{"record":{"id":"45d2078cef700123","repo":"passbolt/passbolt_api","slug":"the-openpgp-server-key-defined-in-the-config-cannot-be-used-45d207","errorCode":null,"errorMessage":"The OpenPGP server key defined in the config cannot be used to decrypt. {exception->getMessage()}","messagePattern":"The OpenPGP server key defined in the config cannot be used to decrypt\\. (.+?)","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"src/Authenticator/GpgAuthenticator.php","lineNumber":349,"sourceCode":"        $fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n        $passphrase = Configure::read('passbolt.gpg.serverKey.passphrase');\n\n        // Check if config contains fingerprint\n        if (!is_string($fingerprint) || !PublicKeyValidationService::isValidFingerprint($fingerprint)) {\n            throw new InternalErrorException('The GnuPG config for the server is not available or incomplete.');\n        }\n\n        // set the key to be used for decrypting\n        try {\n            $this->_gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n        } catch (Exception $exception) {\n            try {\n                $this->_gpg->importServerKeyInKeyring();\n                $this->_gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n            } catch (Exception $exception) {\n                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';\n                $msg .= $exception->getMessage();\n                throw new InternalErrorException($msg, 500, $exception);\n            }\n        }\n    }\n\n    /**\n     * Set user key for encryption and import it in the keyring if needed\n     *\n     * @param string $fingerprint fingerprint\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException when the key is not valid\n     * @return void\n     */\n    private function _initUserKey(string $fingerprint): void\n    {\n        try {\n            $this->_gpg->setEncryptKeyFromFingerprint($fingerprint);\n        } catch (Exception $exception) {\n            // Try to import the key in keyring again\n            try {","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Authenticator/GpgAuthenticator.php#L331-L367","documentation":"Thrown by GpgAuthenticator::_initKeyring() when the fingerprint is valid but the OpenPGP backend cannot set the server key as decryption key: the key material is not importable into the GnuPG keyring or the passphrase does not unlock it. The original exception message is appended to aid diagnosis. Reported as InternalErrorException (HTTP 500).","triggerScenarios":"During any GPGAuth request, setDecryptKeyFromFingerprint($fingerprint, $passphrase) throws (key absent from keyring, corrupt key file, wrong passphrase); the fallback importServerKeyInKeyring() + retry also throws, so the exception is wrapped and rethrown with its message appended.","commonSituations":"serverkey.private.asc missing or unreadable by the web user; GPG homedir (GNUPGHOME) not writable or pointing elsewhere; passphrase in config does not match the one the key was generated with; key was regenerated on disk but the config fingerprint still references the old key; GnuPG agent cache/lock issues in containers.","solutions":["Read the appended exception message to identify the root cause (import failure vs bad passphrase).","Confirm the private key file exists, is readable by the web server user, and its fingerprint matches passbolt.gpg.serverKey.fingerprint (gpg --homedir ... --fingerprint).","Fix passbolt.gpg.serverKey.passphrase to the actual key passphrase (empty string if none).","Ensure the GnuPG home directory is writable and consistent (permissions ~700, correct GNUPGHOME), then retry; re-import the key pair if the keyring is stale."],"exampleFix":"// before\n'passbolt.gpg.serverKey.passphrase' => 'wrong-pass',\n\n// after\n'passbolt.gpg.serverKey.passphrase' => env('PASSBOLT_GPG_SERVERKEY_PASSPHRASE', ''),","handlingStrategy":"validation","validationCode":"// Before serving requests, verify the key is usable:\n$gpg = OpenPGPBackendFactory::get();\ntry {\n    $gpg->setDecryptKeyFromFingerprint(\n        Configure::read('passbolt.gpg.serverKey.fingerprint'),\n        Configure::read('passbolt.gpg.serverKey.passphrase')\n    );\n} catch (Exception $e) { /* fail fast at boot */ }","typeGuard":null,"tryCatchPattern":"try {\n    $gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n} catch (Exception $e) {\n    // inspect $e->getMessage(): key import vs passphrase problem\n}","preventionTips":["Store the private key file (serverkey_private.asc) with ownership/permissions readable by the web user (640, web group).","Keep the passphrase in sync with the key (empty string if generated without one) via env var.","Regenerate key + config together so the fingerprint always matches the on-disk key.","Monitor GNUPGHOME writability in containers (mount a persistent, correctly-owned volume)."],"tags":["gnupg","server-key","keyring","passphrase","authentication"],"backgroundTag":"invalid-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}