{"record":{"id":"19fcca8ce49eca24","repo":"passbolt/passbolt_api","slug":"failed-to-public-key-properties-from-certificate-0","errorCode":null,"errorMessage":"Failed to public key properties from certificate: {0}","messagePattern":"Failed to public key properties from certificate: (.+?)","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Azure/Provider/AzureProvider.php","lineNumber":219,"sourceCode":"\n                    $cert_object = openssl_x509_read($cert);\n\n                    if ($cert_object === false) {\n                        throw new InternalErrorException(__('Failed to read certificate: {0}', $encodedkey));\n                    }\n\n                    $pkey_object = openssl_pkey_get_public($cert_object);\n\n                    if ($pkey_object === false) {\n                        $msg = __('Failed to read public key from certificate: {0}', $encodedkey);\n                        throw new InternalErrorException($msg);\n                    }\n\n                    $pkey_array = openssl_pkey_get_details($pkey_object);\n\n                    if ($pkey_array === false) {\n                        $msg = __('Failed to public key properties from certificate: {0}', $encodedkey);\n                        throw new InternalErrorException($msg);\n                    }\n\n                    $publicKey = $pkey_array['key'];\n\n                    $keys[$keyinfo['kid']] = new Key($publicKey, 'RS256');\n                }\n            }\n        }\n\n        if (empty($keys)) {\n            throw new InternalErrorException('No JWT key defined for Azure service.');\n        }\n\n        return $keys;\n    }\n}\n","sourceCodeStart":201,"sourceCodeEnd":236,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Azure/Provider/AzureProvider.php#L201-L236","documentation":"Thrown by AzureProvider::parseJwksKeys when openssl_pkey_get_details() fails on a public key resource that was successfully obtained from the certificate. The provider needs the PEM string of the public key ($pkey_array['key']) to build the Firebase\\JWT Key object; without details it cannot produce a usable verification key.","triggerScenarios":"openssl_pkey_get_details() returns false for a valid-looking public key resource — typically due to an OpenSSL memory/constraint problem or an unsupported/edge-case key in the x5c certificate. Very rare with Azure AD RSA certificates.","commonSituations":"Outdated or oddly compiled PHP OpenSSL extension; extremely constrained server memory; custom JWKS fixtures with exotic key types. Note the message itself has a typo ('Failed to public key properties...').","solutions":["Check PHP/OpenSSL version and upgrade PHP to a maintained release with a current OpenSSL build.","Confirm the certificate's key type is RSA (Azure uses RS256/RSA) by inspecting it with openssl x509 -text.","Re-fetch the JWKS endpoint to rule out corrupted payloads, then retry.","If persistent, report/inspect with openssl_pkey_get_errors() locally to diagnose the OpenSSL failure."],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"$pkey = openssl_pkey_get_public($certObject);\nif ($pkey === false || openssl_pkey_get_details($pkey) === false) {\n    throw new RuntimeException('OpenSSL cannot extract key details from certificate');\n}","typeGuard":"function canExtractKeyDetails($certObject): bool {\n    $pkey = openssl_pkey_get_public($certObject);\n    $details = $pkey !== false ? openssl_pkey_get_details($pkey) : false;\n    return is_array($details) && isset($details['key']);\n}","tryCatchPattern":"try {\n    $keys = $provider->getJwtVerificationKeys();\n} catch (InternalErrorException $e) {\n    if (str_starts_with($e->getMessage(), 'Failed to public key properties')) {\n        Log::error('openssl_pkey_get_details failed: ' . openssl_error_string());\n    }\n    throw $e;\n}","preventionTips":["Keep the PHP OpenSSL extension updated and healthy","Ensure adequate server memory for OpenSSL operations","Log openssl_error_string() alongside the exception when diagnosing","Test JWKS parsing in staging before Azure key rotations hit production"],"tags":["sso","azure","openssl","public-key","jwks"],"backgroundTag":"internal-invariant-violation","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}