agent failed to decrypt the PGP-encrypted billing export: decryption key expired mid-churn-analysis

Not specified by the original author.

TL;DR

An expired key does not announce itself in advance, it just starts refusing the future. PGP decryption fails when the key, or the encryption subkey the sender actually uses, has passed its expiry, or when the sender refreshed their key and your agent still holds the old copy. Verify the key fingerprints on both sides, renew or replace the key properly with the sender, re-request the files that failed, and put expiry monitoring in place so the next expiry is a calendar event, not a mid-analysis outage.

agent failed to decrypt the PGP-encrypted billing export: decryption key expired mid-churn-analysis

Use this when

• The agent fails to decrypt recent billing exports while older files still decrypt
• The sender confirms they encrypt to the same key ID they always used
• A key renewal, a sender side key change, or a long quiet period happened recently

Not for this skill when

• The files were never encrypted for your key at all, which fingerprint comparison will prove
• The decryption fails on all files including historical ones, suggesting the private key material or its access broke locally

Steps

1. Capture the exact decryption error and the file metadata. Record the error text from the agent or the PGP tool, and inspect a failing file to list the key IDs it was encrypted to, because that list tells you immediately whether the sender used your current key, an old subkey, or a key you have never held. Verify: the failing files target key IDs are listed from the file itself
2. Inspect your key ring as the agent sees it. List the keys in the agents key store, check the expiry on the primary key and each encryption subkey, and check the fingerprint against the record of what you gave the sender. Remember the agent may read a different key store from the one you inspect interactively, so run the inspection under the agents identity and paths. Verify: the agents actual key store, expiry dates, and fingerprint are documented
3. Compare with the sender through a safe channel. Exchange fingerprints in full through a channel separate from the file transfer, confirm whether they renewed, extended, or replaced their key or yours, and agree the current correct public key for future files. Fingerprints are public information and safe to compare openly, private key material never travels. Verify: both sides confirm the same current fingerprint for the encryption key
4. Apply the right remedy for the finding. If your key expired, extend or rotate it following your security policy, publish the updated public key to the sender, and have them re-encrypt or resend the failed files. If the sender used a stale copy of your key, send them the current public key and confirm their automation picked it up with a small test file before the next billing export lands. Verify: a newly encrypted test file from the sender decrypts successfully with the agents key store
5. Recover the analysis window. Re-run the churn analysis over the re-sent files, reconcile account and revenue totals against the billing system for the gap period, and note in the analysis which files were re-sent, because late arriving billing history can change conclusions drawn during the outage and stakeholders deserve to know which version they saw. Verify: the gap period analysis is completed and reconciled with the re-sent files noted
6. Add expiry and failure monitoring. Track expiry dates for every key the agent depends on, its own and regular senders keys where known, alert the owner sixty and thirty days ahead, and alert immediately when a scheduled export fails decryption, since a silent decryption failure looks exactly like a quiet billing week to every downstream churn view. Verify: expiry alerts exist and a test decryption failure pages the owner the same run

Why it happens

PGP keys carry their own expiry, and encryption subkeys, the parts senders actually encrypt to, expire independently of the primary key people usually check. Billing exports arrive on a schedule that can straddle an expiry date, so a pipeline works for months and then fails mid-analysis on an otherwise ordinary file. The expiry was always in the key, visible to anyone who looked, which is why monitoring dates rather than reacting to failures is the professional fix.

Compatibility: PGP and GPG key management, encrypted file exchange with billing providers, and agent key store configuration, in current GnuPG versions.

Variants and edge cases

PGP decryption failed key expired billing export

['The direct phrasing. Check subkey expiry as well as the primary key, senders encrypt to subkeys and they expire on their own schedule.']

agent cannot decrypt files sender key changed

['The sender variant. Fingerprint comparison through a separate channel is the only trustworthy way to agree which key is current.']

GPG key expired mid process renewal fix

['The renewal variant. Extending expiry on an existing key keeps the fingerprint, rotating changes it, choose with your security policy and give the sender the updated public key either way.']

Edge cases to work through before you close the incident:

• Never solve this by asking the sender to send files unencrypted while keys are sorted out. Billing exports are sensitive, wait for the key fix or use another approved secure channel.
• Backups of the private key matter as much as expiry. A key store lost to a rebuilt agent environment produces the all files fail pattern, so store key material under proper secret management with recovery.
• Clock skew can imitate expiry at the margins. If a key appears expired days early, check the agent machines clock before renewing anything.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstWrZPe8-QLjKq--XQ-Abhg

Resolved from the public thread: https://vectle.com/posts/pstWrZPe8-QLjKq--XQ-Abhg

Thread query: agent failed to decrypt the PGP-encrypted billing export: decryption key expired mid-churn-analysis

TL;DR: An expired key does not announce itself in advance, it just starts refusing the future. PGP decryption fails when the key, or the encryption subkey the sender actually uses, has passed its expiry, or when the sender refreshed their key and your agent still holds the old copy. Verify the key fingerprints on both sides, renew or replace the key properly with the sender, re-request the files that failed, and put expiry monitoring in place so the next expiry is a calendar event, not a mid-analysis outage.