Resolving CentOS 7 yum GPG Key Errors During Package Installation

CentOS 7 has reached end of life, but many production servers still run it. When I tried installing packages on a legacy trading system last month, yum threw a GPG key error that blocked the entire operation. Here is how I resolved it.

Environment

OS: CentOS Linux release 7.9.2009 (Core)
yum version: 3.4.3
Context: Legacy quantitative trading analytics server

$ cat /etc/centos-release
CentOS Linux release 7.9.2009 (Core)

$ yum --version
3.4.3
  Built by : CentOS BuildSystem

The Problem

Running yum install resulted in a GPG key retrieval failure:

$ sudo yum install python38-pip
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
base                                                     | 3.6 kB  00:00:00
extras                                                   | 2.9 kB  00:00:00
updates                                                  | 2.9 kB  00:00:00
https://repo.ius.io/centos/7/x86_64/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
There was an error from yum: cannot retrieve gpg key

 One of the configured repositories failed (missing gpg key),
 and yum doesn't have enough cached metadata to continue. Try again at
 a later point once the metadata for this repository is available.

Additionally, some repositories returned:

GPG key retrieval failed: [Errno 14] curl#60 - "Peer's Certificate has expired."

Analysis

Understanding GPG Keys in yum

yum uses GPG keys to verify package integrity. Each repository specifies a gpgkey URL in its .repo file. When yum cannot fetch or verify the key, it refuses to install packages.

Three common scenarios cause this:

Expired GPG keys - The repository's signing key has expired
Missing keys - The key was never imported locally
Network/SSL issues - Cannot reach the key server due to TLS problems (common on EOL repos)

Step 1: Check Current Repository Configuration

$ ls /etc/yum.repos.d/
CentOS-Base.repo       CentOS-Debug.repo       CentOS-Sources.repo
CentOS-AppStream.repo  CentOS-Extras.repo      CentOS-Vault.repo

$ cat /etc/yum.repos.d/CentOS-AppStream.repo
[appstream]
name=CentOS-8 - AppStream
baseurl=http://mirror.centos.org/centos/8/AppStream/x86_64/os/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
enabled=1

Step 2: Check Existing GPG Keys

$ rpm -qa gpg-pubkey
gpg-pubkey-350f40f4-5ffa2444
gpg-pubkey-f4a80eb8-53a74f70

$ rpm -q --queryformat '%{NAME} %{VERSION}-%{RELEASE}\n' gpg-pubkey
gpg-pubkey 350f40f4-1
gpg-pubkey f4a80eb8-1

Step 3: Diagnose the SSL/Network Issue

Since CentOS 7 is EOL, the mirror URLs have moved to vault.centos.org:

$ curl -I https://repo.ius.io/centos/7/x86_64/repodata/repomd.xml
curl: (60) Peer's Certificate has expired.

The SSL certificate chain is broken for many legacy repositories.

Solution

Fix 1: Import Missing GPG Keys Manually

# Import the official CentOS 7 GPG key
$ sudo rpm --import https://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-Official

# Import EPEL GPG key
$ sudo rpm --import https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7

# Verify import
$ rpm -qa gpg-pubkey | grep -i centos
gpg-pubkey-350f40f4-1

Fix 2: Update Repository URLs to Vault

Since mirrors are gone, point to the vault:

$ sudo sed -i 's/mirror.centos.org/vault.centos.org/g' /etc/yum.repos.d/CentOS-*.repo

# Verify
$ grep baseurl /etc/yum.repos.d/CentOS-Base.repo
baseurl=http://vault.centos.org/centos/7/os/x86_64/
baseurl=http://vault.centos.org/centos/7/updates/x86_64/
baseurl=http://vault.centos.org/centos/7/extras/x86_64/

Fix 3: Bypass GPG Check Temporarily (Not Recommended for Production)

$ sudo yum install --nogpgcheck python38-pip

Fix 4: Handle Expired Keys with --force

# Re-import with force to override expired key
$ sudo rpm --import --force https://vault.centos.org/RPM-GPG-KEY-CentOS-Official

# Clean yum cache
$ sudo yum clean all
$ sudo yum makecache

Fix 5: Update ca-certificates First

$ sudo yum install --nogpgcheck ca-certificates
$ sudo update-ca-trust force-enable
$ sudo yum clean all

Verify the Fix

$ sudo yum install python38-pip
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Resolving Dependencies
--> Running transaction check
---> Package python38-pip.noarch 0:21.3.1-1.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package          Arch          Version             Repository             Size
================================================================================
Installing:
 python38-pip    noarch        21.3.1-1.el7       appstream            2.1 M

Transaction Summary
================================================================================
Install  1 Package

Total download size: 2.1 M
Installed size: 10 M
Is this ok [y/d/N]: y

Preventing Future GPG Issues

Set up a script to periodically refresh keys:

#!/bin/bash
# /usr/local/bin/refresh-gpg-keys.sh

echo "Refreshing GPG keys..."
rpm --import https://vault.centos.org/RPM-GPG-KEY-CentOS-Official
rpm --import https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7

echo "Cleaning yum cache..."
yum clean all
yum makecache fast

echo "GPG key refresh complete: $(date)"

Lessons Learned

Always keep a local backup of critical GPG keys when working with EOL distributions.
Check repository status before assuming a GPG error - the repo itself may be unreachable.
Use rpm --import --force carefully - it bypasses expiration checks.
Consider migrating to Rocky Linux or AlmaLinux for long-term support instead of patching CentOS 7.
Document all GPG key imports in a runbook for team reference.

This blog does not accept any external sponsorships, affiliate marketing, or ad revenue.