<p>The <a href="https://bitcoincore.org/en/download/" rel="nofollow noreferrer">home website for Bitcoin Core</a> says</p>
<blockquote>
<p>Refresh expired keys using:<br />
<code>gpg --keyserver hkps://keys.openpgp.org --refresh-keys</code></p>
</blockquote>
<p>I would obtain Bitcoin Core from that bitcoincore.org website and not from bitcoin.org.</p>
<hr />
<p>For signature checking to be more meaningful as a check on authorship or correctness rather than merely a checksum of download integrity, it is probably important to obtain your GPG public keys from a source that is as independent as possible from the website from which you download the source or binaries. Otherwise you could download doctored code and faked signatures &amp; keys from a hacked or impostor website.  This independence appears to be the case with software from bitcoincore.org and keys from openpgp.org or elsewhere (if I understand correctly).</p>
<hr />
<p>You are correct that bitcoin.org currently (2022-02-17) has old expired keys.</p>
<p>After visiting <a href="https://bitcoin.org/en/download" rel="nofollow noreferrer">https://bitcoin.org/en/download</a> and clicking &quot;Bitcoin Core Release Signing Keys&quot; <a href="https://bitcoin.org/laanwj-releases.asc" rel="nofollow noreferrer">v0.11.0+</a> I also see an expired key.</p>
<pre><code>C&gt; gpg --import laanwj-releases.asc
gpg: key 36C2E964: public key &quot;Wladimir J. van der Laan (Bitcoin Core binary release signing key) &lt;laanwj@gmail.com&gt;&quot; imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: no ultimately trusted keys found

C&gt; gpg --list-keys
----------------------------------------------
pub   4096R/36C2E964 2015-06-24 [expired: 2022-02-10]
uid                  Wladimir J. van der Laan (Bitcoin Core binary release signing key) &lt;laanwj@gmail.com&gt;
</code></pre>

CC BY-SA 4.0
2022-02-17T16:51:45.757Z
2022-02-17T18:01:56.093Z
2022-02-17T18:01:56.093Z
RedGrittyBrick
<p>I was trying to add the keys to a keyring to verify the bitcoin core download, but it looks like the gpg keys are all expired.</p>

CC BY-SA 4.0
2022-02-17T16:03:37.920Z
Which keys specifically? Do you have a link?
Pieter Wuille
CC BY-SA 4.0
2022-02-17T17:23:25.643Z
@Pieter see addendum to my answer for possible/probable link.
RedGrittyBrick
CC BY-SA 4.0
2022-02-17T17:23:51.743Z
Oh, I hadn't even considered OP might have been using bitcoin.org.
Pieter Wuille
<security>
Bitcoin.org gpg keys expired?
obe
# Bitcoin.org gpg keys expired?

(Asked by: username_0 on 2022-02-17)

I was trying to add the keys to a keyring to verify the bitcoin core download, but it looks like the gpg keys are all expired.

**Tags:** security

> **Comments:**
> **username_1**: Which keys specifically? Do you have a link?  
> **username_2**: @username_1 see addendum to my answer for possible/probable link.  
> **username_1**: Oh, I hadn't even considered OP might have been using bitcoin.org.  

---

## 1 answers

### Answer by username_2 on 2022-02-17. Score: 2

The [home website for Bitcoin Core](https://bitcoincore.org/en/download/) says

> Refresh expired keys using:  
> `gpg --keyserver hkps://keys.openpgp.org --refresh-keys`

I would obtain Bitcoin Core from that bitcoincore.org website and not from bitcoin.org.

---

For signature checking to be more meaningful as a check on authorship or correctness rather than merely a checksum of download integrity, it is probably important to obtain your GPG public keys from a source that is as independent as possible from the website from which you download the source or binaries. Otherwise you could download doctored code and faked signatures & keys from a hacked or impostor website. This independence appears to be the case with software from bitcoincore.org and keys from openpgp.org or elsewhere (if I understand correctly).

---

You are correct that bitcoin.org currently (2022-02-17) has old expired keys.

After visiting <https://bitcoin.org/en/download> and clicking "Bitcoin Core Release Signing Keys" [v0.11.0+](https://bitcoin.org/laanwj-releases.asc) I also see an expired key.

```
C> gpg --import laanwj-releases.asc
gpg: key 36C2E964: public key "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: no ultimately trusted keys found

C> gpg --list-keys
----------------------------------------------
pub   4096R/36C2E964 2015-06-24 [expired: 2022-02-10]
uid                  Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>

```


---

