{"record":{"id":"10793a0e4a6032bb","repo":"passbolt/passbolt_api","slug":"the-gnupg-config-for-the-server-is-not-available-or","errorCode":null,"errorMessage":"The GnuPG config for the server is not available or incomplete.","messagePattern":"The GnuPG config for the server is not available or incomplete\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"src/Authenticator/GpgAuthenticator.php","lineNumber":336,"sourceCode":"        return true;\n    }\n\n    /**\n     * Initialize OpenPGP keyring and load the config\n     *\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if config is missing or key is not set nor usable to decrypt\n     * @return void\n     */\n    private function _initKeyring(): void\n    {\n        // check if the default key is set and available in gpg\n        $this->_gpg = OpenPGPBackendFactory::get();\n        $fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n        $passphrase = Configure::read('passbolt.gpg.serverKey.passphrase');\n\n        // Check if config contains fingerprint\n        if (!is_string($fingerprint) || !PublicKeyValidationService::isValidFingerprint($fingerprint)) {\n            throw new InternalErrorException('The GnuPG config for the server is not available or incomplete.');\n        }\n\n        // set the key to be used for decrypting\n        try {\n            $this->_gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n        } catch (Exception $exception) {\n            try {\n                $this->_gpg->importServerKeyInKeyring();\n                $this->_gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n            } catch (Exception $exception) {\n                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';\n                $msg .= $exception->getMessage();\n                throw new InternalErrorException($msg, 500, $exception);\n            }\n        }\n    }\n\n    /**","sourceCodeStart":318,"sourceCodeEnd":354,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Authenticator/GpgAuthenticator.php#L318-L354","documentation":"Thrown by GpgAuthenticator::_initKeyring() when the configured server OpenPGP key fingerprint (passbolt.gpg.serverKey.fingerprint) is missing or not a syntactically valid fingerprint. The GPGAuth protocol requires the server key to decrypt user tokens, so authentication cannot proceed without it. It is a server-side configuration failure, reported as InternalErrorException (HTTP 500).","triggerScenarios":"Any GPGAuth request (login stage0+) triggers _initForAllSteps -> _initKeyring; the error is thrown when Configure::read('passbolt.gpg.serverKey.fingerprint') returns null/non-string, an empty string, or a string failing PublicKeyValidationService::isValidFingerprint() (wrong length/characters).","commonSituations":"Fresh installs where app.php/app.local.php was never populated with the server key fingerprint; running `passbolt install` or key generation was skipped; the fingerprint was hand-edited with a typo or lowercase-with-spaces variant the validator rejects; config file loaded from the wrong path in a container; environment variable interpolation produced an empty value.","solutions":["Set a valid 40-hex-character fingerprint under 'passbolt.gpg.serverKey.fingerprint' in config/app.local.php (or via the passbolt config generation).","Regenerate/import a server key if none exists: run the passbolt serverkey generation/import command, then `passbolt healthcheck` to confirm the GPG section passes.","Verify the app is loading the expected config file (check APP_BASE/config paths, container volume mounts) and that no override sets the fingerprint to null/empty.","Run `passbolt cleanup`/healthcheck and restart PHP/web container so cached config is reloaded after fixing."],"exampleFix":"// before (config/app.local.php)\n'gpg' => ['serverKey' => ['fingerprint' => null]],\n\n// after\n'gpg' => ['serverKey' => [\n    'fingerprint' => '2FC8945813C523E1C25EDF0C6F91C027E4645C9B',\n    'public' => CONFIG . 'gpg' . DS . 'serverkey.asc',\n    'private' => CONFIG . 'gpg' . DS . 'serverkey_private.asc',\n]],","handlingStrategy":"validation","validationCode":"$fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\nif (!is_string($fingerprint) || !PublicKeyValidationService::isValidFingerprint($fingerprint)) {\n    // fail fast / abort boot before handling GPGAuth requests\n}","typeGuard":"function isValidServerFingerprint(mixed $fingerprint): bool {\n    return is_string($fingerprint) && PublicKeyValidationService::isValidFingerprint($fingerprint);\n}","tryCatchPattern":"try {\n    $auth->authenticate($request);\n} catch (InternalErrorException $e) {\n    // log config error, return 500 with guidance to run passbolt healthcheck\n}","preventionTips":["Run `passbolt healthcheck` as part of deployment; it validates the GPG config section.","Generate app.local.php via the official install flow instead of hand-editing fingerprints.","Pin the server key fingerprint in an env var and validate it at boot.","Add a smoke test that performs a GPGAuth stage0 request after each deploy."],"tags":["gnupg","configuration","authentication","server-key"],"backgroundTag":"missing-required-config-field","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}