{"record":{"id":"813df22d2b61df42","repo":"passbolt/passbolt_api","slug":"could-not-import-the-user-openpgp-key-813df2","errorCode":null,"errorMessage":"Could not import the user OpenPGP key.","messagePattern":"Could not import the user OpenPGP key\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"src/Service/Gpgkeys/GpgkeysHealthcheckService.php","lineNumber":186,"sourceCode":"    /**\n     * Set user key for encryption and import it in the keyring if needed\n     *\n     * @param string $fingerprint fingerprint\n     * @param string $armored armored\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException when the key is not valid\n     * @return void\n     */\n    private function initUserKey(string $fingerprint, string $armored): void\n    {\n        try {\n            $this->gpg->setEncryptKeyFromFingerprint($fingerprint);\n        } catch (CakeException $exception) {\n            // Try to import the key in keyring again\n            try {\n                $this->gpg->importKeyIntoKeyring($armored);\n                $this->gpg->setEncryptKeyFromFingerprint($fingerprint);\n            } catch (CakeException $exception) {\n                throw new InternalErrorException('Could not import the user OpenPGP key.', 500, $exception);\n            }\n        }\n    }\n\n    /**\n     * @param \\App\\Model\\Entity\\Gpgkey $gpgkey Gpgkey to assess\n     * @return void\n     */\n    private function isKeyExpired(Gpgkey $gpgkey): void\n    {\n        if ($gpgkey->isExpired()) {\n            $msg = __('Key expired: {0}.', $gpgkey->fingerprint);\n            $this->checks[self::CHECK_IS_NOT_EXPIRED]->fail()->addDetail($msg, Healthcheck::STATUS_ERROR);\n        } else {\n            $msg = __('Expiration date valid for key {0}.', $gpgkey->fingerprint);\n            $this->checks[self::CHECK_IS_NOT_EXPIRED]->addDetail($msg, Healthcheck::STATUS_SUCCESS);\n        }\n    }","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Gpgkeys/GpgkeysHealthcheckService.php#L168-L204","documentation":"GpgkeysHealthcheckService::initUserKey() tries to load the user's OpenPGP key into the GnuPG keyring and set it as encryption key. If the first attempt fails and the re-import plus key selection also throws, it wraps the failure in this InternalErrorException (HTTP 500).","triggerScenarios":"canEncrypt() is called for a user whose armored key is not (or cannot be) imported into the server's GNUPGHOME keyring, e.g. corrupt keyring, missing key file, or fingerprint mismatch.","commonSituations":"GNUPGHOME directory wrong or unreadable by the web server user; keyring corrupted or on read-only storage; user's key was deleted from keyring; gpg extension keybox version issues after server migration.","solutions":["Check the GNUPGHOME env/path permissions for the PHP/web server user","Run the passbolt healthcheck (gpg section) to diagnose keyring state","Delete and re-import the problematic key into the server keyring","Verify the key fingerprint stored in gpgkeys table matches a key actually importable","Ensure php-gnupg and gpg binary versions are compatible"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// operator-side: verify keyring health before hitting the app\nbin/cake passbolt healthcheck --filter=gpg","typeGuard":null,"tryCatchPattern":"try {\n  await healthcheckEndpoint();\n} catch (e) {\n  if (e.response?.status === 500) {\n    // inspect GNUPGHOME permissions and re-import user key server-side\n  }\n  throw e;\n}","preventionTips":["Ensure GNUPGHOME is writable by the web/PHP user","Monitor healthcheck gpg section in CI or cron","Re-import user keys after server or keyring migrations","Keep php-gnupg and gpg versions compatible with passbolt requirements"],"tags":["gpg","encryption","healthcheck","internal-error"],"backgroundTag":"missing-dependency","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}