SonarSource/sonarqube · error · IllegalStateException

Fail to decrypt the property

Error message

Fail to decrypt the property %s. Please check your secret key.

What it means

EmailSmtpConfiguration.decryptIfNeeded detects whether a property value (password) is stored in SonarQube's encrypted format (ENC(...) style) and, if so, decrypts it with the configured secret key. Decryption failure is wrapped in an IllegalStateException naming the property, because a wrong or missing secret key makes the SMTP password unusable.

Solutions

1. Restore the original secret key file referenced by sonar.secretKeyPath that was used to encrypt the password.
2. Re-encrypt the SMTP password with the current secret key (via the API or re-saving settings with encryption enabled).
3. Alternatively store the password in plaintext (without ENC()) if encryption is not required.
4. Verify the process has read access to the secret key file.

Example fix

// before: DB holds ENC(xAbc...) but secret key file is missing
// after: regenerate/restore sonar.secretKeyPath, then re-encrypt the password
// sonar.properties
sonar.secretKeyPath=/opt/sonarqube/conf/secret.key

// Verify the secret key file is readable and loadable before startup:
// keytool or the SonarQube API /api/system/info should report encryption as operational

try {
  String pwd = emailSmtpConfiguration.get("smtpPassword");
} catch (IllegalStateException e) {
  if (e.getMessage().startsWith("Fail to decrypt the property")) {
    // restore/re-key then re-encrypt the password
    throw new ConfigurationException("SMTP password secret key mismatch; re-encrypt the password", e);
  }
  throw e;
}

When it happens

Trigger: The SMTP password property holds an encrypted value but the secret key file was changed, moved, is missing, or was generated by a different installation; or the encrypted blob was copied between environments with different keys.

Common situations: Cloning a SonarQube instance without copying sonar.secretKeyPath; regenerating the secret key after the password was encrypted; restoring a database backup onto a server with a different key.

Related errors

• Email configuration doesn't exist.
• Email configuration with id
• "Secret key not found. Please set the property " +…
• "The property " + ENCRYPTION_SECRET_KEY_PATH + " does not…
• Unknown type of SMTP secure connection:

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/957ffb028d8d50f9. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-server-common/src/main/java/org/sonar/server/email/EmailSmtpConfiguration.java:151

    return get(EMAIL_CONFIG_SMTP_OAUTH_GRANT, EMAIL_CONFIG_SMTP_OAUTH_GRANT_DEFAULT);
  }

  private String get(String key, String defaultValue) {
    try (DbSession dbSession = dbClient.openSession(false)) {
      return dbClient.internalPropertiesDao().selectByKey(dbSession, key)
        .map(value -> decryptIfNeeded(key, value))
        .orElse(defaultValue);
    }
  }

  private String decryptIfNeeded(String key, String value) {
    if (!encryption.isEncrypted(value)) {
      return value;
    }
    try {
      return encryption.decrypt(value);
    } catch (Exception e) {
      throw new IllegalStateException("Fail to decrypt the property %s. Please check your secret key.".formatted(key), e);
    }
  }
}

View on GitHub (pinned to 184c821202)