SUSE Linux Enterprise 15 switch-over to new RSA 4096bit signing key
This document (000021335) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Linux Enterprise 15 SP6 based products
Situation
The SUSE Linux Enterprise 15 product family has switched over from a RSA 2048 bit signing key to a new RSA 4096 bit key, starting with the release of SLE 15 Service Pack 6. This switch-over also includes the SUSE Manager 5.0 product.
Resolution
The new signing key should have been auto-imported by recent suse-build-key online updates.
If this has not happened, it can be found in
/usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc
and imported to the RPM keyring using:
rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc
The update stack will otherwise also ask to accept the key.
The keys fingerprint is:
pub rsa4096/0xF74F09BC3FA1D6CE 2023-01-19 [SC] [expires: 2027-01-18]
Key fingerprint = 7F00 9157 B127 B994 D5CF BE76 F74F 09BC 3FA1 D6CE
uid SUSE Package Signing Key <build@suse.de>
and can also be found on our website: https://www.suse.com/support/security/keys/
Additionally a backup 4096 bit RSA backup was imported for Disaster Recovery purposes.
pub rsa4096/0xA1BFC02BD588DC46 2023-01-19 [SC] [expires: 2033-01-16]
Key fingerprint = B56E 5601 41D8 F654 2DFF 3BF9 A1BF C02B D588 DC46
uid SUSE Package Signing Key (reserve key) <build@suse.de>
This key can be manually imported using:
rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc
If this has not happened, it can be found in
/usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc
and imported to the RPM keyring using:
rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc
The update stack will otherwise also ask to accept the key.
The keys fingerprint is:
pub rsa4096/0xF74F09BC3FA1D6CE 2023-01-19 [SC] [expires: 2027-01-18]
Key fingerprint = 7F00 9157 B127 B994 D5CF BE76 F74F 09BC 3FA1 D6CE
uid SUSE Package Signing Key <build@suse.de>
and can also be found on our website: https://www.suse.com/support/security/keys/
Additionally a backup 4096 bit RSA backup was imported for Disaster Recovery purposes.
pub rsa4096/0xA1BFC02BD588DC46 2023-01-19 [SC] [expires: 2033-01-16]
Key fingerprint = B56E 5601 41D8 F654 2DFF 3BF9 A1BF C02B D588 DC46
uid SUSE Package Signing Key (reserve key) <build@suse.de>
This key can be manually imported using:
rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000021335
- Creation Date: 26-Jan-2024
- Modified Date:16-Jul-2024
-
- SUSE Enterprise Storage
- SUSE Linux Enterprise Desktop
- SUSE Linux Enterprise Server
- SUSE Linux Enterprise Server for SAP Applications
- SUSE Manager Server
- SUSE Linux Enterprise Micro
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com
