{"record":{"id":"1670b4fc91641353","repo":"passbolt/passbolt_api","slug":"the-config-for-the-server-private-key-fingerprint-is-not-1670b4","errorCode":null,"errorMessage":"The config for the server private key fingerprint is not available or incomplete.","messagePattern":"The config for the server private key fingerprint is not available or incomplete\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"src/Service/OpenPGP/OpenPGPCommonServerOperationsTrait.php","lineNumber":163,"sourceCode":"                $msg = __('The OpenPGP server key defined in the config cannot be used to sign.') . ' ';\n                $msg .= $exception->getMessage();\n                throw new InternalErrorException($msg, 500, $exception);\n            }\n        }\n\n        return $gpg;\n    }\n\n    /**\n     * @param mixed $fingerprint fingerprint\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if the server key fingerprint cannot be loaded\n     */\n    private function assertServerFingerprint(mixed $fingerprint): void\n    {\n        if (!is_string($fingerprint) || !PublicKeyValidationService::isValidFingerprint($fingerprint)) {\n            $msg = __('The config for the server private key fingerprint is not available or incomplete.');\n            throw new InternalErrorException($msg);\n        }\n    }\n\n    /**\n     * @param mixed $passphrase passphrase\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if the server key passphrase cannot be loaded\n     */\n    private function assertServerPassphrase(mixed $passphrase): void\n    {\n        if (!is_string($passphrase)) {\n            $msg = __('The config for the server private key passphrase is invalid.');\n            throw new InternalErrorException($msg);\n        }\n    }\n}\n","sourceCodeStart":145,"sourceCodeEnd":180,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/OpenPGP/OpenPGPCommonServerOperationsTrait.php#L145-L180","documentation":"Thrown by assertServerFingerprint (invoked by all four set*KeyWithServerKey methods) when passbolt.gpg.serverKey.fingerprint is missing from Configure, is not a string, or fails PublicKeyValidationService::isValidFingerprint (wrong length/charset). It is a fail-fast config assertion before any GnuPG operation is attempted, so no underlying gnupg message is attached.","triggerScenarios":"passbolt.gpg.serverKey.fingerprint absent from config (config/app.php or passbolt.php not loaded/merged); value set to null/false/empty string; fingerprint containing lowercase letters, spaces, or fewer/more than 40 hex characters; environment variable interpolation producing an empty value (e.g. missing PASSBOLT_SERVERKEY_FINGERPRINT env var); config file loaded but the key was renamed.","commonSituations":"Fresh install where `passbolt install` was never run and no server key was generated; hand-edited config dropping the fingerprint key; Docker deployments where the env var holding the fingerprint is unset; switching between config files (default.php/app.php) and losing the override; typos like a 39-character fingerprint after copy/paste.","solutions":["Generate or locate the server key fingerprint: `gpg --show-keys /etc/passbolt/serverkey.asc` (or run the passbolt key-generation command on first install).","Set a valid 40-character uppercase hex fingerprint under passbolt.gpg.serverKey.fingerprint in config/app.php or passbolt.php.","If the value comes from an environment variable, verify it is actually set in the container/service environment (`printenv | grep -i fingerprint`).","Confirm the config file is being loaded (check passbolt.php include/merge and that Configure::read('passbolt.gpg.serverKey.fingerprint') returns the value, e.g. via a healthcheck command).","Normalize the value: strip whitespace/newlines and uppercase it so isValidFingerprint passes."],"exampleFix":"// before (config/app.php)\n'serverKey' => [\n    'fingerprint' => env('PASSBOLT_SERVERKEY_FINGERPRINT'), // env var unset → null\n],\n// after\n'serverKey' => [\n    'fingerprint' => '52729A1CB5D8B6C4F3C0A1B2D4E5F60718293A4B', // 40 uppercase hex chars\n],","handlingStrategy":"validation","validationCode":"use App\\Service\\OpenPGP\\PublicKeyValidationService;\nuse Cake\\Core\\Configure;\n\n$fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\nif (!is_string($fingerprint) || !PublicKeyValidationService::isValidFingerprint($fingerprint)) {\n    throw new Exception('passbolt.gpg.serverKey.fingerprint is not set or is not a valid 40-char hex fingerprint');\n}","typeGuard":"function isValidFingerprintConfig(mixed $fingerprint): bool\n{\n    return is_string($fingerprint)\n        && PublicKeyValidationService::isValidFingerprint($fingerprint);\n}","tryCatchPattern":"try {\n    $gpg = $this->setEncryptKeyWithServerKey($gpg);\n} catch (InternalErrorException $e) {\n    if (str_contains($e->getMessage(), 'fingerprint is not available or incomplete')) {\n        Log::error('passbolt.gpg.serverKey.fingerprint missing/invalid in config');\n    }\n    throw $e;\n}","preventionTips":["Set the fingerprint as a 40-character uppercase hex string; normalize whitespace on env-derived values.","Run `passbolt healthcheck` after installs and config edits to catch missing keys.","Use env-var defaults/fail-fast checks at boot when config comes from the environment.","Keep server key generation (and fingerprint capture) part of the first-run provisioning script.","Add a unit/bootstrap assertion that Configure::read('passbolt.gpg.serverKey.fingerprint') is valid before serving traffic."],"tags":["openpgp","config","fingerprint","missing-config","validation"],"backgroundTag":"missing-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}