Verify RHEL 10 ensures cryptographic verification of vendor software packages.
Confirm Red Hat package-signing keys are installed on the system and verify their fingerprints match vendor values.
Note: For RHEL 10 software packages, Red Hat uses GPG keys labeled "release key 2", "auxiliary key 3", and "release key 4". The keys are defined in key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" by default.
List Red Hat GPG keys installed on the system:
$ sudo rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey | grep -i "red hat"
Red Hat, Inc. (release key 2) <security@redhat.com> public key
Red Hat, Inc. (auxiliary key 3) <security@redhat.com> public key
Red Hat, Inc. (release key 4) <security@redhat.com> public key
If Red Hat GPG keys "release key 2", "auxiliary key 3", and "release key 4" are not installed, or if the key file "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" is missing, this is a finding.
List key fingerprints of installed Red Hat GPG keys:
$ sq inspect /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate.
Fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51
Public-key algo: RSA
Public-key size: 4096 bits
Creation time: 2009-10-22 11:59:55 UTC
Key flags: certification, signing
UserID: Red Hat, Inc. (release key 2) <security@redhat.com>
Note: There is another block of armored OpenPGP data.
Note: This is a non-standard extension to OpenPGP.
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate.
Fingerprint: 7E4624258C406535D56D6F135054E4A45A6340B3
Public-key algo: RSA
Public-key size: 4096 bits
Creation time: 2022-03-09 21:56:46 UTC
Key flags: certification, signing
UserID: Red Hat, Inc. (auxiliary key 3) <security@redhat.com>
Note: There is another block of armored OpenPGP data.
Note: This is a non-standard extension to OpenPGP.
/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release: OpenPGP Certificate.
Fingerprint: FCD355B305707A62DA143AB6E422397E50FE8467A2A95343D246D6276AFEDF8F
Public-key algo: ML-DSA-87+Ed448
Creation time: 2025-10-08 17:40:03 UTC
Key flags: certification, signing
UserID: Red Hat, Inc. (release key 4) <security@redhat.com>
Compare key fingerprints of installed Red Hat GPG keys with fingerprints listed for RHEL 10 on the Red Hat "Product Signing Keys" webpage at https://access.redhat.com/security/team/key.
If key fingerprints do not match, this is a finding.