FINGERPRINT>'
gpg --show-keys /tmp/example.asc       # exactly one key, with the vendor's fingerprint?
sudo install -m 0644 /tmp/example.asc /etc/apt/keyrings/example.asc

In that case write Signed-By: /etc/apt/keyrings/example.asc in the entry below.

Now point the repository at that file only. Create /etc/apt/sources.list.d/example.sources:

Types: deb
URIs: https://repo.example.com/debian
Suites: stable
Components: main
Signed-By: /etc/apt/keyrings/example.gpg

The older one-line format in a .list file still works, but Debian 13 marks it as deprecated:

deb [signed-by=/etc/apt/keyrings/example.gpg] https://repo.example.com/debian stable main

Then run sudo apt update. If it finishes with no NO_PUBKEY or signature errors for that repository, the key works. We tested both the minimal binary keyring and the armored file against a real signed Release file with sqv, the verifier APT 3.0 uses. The APT repository keys guide covers more cases.

Move keys out of trusted.gpg

If an old apt-key adv command put a key into /etc/apt/trusted.gpg, list what is there without importing anything:

gpg --show-keys /etc/apt/trusted.gpg

For each fingerprint, export it into its own file and add Signed-By to the matching source as shown above:

gpg --no-default-keyring --keyring /etc/apt/trusted.gpg --export-options export-minimal --export <FINGERPRINT> | sudo tee /etc/apt/keyrings/example.gpg > /dev/null

When every repository has its own Signed-By and sudo apt update runs clean, move the old file aside: sudo mv /etc/apt/trusted.gpg /root/trusted.gpg.old.

Old links in browsers

Bookmarks and forum posts often link to http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x… or to wwwkeys.pgp.net pages. Links without the port number now lead to this site, and /pks/lookup links open the key lookup page. Links with :11371 fail in the browser. Remove the port and the address works; or search keys.openpgp.org directly.

Mistakes to avoid

Swapping in another dead name. pool.sks-keyservers.net and keys.gnupg.net no longer resolve either (tested November 2026).
Using short key IDs. Use the full fingerprint; anyone can make a key with the same 8 digits.
Trusting a key because a keyserver had it. Keyservers do not check who uploaded a key. Compare the fingerprint with the vendor's.
Dropping the key into trusted.gpg.d. That is the old global trust in a new place. APT 2.9.24 and later treat it as deprecated; use Signed-By.
Using plain hkp://. Prefer hkps:// so the lookup is encrypted and the server is authenticated.