{"record":{"id":"37dccae049f2646f","repo":"phacility/phabricator","slug":"keyring-is-configured-with-a-s-key-but-the-php","errorCode":null,"errorMessage":"Keyring is configured with a \"%s\" key, but the PHP OpenSSL extension is not installed. Install the OpenSSL extension to enable encryption.","messagePattern":"Keyring is configured with a \"(.+?)\" key, but the PHP OpenSSL extension is not installed\\. Install the OpenSSL extension to enable encryption\\.","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php","lineNumber":65,"sourceCode":"      $name = $spec['name'];\n      if (isset($map[$name])) {\n        throw new Exception(\n          pht(\n            'Keyring configuration is invalid: it describes multiple keys '.\n            'with the same name (\"%s\"). Each key must have a unique name.',\n            $name));\n      }\n      $map[$name] = true;\n\n      if (idx($spec, 'default')) {\n        $defaults[] = $name;\n      }\n\n      $type = $spec['type'];\n      switch ($type) {\n        case 'aes-256-cbc':\n          if (!function_exists('openssl_encrypt')) {\n            throw new Exception(\n              pht(\n                'Keyring is configured with a \"%s\" key, but the PHP OpenSSL '.\n                'extension is not installed. Install the OpenSSL extension '.\n                'to enable encryption.',\n                $type));\n          }\n\n          $material = $spec['material.base64'];\n          $material = base64_decode($material, true);\n          if ($material === false) {\n            throw new Exception(\n              pht(\n                'Keyring specifies an invalid key (\"%s\"): key material '.\n                'should be base64 encoded.',\n                $name));\n          }\n\n          if (strlen($material) != 32) {","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php#L47-L83","documentation":"When a keyring entry declares type 'aes-256-cbc' but function_exists('openssl_encrypt') is false in the validating PHP process, the config is rejected: encryption requires the PHP OpenSSL extension, which is not loaded. This checks the actual runtime, not just configuration, because the key would be unusable otherwise.","triggerScenarios":"Setting the keyring on an install whose PHP lacks ext-openssl; CLI using a different php.ini than the web SAPI (openssl enabled for php-fpm but not php-cli, or vice versa); extension commented out or the package not installed.","commonSituations":"Minimal distro or hardened Docker PHP images that omit ext-openssl by default; upgrades that replaced php.ini and dropped extension=openssl; running bin/config on a different host class than the web nodes.","solutions":["Install the extension: apt-get install php-openssl (or your distro's equivalent), or uncomment extension=openssl / compile PHP with --with-openssl","Restart php-fpm and the web server after enabling, then verify with `php -m | grep openssl`","Confirm both SAPIs can see it: php -r 'var_dump(function_exists(\"openssl_encrypt\"));' on web and CLI"],"exampleFix":"; before (php.ini)\n; extension=openssl\n\n; after\nextension=openssl\n\n# then restart the PHP process and verify\nphp -m | grep openssl","handlingStrategy":"validation","validationCode":"if (!function_exists('openssl_encrypt')) {\n  // This PHP runtime cannot use aes-256-cbc keys; install/enable ext-openssl\n  // before configuring encryption or setting files.default-format.\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check `php -m | grep openssl` during provisioning for web and CLI SAPIs","Bake ext-openssl into base Docker images used by Phabricator","Re-verify extensions after PHP upgrades, which can reset php.ini"],"tags":["php","openssl","environment","keyring","phabricator"],"backgroundTag":"missing-php-extension","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}