Downloading Packages:
(1/4): wbm-jailkit-1.1-1.noarch.rpm 64 kB/s | 31 kB 00:00
(2/4): wbm-server-manager-9.8.kvm-1.noarch.rpm 7.1 MB/s | 4.6 MB 00:00
(3/4): wbm-php-pear-1.6-1.noarch.rpm 93 kB/s | 62 kB 00:00
(4/4): wbm-ruby-gems-1.9-1.noarch.rpm 280 kB/s | 68 kB 00:00
------------------------------------------------------------------------------------------------------
Total 6.5 MB/s | 4.8 MB 00:00
Cloudmin Distribution Neutral 1.6 MB/s | 1.7 kB 00:00
Importing GPG key 0xA0BDBCF9:
Userid : ""
Fingerprint: 31D2 B188 72EA F68E FB81 F81D E8DD 3FA0 A0BD BCF9
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-virtualmin
error: Certificate E8DD3FA0A0BDBCF9:
Policy rejects E8DD3FA0A0BDBCF9: Policy rejected asymmetric algorithm
Key import failed (code 2). Failing package is: wbm-server-manager-9.8.kvm-1.noarch
GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-virtualmin
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED
rl@ns1:~$
AI answer/solution (for Virtualmin Staff)
The error message "Policy rejects E8DD3FA0A0BDBCF9: Policy rejected asymmetric algorithm" indicates that a cryptographic operation has been blocked due to the use of an insecure or deprecated asymmetric algorithm, such as RSA with a key size considered too small (e.g., RSA1024) or an outdated signature scheme like SHA-1.
This is consistent with modern security policies that reject weak algorithms to prevent vulnerabilities.
In systems like Fedora 38 and later, the RPM database enforces strict cryptographic policies, rejecting packages signed with older algorithms such as DSA/SHA1 or RSA/SHA1.
Similarly, OpenSSH 8.8 and newer versions disable RSA signatures using the SHA-1 hash by default, leading to issues with legacy SSH keys.
The same principle applies to package managers like APT and DNF, which now reject signatures from keys using insecure algorithms like RSA1024, which has been considered insecure since February 1, 2014.
To resolve this, users should ensure that all keys and packages are signed with modern, secure algorithms such as RSA with SHA-256 or SHA-512, or preferably ECDSA or EdDSA (e.g., ED25519).
For example, in the case of Launchpad PPAs, the keys were re-signed with stronger 4096-bit RSA keys, requiring users to remove and re-add the PPA to refresh the key.
Similarly, VirtualBox updated its signing key to oracle_vbox_2016.asc to support SHA-256 signatures, resolving import issues on Fedora 38.
If the key in question (E8DD3FA0A0BDBCF9) is outdated or uses a weak algorithm, it must be replaced with a newer, secure key. Users should contact the package maintainer or repository administrator to obtain the updated signing key and update their system's keyring accordingly.
rl@ns1:~$ sudo ./cloudmin-kvm-redhat-install.sh
*******************************************************************************
* Welcome to the Cloudmin GPL for KVM installer, version 1.1 *
*******************************************************************************
.
.
.
Error: Unable to find a match: kvm kvm-qemu-img kvm-tools