Veeam Support Knowledge Base
How to Manually Update GPG key on Veeam Hardened Repository Appliance

How to Manually Update GPG key on Veeam Hardened Repository Appliance

KB ID:	4833
Product:	Veeam Backup & Replication \| 12.3 \| 12.3.1 \| 12.3.2
Published:	2026-03-16
Last Modified:	2026-05-29

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong.

Please, try again later.

Article Applicability

This article is specifically regarding the Veeam Hardened Repository ISO v2 appliance, which was distributed alongside Veeam Backup & Replication 12.

For information about manually updating the GPG key on the appliances associated with Veeam Backup & Replication 13, review KB4834.

Challenge

This article documents how to manually update the GPG key for Veeam Hardened Repository ISO v2 appliances.

Generally, the new key should automatically be distributed to all appliances that have access to the Veeam repository. However, if the appliance does not have access to the repository (either directly, via a mirror, or via http_proxy), the GPG key will not be updated. After the installed GPG expires, that appliance will be unable to connect to the update repository.

On March 15, 2026, the GPG key used to sign the Veeam RPM packages expired.

Solution

Note: The updated key shares the same fingerprint (E6FBD664) as the expired key. The key itself has not changed, only its expiration date has been extended. RPM identifies installed keys by fingerprint and will not overwrite an existing entry, even when the expiration date differs. The old entry must be removed first so that the refreshed key can be imported in step 5.

Download the new GPG key and copy it to the Veeam Hardened Repository using either the Files node or SSH with the veeamsvc account.
The new key is available here:
https://repository.veeam.com/keys/RPM-E6FBD664
Use Live Boot ISO to gain shell access to the Veeam Hardened Repository appliance.
Live Boot is available from the same ISO used for installation.
Once in live boot, mount the original system disks and enter chroot.
1. ```
sudo ./mount_systemvol.sh
```
2. ```
sudo chroot /mnt
```
Delete the old GPG key using the following command:

rpm -qa gpg-pubkey | grep e6fbd664 | xargs -r rpm -e
                
            

Import the new GPG key using the following command:

rpm --import /path/to/new/gpg_key

Clear the DNF cache. The DNF cache retains the key used for metadata validation, which is not cleared automatically.

rm -rf /var/cache/dnf/veeam*
rm -rf /var/cache/dnf/baseos*

Replace the expired key file referenced in the repository configuration (/etc/pki/rpm-gpg/RPM-E6FBD664) with the new key. When prompted to overwrite the existing file, confirm the operation.

cp /path/to/new/gpg_key /etc/pki/rpm-gpg/

If the DNF cache and the repository key file are not updated, the appliance will be unable to connect to the repository because the expired key remains stored in the cache. After completing these steps, updates from the repository will be available again.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

How to Manually Update GPG key on Veeam Hardened Repository Appliance

Cheers for trusting us with the spot in your mailbox!

Oops! Something went wrong.

Challenge

Solution

Spelling error in text

Thank you!

Oops! Something went wrong.

You have selected too large block!

KB Feedback/Suggestion

Thank you!