{"record":{"id":"957ffb028d8d50f9","repo":"SonarSource/sonarqube","slug":"fail-to-decrypt-the-property-s-please-check-your","errorCode":null,"errorMessage":"Fail to decrypt the property %s. Please check your secret key.","messagePattern":"Fail to decrypt the property (.+?)\\. Please check your secret key\\.","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"server/sonar-server-common/src/main/java/org/sonar/server/email/EmailSmtpConfiguration.java","lineNumber":151,"sourceCode":"    return get(EMAIL_CONFIG_SMTP_OAUTH_GRANT, EMAIL_CONFIG_SMTP_OAUTH_GRANT_DEFAULT);\n  }\n\n  private String get(String key, String defaultValue) {\n    try (DbSession dbSession = dbClient.openSession(false)) {\n      return dbClient.internalPropertiesDao().selectByKey(dbSession, key)\n        .map(value -> decryptIfNeeded(key, value))\n        .orElse(defaultValue);\n    }\n  }\n\n  private String decryptIfNeeded(String key, String value) {\n    if (!encryption.isEncrypted(value)) {\n      return value;\n    }\n    try {\n      return encryption.decrypt(value);\n    } catch (Exception e) {\n      throw new IllegalStateException(\"Fail to decrypt the property %s. Please check your secret key.\".formatted(key), e);\n    }\n  }\n}\n","sourceCodeStart":133,"sourceCodeEnd":155,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-server-common/src/main/java/org/sonar/server/email/EmailSmtpConfiguration.java#L133-L155","documentation":"EmailSmtpConfiguration.decryptIfNeeded detects whether a property value (password) is stored in SonarQube's encrypted format (ENC(...) style) and, if so, decrypts it with the configured secret key. Decryption failure is wrapped in an IllegalStateException naming the property, because a wrong or missing secret key makes the SMTP password unusable.","triggerScenarios":"The SMTP password property holds an encrypted value but the secret key file was changed, moved, is missing, or was generated by a different installation; or the encrypted blob was copied between environments with different keys.","commonSituations":"Cloning a SonarQube instance without copying sonar.secretKeyPath; regenerating the secret key after the password was encrypted; restoring a database backup onto a server with a different key.","solutions":["Restore the original secret key file referenced by sonar.secretKeyPath that was used to encrypt the password.","Re-encrypt the SMTP password with the current secret key (via the API or re-saving settings with encryption enabled).","Alternatively store the password in plaintext (without ENC()) if encryption is not required.","Verify the process has read access to the secret key file."],"exampleFix":"// before: DB holds ENC(xAbc...) but secret key file is missing\n// after: regenerate/restore sonar.secretKeyPath, then re-encrypt the password\n// sonar.properties\nsonar.secretKeyPath=/opt/sonarqube/conf/secret.key","handlingStrategy":"try-catch","validationCode":"// Verify the secret key file is readable and loadable before startup:\n// keytool or the SonarQube API /api/system/info should report encryption as operational","typeGuard":null,"tryCatchPattern":"try {\n  String pwd = emailSmtpConfiguration.get(\"smtpPassword\");\n} catch (IllegalStateException e) {\n  if (e.getMessage().startsWith(\"Fail to decrypt the property\")) {\n    // restore/re-key then re-encrypt the password\n    throw new ConfigurationException(\"SMTP password secret key mismatch; re-encrypt the password\", e);\n  }\n  throw e;\n}","preventionTips":["Back up sonar.secretKeyPath with the same care as the database.","Copy the secret key when cloning environments.","Re-encrypt secrets after key rotation.","Smoke-test SMTP settings after environment restores."],"tags":["encryption","configuration","smtp"],"backgroundTag":"decryption-failed","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}