Linux Mint Update Manager Authentication Error Fix

Quick answer: Run sudo apt-key list to find expired GPG keys, then delete them with sudo apt-key del <key-id> and re-add them from the official keyserver with sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <key-id>. Then run sudo apt update.

Why This Error Shows Up (And It's Not Your Fault)

You're sitting down, ready to update your Linux Mint system, and boom—Update Manager throws an authentication error. The yellow triangle. The red text. I've been there, and it stinks.

Here's what's actually happening: Linux Mint uses GPG keys to verify that the software you're downloading from repositories is legit. When those keys expire—like the one for the Ubuntu base repo or a PPA you added months ago—your system can't authenticate the package lists. This usually happens after a system upgrade (say, from Mint 20 to 21) or when a third-party repository hasn't refreshed its key.

The worst part? Update Manager just says "authentication error" without telling you which key is bad. So you've got to dig in.

Step 1: Find the Expired Keys

Open a terminal (Ctrl+Alt+T) and run:

sudo apt-key list

You'll see a list of keys. Look for any that say expired: in the output. On Mint 21, you might see something like:

pub   rsa4096 2018-01-01 [SC] [expired: 2023-01-01]
      ABCD 1234 EFGH 5678 IJKL 9012 MNOP 3456 QRST 7890
uid           [ expired] Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>

Copy the key ID—that's the 8-character chunk at the end, like QRST7890 in the example above. If there's no expired key, check for keys that show [S] without expiration—those are usually fine. The problem is almost always expired ones.

Step 2: Delete the Expired Key

Once you've got the key ID (the last 8 characters of the fingerprint), remove it:

sudo apt-key del QRST7890

Replace QRST7890 with your actual key ID. You won't see any confirmation—that's normal. If you get an error like "key not found," you typed the wrong ID.

Step 3: Re-add the Key from the Keyserver

Now add the key back fresh from Ubuntu's keyserver:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys QRST7890

This downloads the updated key with a new expiration date. If you get a timeout error, try a different keyserver:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys QRST7890

Port 80 usually works when the default port 11371 is blocked by your network.

Step 4: Update the Package Lists

Run the update again:

sudo apt update

If it passes without errors, you're golden. Open Update Manager again—it should work.

Alternative Fix: Remove the Broken Repository

If deleting and re-adding the key doesn't fix it, the repository itself might be dead. This happens a lot with PPAs from developers who abandoned the project years ago.

Open Software Sources from the Mint menu. Go to the "Additional Repositories" tab. Look for any repository that shows a red X or says "disabled" after apt update. Uncheck it or delete it entirely.

For command-line types, check your sources list:

ls /etc/apt/sources.list.d/

And remove the offending file. For example, if deadppa.list is the problem:

sudo rm /etc/apt/sources.list.d/deadppa.list

Then run sudo apt update again.

Prevention: Keep Your Keys Fresh

I run this every couple of months to avoid surprises:

sudo apt-key list | grep -B 1 'expired'

If any expired keys show up, delete and re-add them using the steps above before they break your updates. Also, be picky about third-party repositories—stick to official Mint repos and PPAs from active developers. I've seen people add repos from random GitHub projects that went dark two years ago, and then they're stuck wondering why Update Manager is screaming.

One more thing: if you're on Linux Mint 21.2 or later, you might not see apt-key working the same way. Mint's shifting to signed-by in sources, but apt-key still works for now. If you get deprecation warnings, that's fine—your updates will still run.

Pro tip: Always test sudo apt update in the terminal before clicking "refresh" in Update Manager. Terminal output tells you exactly which repo failed, while Update Manager just shows a generic error. Saved me hours of guessing.