{"record":{"id":"52349f46a919af95","repo":"passbolt/passbolt_api","slug":"the-openpgp-server-key-defined-in-the-config-is-not-found-in","errorCode":null,"errorMessage":"The OpenPGP server key defined in the config is not found in the file system.","messagePattern":"The OpenPGP server key defined in the config is not found in the file system\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\InternalErrorException","httpStatus":500,"severity":"critical","filePath":"src/Utility/OpenPGP/OpenPGPBackend.php","lineNumber":96,"sourceCode":"    /**\n     * Import server key in keyring\n     *\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if server key is undefined or invalid\n     * @return void\n     */\n    public function importServerKeyInKeyring(): void\n    {\n        $fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n        $keyFilePath = Configure::read('passbolt.gpg.serverKey.private');\n\n        // If it's not in keyring try to import it\n        // Check if file containing the private key exist\n        if ($keyFilePath === null) {\n            throw new InternalErrorException('The secret key file is not defined.');\n        }\n        if (!file_exists($keyFilePath)) {\n            $msg = __('The OpenPGP server key defined in the config is not found in the file system.');\n            throw new InternalErrorException($msg);\n        }\n        $privateKey = file_get_contents($keyFilePath);\n        if ($privateKey === false) {\n            $msg = __('The OpenPGP server key defined in the config cannot be opened.');\n            throw new InternalErrorException($msg);\n        }\n        if (!$this->isParsableArmoredPrivateKey($privateKey)) {\n            $msg = __('The OpenPGP server key defined on file is not a valid private key.');\n            throw new InternalErrorException($msg);\n        }\n\n        // try to import it\n        $this->importKeyIntoKeyring($privateKey);\n        if (!$this->isKeyInKeyring($fingerprint)) {\n            $msg = __('There is an issue with the OpenPGP server key.') . ' ';\n            $msg .= __('The fingerprint does not match the one associated with the key on file.');\n            throw new InternalErrorException($msg);\n        }","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Utility/OpenPGP/OpenPGPBackend.php#L78-L114","documentation":"importServerKeyInKeyring loads the server's OpenPGP private key from the file path given in config and imports it into the GnuPG keyring. Before reading the file it checks file_exists($keyFilePath); when the path is null-adjacent misconfiguration resolves to a path that does not exist on disk, this InternalErrorException is thrown. It means the configured secret key file is absent from the filesystem.","triggerScenarios":"Calling importServerKeyInKeyring() when the configured PASSBOLT_GPG_SERVER_KEY_PRIVATE path points to a file that does not exist (file_exists() returns false).","commonSituations":"Fresh installs where passbolt.php or environment variables were never pointed at a key file; the key was generated on another host and never copied; Docker volume not mounted; wrong relative vs absolute path; key deleted during cleanup.","solutions":["Verify the config value passbolt.gpg.serverKey.private (or PASSBOLT_GPG_SERVER_KEY_PRIVATE env var) points to an existing absolute path.","Create or restore the server key: run `su -s /bin/bash -c \"gpg --home /var/lib/passbolt --gen-key\" www-data` or copy the existing key file to the configured location.","Ensure the web server user (www-data) can read the file and the containing directory (check permissions/SELinux).","In containerized deployments, confirm the key file is present inside the container/volume, not only on the host."],"exampleFix":"// before (config/passbolt.php)\n'serverKey' => ['private' => '/config/gpg/serverkey_private.asc'], // file missing\n// after: place the key there and confirm\nis_file('/config/gpg/serverkey_private.asc') || throw new \\RuntimeException('mount the server private key at /config/gpg/serverkey_private.asc');","handlingStrategy":"validation","validationCode":"$keyPath = Configure::read('passbolt.gpg.serverKey.private');\nif (!is_string($keyPath) || !is_file($keyPath)) {\n    throw new \\RuntimeException(\"Server private key not found at: \" . var_export($keyPath, true));\n}","typeGuard":null,"tryCatchPattern":"try {\n    $backend->importServerKeyInKeyring($fingerprint, $keyPath);\n} catch (\\Cake\\Http\\Exception\\InternalErrorException $e) {\n    if (str_contains($e->getMessage(), 'not found in the file system')) {\n        // log config path, alert operator\n    }\n    throw $e;\n}","preventionTips":["Run `passbolt healthcheck` in deployment pipeline — it validates the server key file presence.","Mount/ship the key file as part of infrastructure-as-code, never assume it exists.","Use absolute paths in config; document the expected path per environment."],"tags":["openpgp","server-key","config","filesystem","gnupg"],"backgroundTag":"file-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}