EC
EKEYEXPIRED
Linux / POSIXERRORNotableSecurityHIGH confidence

Key Has Expired

Production Risk

Common with Kerberos; implement automatic ticket renewal.

What this means

EKEYEXPIRED (errno 127) is returned by the Linux keyring subsystem when a key exists but has passed its expiration time.

Why it happens
  1. 1Kerberos ticket has expired
  2. 2Kernel keyring key created with a timeout that has now passed
  3. 3SSL/TLS session key expired
How to reproduce

request_key() on an expired Kerberos credential.

trigger — this will error
trigger — this will error
key_serial_t key = request_key("krb5", "ticket", NULL, KEY_SPEC_SESSION_KEYRING);
// Returns -1, errno = EKEYEXPIRED

expected output

request_key: Key has expired (EKEYEXPIRED)

Fix

Renew or re-obtain the key

WHEN When EKEYEXPIRED is returned

Renew or re-obtain the key
# Renew Kerberos ticket
kinit -R  # renew if within renewable period
# Or get a new ticket:
kinit username@REALM

# For kernel keys, re-add with new timeout:
keyctl add user my-key "new-value" @u
keyctl timeout <key-id> 3600  # 1 hour

Why this works

Expired keys must be renewed or replaced; the original key cannot be extended after expiry.

Sources
Official documentation ↗

Linux Programmer Manual keyrings(7)

Content generated with AI assistance and reviewed for accuracy. Found an error? hello@errcodes.dev

← All Linux / POSIX errors