{"record":{"id":"18475ed711a7fbe8","repo":"passbolt/passbolt_api","slug":"the-jwt-public-key-details-could-not-be-read","errorCode":null,"errorMessage":"The JWT public key details could not be read.","messagePattern":"The JWT public key details could not be read\\.","errorType":"http","errorClass":"InvalidJwtKeyPairException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwksGetService.php","lineNumber":68,"sourceCode":"        $details = $this->getDetails();\n\n        return $details['bits'] ?? 0;\n    }\n\n    /**\n     * @return array\n     * @throws \\Passbolt\\JwtAuthentication\\Error\\Exception\\AccessToken\\InvalidJwtKeyPairException if the public key file is not parsable.\n     */\n    private function getDetails(): array\n    {\n        $pubKey = $this->readKeyFileContent();\n        $res = openssl_pkey_get_public($pubKey);\n        if ($res === false) {\n            throw new InvalidJwtKeyPairException(__('The JWT public key could not be extracted.'));\n        }\n        $details = openssl_pkey_get_details($res);\n        if ($details === false) {\n            throw new InvalidJwtKeyPairException(__('The JWT public key details could not be read.'));\n        }\n\n        return $details;\n    }\n\n    /**\n     * @return string|false\n     * @throws \\Passbolt\\JwtAuthentication\\Error\\Exception\\AccessToken\\InvalidJwtKeyPairException if the public key file is not found or not readable.\n     */\n    public function getRawPublicKey(): string|false\n    {\n        return $this->readKeyFileContent();\n    }\n}\n","sourceCodeStart":50,"sourceCodeEnd":83,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwksGetService.php#L50-L83","documentation":"Thrown by JwksGetService::getDetails when the key parsed successfully but openssl_pkey_get_details() returns false, i.e. OpenSSL cannot extract the key's details (type, RSA components) needed to build the JWKS.","triggerScenarios":"getPublicKey or getSecretKeySize called when the loaded key resource yields no details — typically a non-RSA or unsupported key type parsed by openssl_pkey_get_public.","commonSituations":"JWT key pair generated with an unsupported algorithm/type (e.g. EC or Ed25519 where RSA is expected); OpenSSL version quirks; corrupted-but-parseable key material.","solutions":["Regenerate an RSA key pair with bin/cake passbolt create_jwt_keys","Confirm key type: openssl pkey -pubin -in config/jwt/jwt.public.key -text -noout (should show RSA)","Ensure the private/public pair matches (compare modulus hashes)","Check the PHP OpenSSL extension version supports the key format in use"],"exampleFix":"// before: EC or broken key\n// after: regenerate RSA pair\nbin/cake passbolt create_jwt_keys","handlingStrategy":"validation","validationCode":"$details = openssl_pkey_get_details(openssl_pkey_get_public(file_get_contents($path)));\nif (($details['type'] ?? null) !== OPENSSL_KEYTYPE_RSA) throw new RuntimeException('JWT key must be RSA');","typeGuard":null,"tryCatchPattern":"try { $size = $service->getSecretKeySize(); } catch (InvalidJwtKeyPairException $e) { regenerateRsaKeys(); }","preventionTips":["Generate JWT keys only with the bundled create_jwt_keys command (RSA)","Assert key type is RSA in deployment checks","Pin a known-good OpenSSL/PHP version"],"tags":["jwt","openssl","key-pair","jwks"],"backgroundTag":"unsupported-key-type","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}