Firefox RPM: updates fail after GPG signing key rotation on Fedora 42 and older, RHEL, SUSE
Summary
Mozilla moved to a new GPG signing subkey for Firefox RPM packages, Linux tarballs and checksum files and revoked the previous key. On some RPM distributions the package manager cannot replace the key itself, so Firefox updates fail. Mozilla documents a manual workaround.
Symptoms
On Fedora 42 and older and RHEL/Rocky/Almalinux, updates fail with "Import of the key didn’t help, wrong key?" or "The GPG keys listed for the mozilla repository are already installed but they are not correct for this package". On openSUSE/SUSE based distributions, updates fail with "Signature verification failed" or "NOKEY".
Affected
- Fedora 42 and older
- RHEL, Rocky Linux, AlmaLinux
- openSUSE/SUSE based distributions
- Not affected: Fedora 43 and later (dnf downloads the new key, import must be confirmed). Thunderbird has no official RPM packages.
Workaround
- Fedora 42 and older, RHEL/Rocky/Almalinux: remove the old key first: sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
- Import the new key: sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg
- Run: sudo dnf clean all
- openSUSE/SUSE: run steps 1 and 2 the same way, then run: sudo zypper refresh
- Always remove the old key before importing; otherwise rpm --import may report success although the key is not updated.
- On Fedora 43 and later, confirm the key import at the next update only if the fingerprint matches 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3.
Fix
Not fixed yet. The package managers on the affected distributions cannot replace the key automatically; the manual steps are required.
Recommendation
Apply the documented steps on affected RPM-based workstations and servers, and check the fingerprint of the new key before accepting it. If you verify Mozilla GPG signatures manually, import the new key and the revocation of the old one; releases signed with the old key can then no longer be verified.
Sources
- Updated GPG key for signing Firefox and Thunderbird Releases (Mozilla Security Blog) Vendor · blog.mozilla.org
- Mozilla Firefox RPM signing key Vendor · packages.mozilla.org
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:57.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.