If you tried to run ‘yum update’ and encountered this rather cryptic error message:

error: rpmts_HdrFromFdno: Header V3 RSA/SHA1 Signature, key ID c105b9de: BAD

Do NOT  try to rebuild your rpm database (do NOT run this command: “rpm –rebuilddb”as it would corrupt your RPM db.



This error is caused by mismatched versions of nss-softokn and nss-softokn-freebl. Around mid January 2015, CentOS pushed out an update for the nss-softoken package (ver 3.14.3-19), but unfortunately, the corresponding g version of “nss-softokn-freebl” was not yet available.

Both the “nss-softokn-3.14.3-19” and the “nss-softokn-freebl-3.14.3-19″  are interdependent in order to operate properly. Because of the software version mismatch – the ‘yum’ (and ‘rpm’) command was broken.

To fix this, you need to manually download the corresponding “nss-softokn-freebl-3.14.3-19” from one of the CentOS mirrors and manually install it.

For 32-bit CentOS:
wget http://mirror.centos.org/centos/6/updates/x86_64/Packages/nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm

For 64-bit CentOS:

wget http://mirror.centos.org/centos/6/updates/x86_64/Packages/nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm

Once you’ve downloaded the correct rpm file for your architecture, please extract it:

# rpm2cpio nss-softoken-freebl* | cpio -idmv

Then copy the libfreeblpriv3 files to their correct location, e.g.

For 64-bit (x86_64) architecture:

# cp ./lib64/libfreeblpriv3.* /lib64

For 32-bit (i386) architecture:

# cp ./lib/libfreeblpriv3.* /lib

Finally, try running ‘yum update’ – this time, everything should be running smoothly.


You can view/check the available CentOS 6 packages:

32-Bit Architecture


64-Bit Architecture