{"record":{"id":"55f4b6fc67fa3613","repo":"passbolt/passbolt_api","slug":"the-openpgp-server-key-defined-in-the-config-cannot-be-used-55f4b6","errorCode":null,"errorMessage":"The OpenPGP server key defined in the config cannot be used to decrypt. ","messagePattern":"The OpenPGP server key defined in the config cannot be used to decrypt\\. ","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsGetService.php","lineNumber":159,"sourceCode":"     * @throws \\Cake\\Http\\Exception\\InternalErrorException if there is an issue with settings data decryption\n     * @return array\n     */\n    protected function decrypt(string $data): array\n    {\n        $gpg = OpenPGPBackendFactory::get();\n        $fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n        $passphrase = Configure::read('passbolt.gpg.serverKey.passphrase');\n\n        try {\n            $gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n        } catch (Exception $exception) {\n            try {\n                $gpg->importServerKeyInKeyring();\n                $gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n            } catch (Exception $exception) {\n                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';\n                $msg .= $exception->getMessage();\n                throw new InternalErrorException($msg, 500, $exception);\n            }\n        }\n\n        try {\n            $decryptedData = $gpg->decrypt($data);\n        } catch (Exception $exception) {\n            throw new InternalErrorException(__('The SSO setting cannot be decrypted.'), 500, $exception);\n        }\n\n        $decodedData = json_decode($decryptedData, true);\n        if (!isset($decodedData) || !is_array($decodedData)) {\n            throw new InternalErrorException(__('The SSO setting cannot be decoded.'));\n        }\n\n        return $decodedData;\n    }\n}\n","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsGetService.php#L141-L177","documentation":"decrypt() sets up OpenPGP with the server key from configuration and calls importServerKeyInKeyring()/setDecryptKeyFromFingerprint(). If either fails (key missing from config, unreadable key file, wrong passphrase, keyring problems), it wraps the underlying exception into an InternalErrorException starting with 'The OpenPGP server key defined in the config cannot be used to decrypt.'","triggerScenarios":"The server OpenPGP key fingerprint in config is wrong or the key is not present in the filesystem; the key passphrase is missing/incorrect; the GPG keyring is not writable or gnupg extension fails to import the key.","commonSituations":"Migration to a new server where the server key was not copied; config/app.php pass.serverKey pointing to a stale fingerprint; wrong file permissions on the keyring directory; GPG homedir misconfigured in the container.","solutions":["Verify config pass.serverKey fingerprint matches the actual server key and the key file exists and is readable.","Check the key passphrase in config matches the key; fix or remove an incorrect passphrase.","Ensure the GPG keyring directory (GNUPGHOME / WEBROOT_TMP) exists and is writable by the web server user.","Import the server key manually (gpg --import) and re-test; read the appended exception message for the gnupg failure cause.","Run bin/cake passbolt healthcheck for GPG configuration checks."],"exampleFix":"// before (config/app.php)\n'serverKey' => ['fingerprint' => '<OLD_FINGERPRINT>', 'passphrase' => '']\n// after\n'serverKey' => ['fingerprint' => '<CORRECT_FINGERPRINT_FROM_serverkey.asc>', 'passphrase' => '<CORRECT_PASSPHRASE>']","handlingStrategy":"try-catch","validationCode":"// check config before calling\n$fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n$passphrase = Configure::read('passbolt.gpg.serverKey.passphrase');\nif (empty($fingerprint)) { throw new Exception('Missing server key fingerprint'); }","typeGuard":null,"tryCatchPattern":"try { $dto = $service->getByIdOrFail($id, true); } catch (InternalErrorException $e) { if (str_contains($e->getMessage(), 'server key')) { // alert: check GPG config/keyring } }","preventionTips":["Run bin/cake passbolt healthcheck after any server/config change","Keep the server key fingerprint, private key and passphrase in sync in config","Ensure the GPG keyring directory is owned by the web user and persists across deploys","Copy the server key when migrating hosts"],"tags":["gpg","sso","config","server-key","decryption"],"backgroundTag":"invalid-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}