Arch Linux

vendion

Member

From: Tennessee, USA

Registered: 2010-03-10

Posts: 204

Website

[Solved] GPG fails on keyserver ops with Not enabled error

Recently when I try to do any action in gpg that requires a keyserver, example fetching a key or refreshing keys, it fails with the following error "gpg: keyserver refresh failed: Not enabled". When I try to google the error to try and figure out the cause I get no results for "Not enabled", I get plenty of results for "No keyserver available" or "no name" though.

dirmngr.conf

[~]─> gpg -vvv --refresh-keys
gpg: using character set 'utf-8'
gpg: refreshing 61 keys from hkps://keys.openpgp.org
gpg: keyserver refresh failed: Not enabled

My configs:

# dirmngr.conf - Options for Dirmngr
# Written in 2015 by The GnuPG Project <https://gnupg.org>
#
# To the extent possible under law, the authors have dedicated all
# copyright and related and neighboring rights to this file to the
# public domain worldwide.  This file is distributed without any
# warranty.  You should have received a copy of the CC0 Public Domain
# Dedication along with this file. If not, see
# <http://creativecommons.org/publicdomain/zero/1.0/>.
#
#
# Unless you specify which option file to use (with the command line
# option "--options filename"), the file ~/.gnupg/dirmngr.conf is used
# by dirmngr.  The file can contain any long options which are valid
# for Dirmngr.  If the first non white space character of a line is a
# '#', the line is ignored.  Empty lines are also ignored.  See the
# dirmngr man page or the manual for a list of options.
#

# --keyserver URI
#
# GPG can send and receive keys to and from a keyserver.  These
# servers can be HKP, Email, or LDAP (if GnuPG is built with LDAP
# support).
#
# Example HKP keyservers:
#      hkp://keys.gnupg.net
#
# Example HKP keyserver using a Tor OnionBalance service
#      hkp://jirk5u4osbsr34t5.onion
#
# Example HKPS keyservers (see --hkp-cacert below):
#       hkps://hkps.pool.sks-keyservers.net
#
# Example LDAP keyservers:
#      ldap://pgp.surfnet.nl:11370
#
# Regular URL syntax applies, and you can set an alternate port
# through the usual method:
#      hkp://keyserver.example.net:22742
#
# Most users just set the name and type of their preferred keyserver.
# Note that most servers (with the notable exception of
# ldap://keyserver.pgp.com) synchronize changes with each other.  Note
# also that a single server name may actually point to multiple
# servers via DNS round-robin.  hkp://keys.gnupg.net is an example of
# such a "server", which spreads the load over a number of physical
# servers.
#
# If exactly two keyservers are configured and only one is a Tor hidden
# service, Dirmngr selects the keyserver to use depending on whether
# Tor is locally running or not (on a per session base).

keyserver hkps://keys.openpgp.org
keyserver hkps://keys.mailvelope.com
keyserver hkps://attester.flowcrypt.com
keyserver hkp://keyserver.ubuntu.com

# --hkp-cacert FILENAME
#
# For the "hkps" scheme (keyserver access over TLS), Dirmngr needs to
# know the root certificates for verification of the TLS certificates
# used for the connection.  Enter the full name of a file with the
# root certificates here.  If that file is in PEM format a ".pem"
# suffix is expected.  This option may be given multiple times to add
# more root certificates.  Tilde expansion is supported.

hkp-cacert /usr/share/gnupg/sks-keyservers.netCA.pem

standard-resolver

###+++--- GPGConf ---+++###
###+++--- GPGConf ---+++### Fri Jun 28 13:17:05 2019 EDT
# GPGConf edited this configuration file.
# It will disable options before this marked block, but it will
# never change anything below these lines.

gpg-agent.conf

max-cache-ttl 60480000
max-cache-ttl-ssh 60480000
default-cache-ttl 60480000
default-cache-ttl-ssh 60480000


pinentry-program /usr/bin/pinentry-kwallet

###+++--- GPGConf ---+++###
enable-ssh-support
debug-level basic

gpg.conf

default-key  F1F26B789FC642D0
use-agent
keyserver-options auto-key-retrieve
keyserver-options no-honor-keyserver-url
keyid-format 0xlong
with-fingerprint
cert-digest-algo SHA256
no-emit-version
no-comments
personal-cipher-preferences AES AES256 AES192 CAST5
personal-digest-preferences SHA256 SHA512 SHA384 SHA224
ignore-time-conflict

Edit: Seems the problem was the use of standard-resolver while having tor enabled as they do not work together.

Last edited by vendion (2022-09-16 18:10:49)