Issue Weak Algorithm Warning (DSA1024) for Plesk Repositories on Ubuntu 24.04 LTS

[LionKing]

Server operating system version

Ubuntu 24.04 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.67 Update #3 Web Host Edition

Hi Plesk Support Team and Community,
I’m running into an issue with the Plesk repositories on my Ubuntu 24.04 LTS server and would appreciate some guidance.

When I run sudo apt update, I get warnings about the Plesk repositories using a weak algorithm (DSA1024) for their signatures. The affected repositories include those for Plesk itself and several PHP versions (e.g., PHP 7.4, 8.0, 8.1, 8.2). The warning message indicates that the key used to sign these repositories is considered cryptographically weak by modern standards.

I tried to fetch an updated key from a keyserver using apt-key adv, but I received an error that the key ID was not found. I also learned that apt-key is deprecated in Ubuntu 24.04, and the recommended method is to manage keys in /etc/apt/trusted.gpg.d/. However, even if I were to add the key manually, the weak algorithm issue would likely persist.

Here’s what I’ve done so far:

1. Ran sudo apt update and noted the weak algorithm warnings for the Plesk repositories.
2. Attempted to fetch the key using apt-key adv --keyserver keyserver.ubuntu.com --recv-keys with the key ID, but it failed with a "not a key ID: skipping" error.
3. Considered adding the key manually to /etc/apt/trusted.gpg.d/, but I’m concerned that the underlying issue (weak DSA1024 algorithm) would still remain.

My questions are:

• Has Plesk updated its repository signing keys to use a stronger algorithm (e.g., RSA-2048 or ECDSA)? If so, where can I find the new key and instructions to add it?
• If not, are there plans to update the keys soon? The weak algorithm warning is a security concern, and I’d like to ensure my server remains secure.
• Are there alternative repositories or mirrors that use updated keys?
• How do I run an actual update of this and fix the issue on the Ubuntu 24.04 LTS server?

I’d really appreciate any help or updates from the Plesk team or community members who have encountered and resolved this issue. Thanks in advance for your assistance!

Best regards,

LionKing

 

[scsa20]

The warning can be ignored and should be updated in an updated release. You can refer to Issue - Plesk Updates - Expected in 18.0.65 - Now Overdue for more details.

 

[LionKing]

No they don't actually. The old Repositories just keeps being there and been there for a while now hence the post here.

 

[LionKing]

So do anyone have an idea of how to fix this?

Here is a detailed screenshot of how it looks like:

 

[Sebahat.hadzhi]

@LionKing our team is already working on updating the signing key. The case is currently in the testing phase and the fix should be released in the upcoming days.

 

[LionKing]

working on updating the signing key. The case is currently in the testing phase and the fix should be released in the upcomi

Thank you very much for the update @Sebahat.hadzhi!

That is very good news and I'm glad to hear that.

Kind regards,