Fix Tailscale apt Errors for Ubuntu 24.04

Why Tailscale install errors for Ubuntu na apt errors

Tailscale install errors for Ubuntu almost always happen before any Tailscale code run. Dem na apt errors. Ubuntu no ship any tailscale package by itself: when dem check Ubuntu package archive for October 2026, the only matches na Go helper libraries and python3-tailscale. So, the daemon must come from Tailscale own apt repository for pkgs.tailscale.com.

When you add that repository, e go write two files. One file tells apt where the packages dey. The other one hold the public key wey apt dey use to check the signature for the repository index. Almost every failure below na because one of those two files no correct, or because device between apt and the repository refuse the request.

These na the commands wey Tailscale publish for Ubuntu 24.04:

sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
sudo apt-get update && sudo apt-get install tailscale

noble na the codename for Ubuntu 24.04, and e dey appear for both URLs. The second command writes one comment line and one deb line inside /etc/apt/sources.list.d/tailscale.list, while cat shows you exactly wetin enter there.

cat /etc/apt/sources.list.d/tailscale.list

Read that deb line as address wey get four fields: the bracket option [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] first, then the repository base, wey be pkgs.tailscale.com/stable/ubuntu reached through https, then the suite noble, and lastly the component main. apt joins the base and the suite into one URL, then e fetch am: https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease. If you fit fetch that URL by hand, apt fit fetch am too. Na the whole diagnostic be that.

Read the apt error before you change anything

Run the update on its own so nothing scrolls the error away.

sudo apt update

A failed third-party repository looks like this. The codename and the IP address will be different on your machine.

E: Failed to fetch https://pkgs.tailscale.com/stable/ubuntu/dists/wilma/InRelease  404  Not Found [IP: 203.0.113.9 443]
E: Some index files failed to download. They have been ignored, or old ones used instead.

Two things in that output decide what you do next: the status code, and the full URL on the E: Failed to fetch line. Do not guess from the summary line at the bottom. Copy the URL and ask the server yourself.

curl -sS -o /dev/null -w '%{http_code}\n' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease

That prints 200 for a codename Tailscale publishes for. Checked in October 2026, noble returns a signed index carrying Origin: Tailscale and Codename: noble. Swap noble for the codename from your own error and run it again. If curl gets 200 where apt got an error, the repository is fine and the problem is in apt's own configuration.

Status code dey tell you wetin

• 404 Not Found mean say repository no get file for that path. For pkgs.tailscale.com, na almost always the codename wey dey for URL.
• 403 Forbidden mean say something answer but e refuse request. As of October 2026, this repository dey return 404 for path wey e no get, so 403 dey point to proxy, filtering appliance, or firewall wey dey between your server and Tailscale.
• 401 Unauthorized or 407 Proxy Authentication Required mean say proxy dey request credentials wey apt no dey send.
• Connect error or name resolution error mean say no HTTP conversation happen at all. Skip go the IPv6 section.

URL wey use codename wey Tailscale no publish

Tailscale dey build separate directory for each Ubuntu codename. If you request codename wey no dey there, you go get 404, because server no get dists/<codename> to serve. Vendor own listing for pkgs.tailscale.com/stable show the ones wey dey available. For October 2026, the list start from 16.04 reach resolute, wey be Ubuntu 26.04.

The usual way wrong codename dey enter na when you run lsb_release -cs for distribution wey base on Ubuntu but no be Ubuntu. For Linux Mint 22, that command print wilma, wey be Mint own codename, and Tailscale no publish anything for am. Read the Ubuntu base instead.

. /etc/os-release
echo "$VERSION_CODENAME $UBUNTU_CODENAME"

For Ubuntu, both values dey the same. For derivative, VERSION_CODENAME na the derivative name, while UBUNTU_CODENAME na the Ubuntu release wey dem build am on. Use UBUNTU_CODENAME for both URLs.

The second way na release upgrade. Ubuntu upgrade tool dey disable third-party sources when e run. So after upgrading Ubuntu 24.04 to 26.04, you go find /etc/apt/sources.list.d/tailscale.list either commented out or still dey use noble for machine wey don become resolute. Fix am by running the two curl commands again with the new codename. The commands go overwrite both files. If the upgrade stop halfway, and dpkg dey complain about half-configured packages instead of only this repository, recover the failed release upgrade first. Any fix to tailscale.list no go last for system wey apt no fit finish configuring.

The third way na timing. During the weeks after new Ubuntu release, the codename fit dey exist for Canonical before e dey available for Tailscale. If you point the file to the previous LTS codename, installation normally fit work because these packages get few dependencies. But you go dey run build wey dem make for older release. Check wetin you actually get with apt policy tailscale, then change the file back when the correct codename appear.

Keyring empty, and the command wey write am no talk anything

This one quiet, and na where plenty of these problems dey end. Look the keyring command again:

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null

Shell dey build the whole pipeline before any of the two programs run, so sudo tee go open the keyring path and truncate am to zero bytes immediately. If curl later fail, and -f make am fail for any HTTP error, curl no go write anything and e go exit with nonzero status. The file go remain at zero bytes. Pipeline exit status na the status of the last command, wey be tee, and e succeed. Nothing go print, and you go move to the next command thinking say the key don install.

Check the file, no be the command wey create am.

ls -l /usr/share/keyrings/tailscale-archive-keyring.gpg
gpg --show-keys /usr/share/keyrings/tailscale-archive-keyring.gpg

Healthy keyring go print a pub line and a uid line wey name Tailscale. File wey get zero bytes go print gpg: no valid OpenPGP data found. and nothing else. File wey catch HTML error page go print the same thing, and head -c 80 on top am go show the beginning of a web page instead of binary key data.

If keyring no hold any usable key, sudo apt update go download the index and then reject am. You go see a W: GPG error line wey name the Tailscale repository and its suite, the text The following signatures couldn't be verified because the public key is not available: NO_PUBKEY followed by a 16 character key id, and underneath an error wey talk say the repository no get signature. Pay attention to wetin apt dey tell you: e download the index well, but e no fit check the signature. Na key problem be that, no be network problem. If keyring file no dey at all, the message go different again, and e go name the path directly with Could not open file /usr/share/keyrings/tailscale-archive-keyring.gpg.

Write the key in two steps, so failed download no fit damage a working keyring.

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg -o /tmp/tailscale.gpg
gpg --show-keys /tmp/tailscale.gpg
sudo install -m 0644 -o root -g root /tmp/tailscale.gpg /usr/share/keyrings/tailscale-archive-keyring.gpg

The middle line na the gate: if e no print a Tailscale uid, stop and no copy the file. Mode 0644 matter because apt dey switch to the unprivileged _apt user to fetch and verify, so keyring wey only root fit read na keyring apt no fit use.

Both .list and .sources file fit describe the same repository

Ubuntu move its own sources go deb822 format for Ubuntu 24.04 LTS, where /etc/apt/sources.list turn to /etc/apt/sources.list.d/ubuntu.sources. Tailscale still dey publish the one line format. As checked for October 2026, no .sources file dey available to download from pkgs.tailscale.com: that URL dey return 404. So if your machine get tailscale.sources, na you or one guide write am by hand. And if tailscale.list still dey there too, apt now get the same repository described two times.

The mild version na warning for every update:

W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list.d/tailscale.list:1 and /etc/apt/sources.list.d/tailscale.sources:1

The severe version dey happen when the two files name different keyring paths, because apt no fit decide which key dey control the repository. E print E: Conflicting values set for option Signed-By regarding source, then the repository and its suite, then the two keyring paths with != between dem, and then e refuse to continue:

E: The list of sources could not be read.

This one block every apt command, no be update alone, until one of the files comot. The same failure dey show for Ubuntu own repositories too, and the duplicate apt source error after deb822 migration explain the general case.

Find every file wey mention Tailscale before you delete anything.

grep -RIn tailscale /etc/apt/sources.list /etc/apt/sources.list.d/

Keep one file. To disable the other without losing am, rename am: apt dey read only files wey end with .list or .sources, so tailscale.list.bak go skip am and e go remain for disk as reference.

How to write the deb822 source file correctly

If you prefer the newer format, convert the file wey you already get instead of typing the repository address again, because na typo there dey cause the errors above. Recent apt releases get a converter wey dey rewrite .list files into deb822 stanzas and move the signed-by option across as Signed-By.

apt modernize-sources --help
sudo apt modernize-sources

Ubuntu 24.04 ship with apt wey older than that subcommand, so the help line go tell you quickly whether your own get am. If e no get am, build the stanza from the line wey already dey for disk, so the base go come from the vendor file instead of your keyboard.

. /etc/os-release
{
  echo 'Types: deb'
  echo "URIs: $(awk '/^deb /{print $3}' /etc/apt/sources.list.d/tailscale.list)"
  echo "Suites: $UBUNTU_CODENAME"
  echo 'Components: main'
  echo 'Signed-By: /usr/share/keyrings/tailscale-archive-keyring.gpg'
} | sudo tee /etc/apt/sources.list.d/tailscale.sources
sudo rm /etc/apt/sources.list.d/tailscale.list

That command go print the stanza wey e write, so you fit read the fields again before the next apt update. Four of dem important to understand well, because each one fit fail for different way:

• URIs stops for the repository base. If you paste the dists/noble part inside am, e go give 404, because apt dey append dists/<suite> by itself and ask for dists/noble/dists/noble.
• Suites na the codename, exactly the value wey dey for the middle of the one-line format.
• Signed-By takes absolute path to a keyring file. E also accepts armored key wey you put directly underneath am, where every key line get one space indentation and each blank line inside the key dey written as one dot.
• Enabled: no switches source off without deleting am. This one easier to undo than renaming the file, and easier to explain to the next person.

Keep one stanza for each file for third-party repositories. If you keep several together, put blank line between the stanzas. The repository index lists amd64 and arm64 among its architectures, so ARM VPS no need extra Architectures field.

Proxy wey dey middle dey return 403

Because path wey repository no get go answer 404, 403 mean say another thing answer on behalf of am. Start with apt own configuration, because proxy wey you set there dey apply to apt, but e no apply to your interactive curl.

grep -RIn -i proxy /etc/apt/apt.conf.d/ /etc/apt/apt.conf
sudo apt-config dump | grep -i 'acquire::http'

Then monitor wetin apt really dey send.

sudo apt -o Debug::Acquire::http=1 update

This one go print request line, headers wey apt send, and proxy wey e connect through, if any. Compare am with plain curl to the same URL. If curl return 200 and apt return 403, the two requests differ for something wey middlebox dey check. The usual suspect na user agent:

curl -sS -o /dev/null -w '%{http_code}\n' -A 'Debian APT-HTTP/1.3' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease

If that one return 403 while default curl return 200, filtering device dey reject apt because of its name. The fix suppose dey on that device, not for your server. Corporate proxy wey dey inspect TLS fit behave differently: apt go report certificate verification failure instead of status code, because certificate wey e receive come from the proxy, not from Tailscale's certificate authority. Cloud egress firewall wey only allow Ubuntu mirrors na another common source. For that case, allow pkgs.tailscale.com for the firewall.

IPv6-only egress, and the errors wey no be status codes

If apt no ever receive HTTP response, test each protocol separately.

curl -4 -sS -o /dev/null -w 'v4 %{http_code}\n' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease
curl -6 -sS -o /dev/null -w 'v6 %{http_code}\n' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease

When IPv4 dey answer but IPv6 hang or report Network is unreachable, apt dey fail because resolver library prefer IPv6 and the box no get working IPv6 path. Force one run use IPv4 to confirm the theory:

sudo apt -o Acquire::ForceIPv4=true update

If that update succeed, make the change permanent.

echo 'Acquire::ForceIPv4 "true";' | sudo tee /etc/apt/apt.conf.d/99force-ipv4

Make you understand the opposite case too. For VPS wey no get IPv4 address at all, forcing IPv4 no go fix anything because no IPv4 route dey to force traffic through. For that setup, you need NAT64 with DNS64 from your provider, or proxy wey get IPv4 address. The symptom na connect error wey name an IPv6 address, so na the curl -6 line go tell you the truth.

The fallback options, and wetin each one go cost

The vendor install script. curl -fsSL https://tailscale.com/install.sh | sh na the command wey Tailscale dey advertise. If you read the script, e go detect your distribution from /etc/os-release, then e go write the same two paths wey this guide don dey fix, /usr/share/keyrings/tailscale-archive-keyring.gpg and /etc/apt/sources.list.d/tailscale.list, from the same URLs. This one matter for wetin you expect: e no go bypass repository wey proxy dey block. E go fail the same way, but with less output. To pipe downloaded script enter shell as root na a trade-off, no be solution, because you dey trust anything wey server return at that moment, and you no keep copy of wetin run. If you choose this trade-off, make you understand the risk:

curl -fsSL https://tailscale.com/install.sh -o install.sh
less install.sh
sh install.sh

The static binaries. The same server dey publish plain tarballs under the static binaries section of pkgs.tailscale.com/stable. As of October 2026, the stable release na 1.102.4, and the 64 bit x86 file na tailscale_1.102.4_amd64.tgz. You go place the tailscale client and tailscaled daemon by yourself, and you go supervise the daemon by yourself. So, no apt upgrade path dey, and every future update na download wey you must remember to do. E fit make sense for an air gapped host, or when you must pin one exact version.

Ubuntu's own package. E no dey. If you run sudo apt install tailscale without configuring the vendor repository, e go end for E: Unable to locate package tailscale, and no amount of apt update fit change that. If wetin you really want na coordination server wey you control instead of Tailscale's hosted one, na separate decision be that: run Headscale as your own control server covers am, and the comparison between Tailscale and plain WireGuard covers whether you need all this machinery.

Package don install, but tailscaled no gree start

Once apt don work fine, na daemon dey bring the next errors.

systemctl status tailscaled
sudo journalctl -u tailscaled -n 50

For VPS wey dey use container virtualisation and share host kernel, like LXC or OpenVZ, log fit get line say /dev/net/tun no dey. Daemon need TUN device to create the tailscale0 interface, but container no get one. Ask your provider make dem enable TUN for the container, or move go KVM plan wey give you your own kernel. For KVM, this one go work without extra setup.

After that, sudo tailscale up go print login URL, and tailscale status suppose list your machine with address for 100.64.0.0/10 range. Machine wey show there na machine wey you fit build on, whether na advertise private subnet from your VPS or use VPS as exit node.

FAQ

Why apt dey talk say Tailscale repository no get signature?

Because apt download the repository index but e no fit verify the signature against /usr/share/keyrings/tailscale-archive-keyring.gpg. The usual reason na say keyring dey zero bytes: sudo tee truncate the file before curl fail to download anything, and the pipeline report success because tee succeed. Run gpg --show-keys /usr/share/keyrings/tailscale-archive-keyring.gpg. Working keyring go print one pub line and one uid line wey name Tailscale, while empty or corrupt one go print gpg: no valid OpenPGP data found. Download the key go temporary file, check am there, then copy am into place with mode 0644 so _apt user fit read am.

Which Ubuntu codename I suppose put for the Tailscale URLs?

Use the value of UBUNTU_CODENAME from /etc/os-release. Na noble for Ubuntu 24.04 and resolute for Ubuntu 26.04. No use lsb_release -cs for distribution wey come from Ubuntu: for Linux Mint 22 e print wilma, Tailscale no publish anything under that name, and apt report 404 for dists/wilma/InRelease. Confirm your choice before you edit anything by fetching the index by hand with curl -sS -o /dev/null -w '%{http_code}\n' against https://pkgs.tailscale.com/stable/ubuntu/dists/<codename>/InRelease.

E safe to run Tailscale install script wey you pipe enter shell?

Na trade-off wey you suppose decide deliberately. Tailscale provide the script, and e do the same things as the manual steps: e read /etc/os-release, write the same keyring and the same /etc/apt/sources.list.d/tailscale.list, then install the package. The cost na say you run anything wey server return at that moment, with root, and you no keep any record of am. Download am with -o install.sh, read am, then run am if you want the convenience without the blind spot. E still no fit help if repository dey blocked, because e use the same URLs wey don already fail.

How I fit install Tailscale for Ubuntu without apt repository?

Use the static tarballs wey dem publish for pkgs.tailscale.com. As of October 2026, dem dey version 1.102.4, with amd64 file wey dem name tailscale_1.102.4_amd64.tgz. You go install tailscale and tailscaled programs yourself, and run the daemon under systemd yourself. The cost na upgrades: no apt package dey to pull new version, so you go do each update manually. Ubuntu archive no get tailscale package of its own, so sudo apt install tailscale for machine wey no get vendor repository go stop for E: Unable to locate package tailscale.