apt update fails: switching an old Debian release to the archive

You run apt update on an older Debian server, and instead of the package list you get nothing but error messages: "404 Not Found", "Release file is not valid yet" or "Repository does not have a Release file". This guide explains the cause and shows you how to make the server updatable again.

This affects every Debian release whose support has ended: Debian 8 (Jessie), Debian 9 (Stretch), Debian 10 (Buster) and, before long, Debian 11 (Bullseye) as well.

Why apt update fails on old Debian releases

Debian operates its own package servers for every release. As soon as a version reaches the end of its support period, it disappears from the regular mirrors at deb.debian.org and security.debian.org. The packages are not lost in the process, they simply relocate: to archive.debian.org.

Your /etc/apt/sources.list file, however, still points at the old addresses. That is why apt reports a 404 error. On top of that comes a second problem: the release files stored in the archive carry an expiry date that passed long ago. apt aborts on that as well, even when the addresses are correct.

Both points can be fixed. What matters is the context, though: a Debian release without support no longer receives security updates. The steps below make the server manageable again, they are not a substitute for an upgrade.

Which Debian version is running on your server?

Check that first, because the correct addresses depend on it:

cat /etc/debian_version
lsb_release -a

The codename you get back (jessie, stretch, buster, bullseye) shows up again in every line that follows.

Back up and edit sources.list

Create a backup first so that you can go back at any time:

cp /etc/apt/sources.list /etc/apt/sources.list.bak

Then open the file in an editor:

nano /etc/apt/sources.list

Delete the existing content and enter the block from the next section that matches your version. After that, also check the /etc/apt/sources.list.d/ directory: it often holds separate files with outdated addresses that keep triggering the error.

The matching archive sources

Debian 10 (Buster)

Support ended in mid 2024, so Buster now sits entirely in the archive:

deb http://archive.debian.org/debian/ buster main contrib non-free
deb-src http://archive.debian.org/debian/ buster main contrib non-free

deb http://archive.debian.org/debian-security/ buster/updates main contrib non-free
deb-src http://archive.debian.org/debian-security/ buster/updates main contrib non-free

Debian 9 (Stretch)

deb http://archive.debian.org/debian/ stretch main contrib non-free
deb-src http://archive.debian.org/debian/ stretch main contrib non-free

deb http://archive.debian.org/debian-security/ stretch/updates main contrib non-free
deb-src http://archive.debian.org/debian-security/ stretch/updates main contrib non-free

Debian 8 (Jessie)

Jessie is the classic among the failure cases, because plenty of old guides on the web still refer to security.debian.org. That address no longer delivers anything for Jessie:

deb http://archive.debian.org/debian/ jessie main contrib non-free
deb-src http://archive.debian.org/debian/ jessie main contrib non-free

deb http://archive.debian.org/debian-security/ jessie/updates main contrib non-free
deb-src http://archive.debian.org/debian-security/ jessie/updates main contrib non-free

deb http://archive.debian.org/debian/ jessie-backports main
deb-src http://archive.debian.org/debian/ jessie-backports main

Debian 11 (Bullseye)

Bullseye reaches the end of its LTS phase in August 2026. After that, the same pattern applies. Note that the notation of the security source changed with Bullseye: it is no longer bullseye/updates, but bullseye-security:

deb http://archive.debian.org/debian/ bullseye main contrib non-free
deb-src http://archive.debian.org/debian/ bullseye main contrib non-free

deb http://archive.debian.org/debian-security/ bullseye-security main contrib non-free
deb-src http://archive.debian.org/debian-security/ bullseye-security main contrib non-free

As long as Bullseye is still supported, the regular mirrors remain the right choice. Only switch over once apt actually reports a 404 error.

One note for newer systems: from Debian 13 (Trixie) onwards, package sources are no longer maintained in /etc/apt/sources.list by default, but in the deb822 format under /etc/apt/sources.list.d/debian.sources. The layout there looks different, the principle stays the same.

Accepting expired package lists

After saving, apt will probably still abort, this time with a note that the release file has expired. That is perfectly normal for archived releases. Tell apt to ignore the expiry date:

echo 'Acquire::Check-Valid-Until "false";' | tee /etc/apt/apt.conf.d/10-nocheckvalid

If you only need this once, you can attach the setting directly to the command instead of creating a file:

apt-get -o Acquire::Check-Valid-Until=false update

After that, the usual update routine works again:

apt-get update
apt-get upgrade

Common error messages and what they mean

• "404 Not Found": The address in the sources.list still points at a regular mirror. Switch it over to archive.debian.org.
• "Release file ... is not valid yet" or "expired": The expiry date of the release file has passed. Set the Check-Valid-Until option as described above.
• "The repository ... does not have a Release file": Usually a typo in the codename, or a suite that does not exist in the archive. Check the spelling character by character.
• "NO_PUBKEY" or "EXPKEYSIG": The signing key of the old release has expired. In many cases it helps to reinstall the debian-archive-keyring package.
• The error persists despite a corrected sources.list: There is still a second file with old addresses in /etc/apt/sources.list.d/.

The permanent fix: upgrade or fresh install

Switching to the archive brings your server back into a manageable state, but it does not deliver any security updates. For a server that is reachable from the internet, a move to a supported Debian release should therefore follow.

There are two ways to go about it:

1. Fresh install: In most cases the faster and cleaner route. You can reinstall your server with a current operating system yourself at any time in the customer panel. Back up your data and configuration files beforehand.
2. Step-by-step upgrade: Debian can be pulled up one release at a time, so for example from Buster to Bullseye and then on to Bookworm. Jumps across several releases are not supported and regularly end in a broken system.

Create a backup beforehand in either case. Experience shows that an upgrade spanning versions that are several years old is exactly the point where old configurations and third-party sources start causing trouble.