Fix Tailscale apt Errors for Ubuntu Without Guesswork

Wetin make Tailscale install errors for Ubuntu be apt errors

Tailscale install errors for Ubuntu almost always happen before any Tailscale code run. Dem na apt errors. Ubuntu no ship any tailscale package by itself: when we check Ubuntu package archive for August 2026, na only Go helper libraries and python3-tailscale dey match. So, the daemon must come from Tailscale own apt repository for pkgs.tailscale.com.

When you add that repository, e write two files. One file tell apt where the packages dey. The other file hold the public key wey apt use check the signature for the repository index. Almost every failure below happen because one of those two files no correct, or because one device between apt and the repository reject the request.

These na the commands wey Tailscale publish for Ubuntu 24.04:

sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
sudo apt-get update && sudo apt-get install tailscale

noble na the codename for Ubuntu 24.04, and e dey appear for both URLs. The second command write one comment line and one deb line inside /etc/apt/sources.list.d/tailscale.list, while cat show you exactly wetin enter there.

cat /etc/apt/sources.list.d/tailscale.list

Read that deb line as address wey get four fields: the bracketed option [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] first, then the repository base, wey be pkgs.tailscale.com/stable/ubuntu and apt reach am through https, then the suite noble, and finally the component main. apt join the base and suite into one URL, then fetch am: https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease. If you fit fetch that URL by hand, apt fit fetch am too. Na the complete diagnostic.

Read the apt error before you change anything

Run the update on its own so nothing scrolls the error away.

sudo apt update

A failed third-party repository dey look like this. The codename and IP address go different for your machine.

E: Failed to fetch https://pkgs.tailscale.com/stable/ubuntu/dists/wilma/InRelease  404  Not Found [IP: 203.0.113.9 443]
E: Some index files failed to download. They have been ignored, or old ones used instead.

Two things for that output dey decide wetin you go do next: the status code, and the full URL for the E: Failed to fetch line. No guess from the summary line for bottom. Copy the URL and ask the server yourself.

curl -sS -o /dev/null -w '%{http_code}\n' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease

That one go print 200 for codename wey Tailscale publishes for. As dem check am for August 2026, noble dey return signed index wey carry Origin: Tailscale and Codename: noble. Replace noble with the codename from your own error and run am again. If curl gets 200 where apt gets error, the repository dey okay and the problem dey inside apt own configuration.

Wetin the status code dey tell you

• 404 Not Found mean say repository no get any file for that path. For pkgs.tailscale.com, na almost always the codename wey dey inside the URL.
• 403 Forbidden mean say something answer but refuse the request. As of August 2026, this repository dey return 404 for path wey e no get, so 403 dey point to proxy, filtering appliance, or firewall wey dey between your server and Tailscale.
• 401 Unauthorized or 407 Proxy Authentication Required mean say proxy dey request credentials wey apt no dey send.
• Connect error or name resolution error mean say no HTTP conversation happen at all. Move go the IPv6 section.

Codename wey dey for URL na one wey Tailscale no publish

Tailscale dey build separate directory for each Ubuntu codename. If you request codename wey no dey there, you go get 404, because no dists/<codename> dey for server to serve. Vendor listing wey dey pkgs.tailscale.com/stable show which ones dey available. For August 2026, the list start from 16.04 reach resolute, wey be Ubuntu 26.04.

The usual way wrong codename dey enter na lsb_release -cs for distribution wey base on Ubuntu but no be Ubuntu. For Linux Mint 22, that command print wilma, wey be Mint own codename, and Tailscale no publish anything for am. Read the Ubuntu base instead.

. /etc/os-release
echo "$VERSION_CODENAME $UBUNTU_CODENAME"

For Ubuntu, both values dey the same. For derivative, VERSION_CODENAME na the derivative name, while UBUNTU_CODENAME na the Ubuntu release wey dem build am on. Use UBUNTU_CODENAME for both URLs.

The second way na release upgrade. Ubuntu upgrade tool dey disable third-party sources when e dey run, so after upgrading Ubuntu 24.04 to 26.04, you go find /etc/apt/sources.list.d/tailscale.list either commented out or still dey name noble for machine wey don become resolute. Fix am by running the two curl commands again with the new codename. Dem go overwrite both files.

The third way na timing. For the weeks after new Ubuntu release, Codename fit dey Canonical before e dey Tailscale. If you point the file to previous LTS codename, installation normally go work because these packages get few dependencies. But you go dey run build wey dem make for older release. Check wetin you actually get with apt policy tailscale, then change the file back when the correct codename appear.

Keyring empty, and command wey write am no talk anything

This one quiet, and na here most of dem dey end. Look the keyring command again:

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null

Shell dey build the complete pipeline before either program run, so sudo tee open the keyring path and truncate am to zero bytes immediately. If curl fail, and -f make am fail for any HTTP error, curl no write anything and e exit with nonzero status. The file remain zero bytes. Pipeline exit status na the status of the last command, wey be tee, and e succeed. Nothing print, and you move to the next command thinking say key don install.

Check the file, no be the command wey create am.

ls -l /usr/share/keyrings/tailscale-archive-keyring.gpg
gpg --show-keys /usr/share/keyrings/tailscale-archive-keyring.gpg

Healthy keyring dey print a pub line and a uid line wey name Tailscale. Zero byte file dey print gpg: no valid OpenPGP data found. and nothing else. File wey catch HTML error page go print the same thing, and head -c 80 on top am go show the beginning of web page instead of binary key data.

If keyring no get any usable key, sudo apt update go download the index and then reject am. You go get a W: GPG error line wey name Tailscale repository and its suite, the text The following signatures couldn't be verified because the public key is not available: NO_PUBKEY followed by 16 character key id, and error underneath wey talk say repository no get signature. Pay attention to wetin apt dey tell you: e download the index well, but e no fit check the signature. Na key problem be that, no be network problem. If keyring file no dey at all, the message go different again, and e go name the path directly with Could not open file /usr/share/keyrings/tailscale-archive-keyring.gpg.

Write the key with two steps so failed download no fit destroy keyring wey dey work.

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg -o /tmp/tailscale.gpg
gpg --show-keys /tmp/tailscale.gpg
sudo install -m 0644 -o root -g root /tmp/tailscale.gpg /usr/share/keyrings/tailscale-archive-keyring.gpg

The middle line na the gate: if e no print Tailscale uid, stop and no copy the file. Mode 0644 matter because apt dey switch to unprivileged _apt user to fetch and verify, so keyring wey only root fit read na keyring apt no fit use.

Both .list and .sources file fit describe the same repository

Ubuntu move its own sources go deb822 format for Ubuntu 24.10, where /etc/apt/sources.list turn to /etc/apt/sources.list.d/ubuntu.sources. Tailscale still dey publish the one-line format. As checked for August 2026, no .sources file dey available to download from pkgs.tailscale.com: that URL dey return 404. So if your machine get tailscale.sources, na you or one guide write am by hand. And if tailscale.list still dey there too, apt don get the same repository described two times.

The mild version na warning for every update:

W: Target Packages (main/binary-amd64/Packages) is configured multiple times in /etc/apt/sources.list.d/tailscale.list:1 and /etc/apt/sources.list.d/tailscale.sources:1

The serious version happen when the two files name different keyring paths, because apt no fit decide which key dey control the repository. E print E: Conflicting values set for option Signed-By regarding source, then the repository and its suite, then the two keyring paths with != between dem, and then e refuse to continue:

E: The list of sources could not be read.

That one block every apt command, no be only the update, until one of the files comot. The same failure fit show for Ubuntu own repositories, and the duplicate apt source error after a deb822 migration explain the general case.

Find every file wey mention Tailscale before you delete anything.

grep -RIn tailscale /etc/apt/sources.list /etc/apt/sources.list.d/

Keep one file. To disable the other without losing am, rename am: apt dey read only files wey end with .list or .sources, so tailscale.list.bak go skip am and leave am on disk for reference.

Write the deb822 source file correctly

If you prefer the newer format, convert the file wey you already get instead of typing the repository address again, because typo for there na exactly how the errors above dey start. Recent apt releases get converter wey dey rewrite .list files into deb822 stanzas and move the signed-by option across as Signed-By.

apt modernize-sources --help
sudo apt modernize-sources

Ubuntu 24.04 ship with apt wey older pass that subcommand, so the help line go tell you within one second whether your own get am. If e no get am, build the stanza from the line wey already dey disk, so the base go come from the vendor file instead of your keyboard.

. /etc/os-release
{
  echo 'Types: deb'
  echo "URIs: $(awk '/^deb /{print $3}' /etc/apt/sources.list.d/tailscale.list)"
  echo "Suites: $UBUNTU_CODENAME"
  echo 'Components: main'
  echo 'Signed-By: /usr/share/keyrings/tailscale-archive-keyring.gpg'
} | sudo tee /etc/apt/sources.list.d/tailscale.sources
sudo rm /etc/apt/sources.list.d/tailscale.list

That one go print the stanza wey e write, so you fit read the fields again before the next apt update. Four of dem worth knowing well, because each one dey fail for different way:

• URIs dey stop for the repository base. If you paste the dists/noble part inside am, e go give 404, because apt dey append dists/<suite> by itself and dey ask for dists/noble/dists/noble.
• Suites na the codename, exactly the value wey dey middle of the one-line format.
• Signed-By dey take absolute path to a keyring file. E also accept armored key wey you inline underneath am, where every line of the key get one space indentation and each blank line inside the key dey written as one dot.
• Enabled: no dey switch source off without deleting am. This one easier to undo pass rename and easier to explain to the next person.

Keep one stanza for each file for third-party repositories, and put blank line between stanzas if you ever keep plenty together. The repository index list amd64 and arm64 among its architectures, so ARM VPS no need extra Architectures field.

Proxy wey dey middle dey return 403

Because this repository no get the path, e suppose return 404. So, 403 mean say something else answer on behalf of the repository. Start with apt own configuration, because proxy wey you set there apply to apt, but e no apply to your interactive curl.

grep -RIn -i proxy /etc/apt/apt.conf.d/ /etc/apt/apt.conf
sudo apt-config dump | grep -i 'acquire::http'

Then monitor wetin apt actually send.

sudo apt -o Debug::Acquire::http=1 update

This go print the request line, the headers wey apt send, and the proxy wey e connect through, if any. Compare am with plain curl to the same URL. If curl return 200 and apt return 403, the two requests dey differ for something wey the middlebox dey check. The usual suspect na the user agent:

curl -sS -o /dev/null -w '%{http_code}\n' -A 'Debian APT-HTTP/1.3' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease

If that one return 403 while default curl return 200, filtering device dey reject apt because of the name. The fix suppose dey for that device, no be for your server. Corporate proxy wey dey inspect TLS behave differently again: apt report certificate verification failure instead of status code, because the certificate wey e receive come from the proxy, no be from Tailscale's certificate authority. Cloud egress firewall wey only allow Ubuntu mirrors na another common source. For that case, allow pkgs.tailscale.com for the firewall.

IPv6 only egress, and the errors wey no be status codes

If apt never receive HTTP response, test each protocol by itself.

curl -4 -sS -o /dev/null -w 'v4 %{http_code}\n' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease
curl -6 -sS -o /dev/null -w 'v6 %{http_code}\n' https://pkgs.tailscale.com/stable/ubuntu/dists/noble/InRelease

When IPv4 dey answer and IPv6 hang or report Network is unreachable, apt dey fail because resolver library prefer IPv6 and the box no get working IPv6 path. Force one run use IPv4 to confirm the theory:

sudo apt -o Acquire::ForceIPv4=true update

If that update succeed, make the change permanent.

echo 'Acquire::ForceIPv4 "true";' | sudo tee /etc/apt/apt.conf.d/99force-ipv4

Make we talk true about the opposite case. For VPS wey no get IPv4 address at all, forcing IPv4 no go fix anything, because no IPv4 route dey to force traffic through. For there, you need NAT64 with DNS64 from your provider, or proxy wey get IPv4 address. The symptom na connect error wey name an IPv6 address, so na the curl -6 line dey tell you the truth.

The fallback options, and wetin each one go cost

The vendor install script. curl -fsSL https://tailscale.com/install.sh | sh na the command wey Tailscale dey advertise. If you read the script, e detect your distribution from /etc/os-release, then e write the same two paths wey this guide don dey fix: /usr/share/keyrings/tailscale-archive-keyring.gpg and /etc/apt/sources.list.d/tailscale.list, from the same URLs. This matter because e set the right expectation: e no go bypass repository wey proxy dey block. E go fail the same way, but with less output. To pipe downloaded script enter shell as root na trade-off, no be solution, because you dey trust anything wey server return at that time, and you no keep copy of wetin run. If you accept the trade-off, accept am with clear understanding:

curl -fsSL https://tailscale.com/install.sh -o install.sh
less install.sh
sh install.sh

The static binaries. The same server dey publish plain tarballs under the static binaries section of pkgs.tailscale.com/stable. As of August 2026, the stable release na 1.102.2, and the 64 bit x86 file na tailscale_1.102.2_amd64.tgz. You go place the tailscale client and the tailscaled daemon by yourself, and you go supervise the daemon by yourself. So apt upgrade path no dey, and every future update na download wey you must remember to do. E make sense for air gapped host, or when you must pin one exact version.

Ubuntu's own package. E no dey. If you run sudo apt install tailscale without configuring the vendor repository, e go end for E: Unable to locate package tailscale, and no amount of apt update go change that. If wetin you really want na coordination server wey you control instead of Tailscale's hosted one, that na separate decision: run Headscale as your own control server cover am, and the comparison between Tailscale and plain WireGuard explain whether you need all this machinery.

Package don install, but tailscaled no go start

Once apt don work fine, na daemon go start get problem.

systemctl status tailscaled
sudo journalctl -u tailscaled -n 50

For VPS wey dey use container virtualisation and share host kernel, like LXC or OpenVZ, log fit show one line say /dev/net/tun no dey exist. Daemon need TUN device to create tailscale0 interface, but container no get one. Ask your provider make dem enable TUN for the container, or move go KVM plan wey give you your own kernel. For KVM, this one go work without extra setup.

After that, sudo tailscale up go print login URL, and tailscale status suppose list your machine with address for 100.64.0.0/10 range. Machine wey dey show there na machine wey you fit build on, whether na advertising private subnet from your VPS or using the VPS as an exit node.

FAQ

Why apt dey talk say Tailscale repository no get signature?

Because apt download the repository index but e no fit verify the signature against /usr/share/keyrings/tailscale-archive-keyring.gpg. The usual reason na say keyring get zero bytes: sudo tee truncate the file before curl fail to download anything, and the pipeline report success because tee succeed. Run gpg --show-keys /usr/share/keyrings/tailscale-archive-keyring.gpg. Working keyring go print one pub line and one uid line wey name Tailscale, while empty or corrupt one go print gpg: no valid OpenPGP data found. Download the key go temporary file, check am there, then copy am enter the correct place with mode 0644 so _apt user fit read am.

Which Ubuntu codename I suppose put for the Tailscale URLs?

Use the value of UBUNTU_CODENAME from /etc/os-release. Na noble for Ubuntu 24.04 and resolute for Ubuntu 26.04. No use lsb_release -cs for distribution wey come from Ubuntu: for Linux Mint 22 e dey print wilma, Tailscale no publish anything under that name, and apt report 404 for dists/wilma/InRelease. Confirm your choice before you edit anything by fetching the index by hand with curl -sS -o /dev/null -w '%{http_code}\n' against https://pkgs.tailscale.com/stable/ubuntu/dists/<codename>/InRelease.

E safe to run Tailscale install script wey you pipe enter shell?

Na trade wey you suppose make deliberately. Tailscale provide the script, and e dey do the same things as the manual steps: e read /etc/os-release, write the same keyring and the same /etc/apt/sources.list.d/tailscale.list, then install the package. The cost be say you run anything wey server return at that moment, with root, and you no keep record of am. Download am with -o install.sh, read am, then run am if you want the convenience without the blind spot. E still no fit help if repository block, because e use the same URLs wey already fail.

How I fit install Tailscale for Ubuntu without apt repository?

Use the static tarballs wey dem publish for pkgs.tailscale.com. As of August 2026, dem dey version 1.102.2, with amd64 file wey dem name tailscale_1.102.2_amd64.tgz. You go install the tailscale and tailscaled programs by yourself, and run the daemon under systemd by yourself. The cost na upgrades: no apt package dey pull new version, so every update na manual. Ubuntu archive no get tailscale package of its own, so sudo apt install tailscale for machine wey no get vendor repository go stop for E: Unable to locate package tailscale.