When running YUM or RPM commands, the following errors occurred:

error: rpmts_HdrFromFdno: Header V3 RSA/SHA1 Signature, key ID XXXXXXXX: BAD

error: rpmdbNextIterator: skipping h# XXXX Header V3 RSA/SHA1 Signature, key ID XXXXXXXX BAD

Error: Cannot retrieve metalink for repository: epel. Please verify its path and try again

In addition, any commands related to YUM and RPM are completely unusable. In addition, if you attempt to rebuild the RPM database with “rpm –rebuilddb” to correct the issue, the RPM database is wiped off and then list of packages installed on your system becomes empty, at least according to the RPM database.

RPM / YUM Error

If you’re using Virtualmin/Webmin, all listing of software packages and Virtualmin packages return empty list – no packages available or installed.

The issue is caused by mismatched versions of nss-softokn and nss-softokn-freebl. CentOS pushes out update for nss-softoken package to version 3.14.3-19 (nss-softokn-3.14.3-19) in mid January 2015. However, update for corresponding version of nss-softokn-freebl is not yet available. nss-softokn-3.14.3-19 needs nss-softokn-freebl-3.14.3-19 to operate properly, and vice versa. But as these packages do not have checks in place to make sure that a matching version of the other package are also installed, users can accidentally install a different mismatched version when YUM or RPM does not offer both packages at the same time.

As the result, YUM and RPM are broken and corrupted. In fact, if you attempt to repair the system based on the error messages that were shown, you’ll end up with funnier issues. And remember, NEVER run “rpm –rebuilddb” if you’re facing this issue.

To fix the issue, we need to install nss-softokn-freebl-3.14.3-19, which is not installed alongside nss-softokn-3.14.3-19 in most of the cases.

  1. Download nss-softokn-freebl-3.14.3-19.

    For 64-bit (x86_64) CentOS:

    wget http://mirror.centos.org/centos/6/updates/x86_64/Packages/nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm

    Or for 32-bit (i386) CentOS:

    wget http://mirror.centos.org/centos/6/updates/i386/Packages/nss-softokn-freebl-3.14.3-19.el6_6.i686.rpm

    Or simply:

    yumdownloader nss-softokn-freebl
  2. Extract and install the RPM. We have to rely on rpm2cpio and cpio because YUM and RPM is not working!

    For 64-bit (x86_64):

    rpm2cpio nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm | cpio -idmv

    For 32-bit (i386):

    rpm2cpio nss-softokn-freebl-3.14.3-19.el6_6.i686.rpm | cpio -idmv
  3. Copy the libfreeblpriv3 files to respective location:

    For 64-bit (x86_64):

    cp ./lib64/libfreeblpriv3.* /lib64

    For 32-bit (i386):

    cp ./lib/libfreeblpriv3.* /lib
  4. Run yum update again to ensure everything is up-to-date and in order.

If you’re previously run “rpm –rebuilddb” to attempt the repair, the RPM database is as good as gone, as both “rpm -qa” and “yum list installed” will return empty result. However, in actual fact, all packages are still installed, and in most cases, should still be working properly. You will need to restore the RPM database. You can copy the RPM database from an identical server which does not face this issue, or restore from backup. The RPM database is located in /var/lib/rpm. To restore, just replace everything.

What if you don’t have backup? Well, good luck. You can refer to this post to try to rediscover all your installed packages.