signature verification failed with all loaded keys

Embedded Linux

This page covers the Linux agent. If you hit a signature error on an MCU fleet, it comes from the server rejecting an upload — see ESP32 signing or Zephyr signing.

Symptom

The device downloads the artifact and the agent log shows:

signature verification failed with all loaded keys

The update aborts. The console shows the deployment stuck in pending or failed.

Cause

The artifact was signed with a private key whose public key is not the one baked into the device image (SOC_OTA_VERIFICATION_KEYS), or the key was replaced after the artifact was built. On the server side, an upload is rejected with HTTP 422 if the artifact’s embedded signature matches none of the keys the server trusts: your organization’s active signing keys (console Signing Keys) and any deployment-wide ARTIFACT_VERIFY_KEY_PATHS. A revoked key no longer counts.

Fix

Verify the artifact against the public key that is baked into the image:

otapulse-artifact validate firmware.otapulse --key production-rsa-public.pem

If validation fails, re-sign the artifact with the private key that matches the public key in the image (otapulse-artifact write ... --key <private-key>) and re-upload it. If you changed keys, rebuild the image with the new public key in SOC_OTA_VERIFICATION_KEYS (its filename must be listed in SOC_OTA_VERIFY_KEY_FILES) and make sure the server trusts the same key: import the public key under Signing Keys -> Import Public Key (use Replace to swap out the old key; both need you to type delete). The server cannot push keys to devices, so the image and the console must each carry the key. See the End-to-end quickstart.