{"record":{"id":"96a010a1a18254dd","repo":"passbolt/passbolt_api","slug":"invalid-value-provided-in-passbolt-security-sso-sslcafile","errorCode":null,"errorMessage":"Invalid value provided in `passbolt.security.sso.sslCafile` config","messagePattern":"Invalid value provided in `passbolt\\.security\\.sso\\.sslCafile` config","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Http/SsoHttpClientFactory.php","lineNumber":70,"sourceCode":"     * Resolve the Guzzle `verify` option from the SSO SSL configuration.\n     *\n     * @see https://docs.guzzlephp.org/en/stable/request-options.html#verify\n     * @return string|bool `true` for default verification, `false` to disable, or a CA file path.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException When a custom CA file is configured but invalid.\n     */\n    private static function resolveVerify(): bool|string\n    {\n        $sslVerify = (bool)Configure::read(self::CONFIG_SSL_VERIFY, true);\n        $sslCafile = Configure::read(self::CONFIG_SSL_CAFILE);\n\n        if ($sslVerify && $sslCafile === null) {\n            return true;\n        }\n        if (!$sslVerify) {\n            return false;\n        }\n        if (!is_string($sslCafile)) {\n            throw new BadRequestException(__('Invalid value provided in `passbolt.security.sso.sslCafile` config'));\n        }\n        if (!file_exists($sslCafile)) {\n            throw new BadRequestException(__('Provided root CA file does not exist'));\n        }\n\n        return $sslCafile;\n    }\n}\n","sourceCodeStart":52,"sourceCodeEnd":79,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Http/SsoHttpClientFactory.php#L52-L79","documentation":"SsoHttpClientFactory::resolveVerify() maps passbolt.security.sso.sslVerify/sslCafile config onto Guzzle's 'verify' option. If sslVerify is truthy and a custom CA bundle is configured, sslCafile must be a string path; any other value (array, true, int, non-empty-but-invalid type) throws this BadRequestException. It is thrown when building the SSO HTTP client, so every SSO operation fails until config is fixed.","triggerScenarios":"resolveVerify() is invoked from create(); passbolt.security.sso.sslVerify is enabled AND passbolt.security.sso.sslCafile is set to something that is not a string (e.g. true, an array from bad config merge, or a numeric value in config/passbolt.php).","commonSituations":"Admins setting 'sslCafile' => true expecting 'use CA verification' instead of a path; config files importing the wrong variable type; environment variable interpolation producing non-strings; leftovers from copy-pasted config snippets.","solutions":["Open config/passbolt.php (or app.php) and set passbolt.security.sso.sslCafile to a string filesystem path to a PEM CA bundle, e.g. '/etc/ssl/certs/ca-certificates.crt'.","If you don't need a custom CA, remove the sslCafile key entirely so resolveVerify() returns true (default system verification).","Confirm sslVerify is a boolean true/false and matches your intent (false disables verification entirely).","Validate config at deploy time with a quick Configure::read() dump to catch type issues before runtime."],"exampleFix":"// before (config/passbolt.php)\n'security' => ['sso' => ['sslVerify' => true, 'sslCafile' => true]],\n// after\n'security' => ['sso' => ['sslVerify' => true, 'sslCafile' => '/etc/ssl/certs/ca-certificates.crt']],","handlingStrategy":"validation","validationCode":"$cafile = Configure::read('passbolt.security.sso.sslCafile');\nif (Configure::read('passbolt.security.sso.sslVerify') && $cafile !== null) {\n    assert(is_string($cafile), 'sslCafile must be a string path');\n    assert(file_exists($cafile), 'sslCafile must point to an existing CA bundle');\n}","typeGuard":"function isValidCafile(mixed $cafile): bool {\n    return is_string($cafile) && $cafile !== '' && is_file($cafile) && is_readable($cafile);\n}","tryCatchPattern":"try {\n    $client = SsoHttpClientFactory::create();\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    $this->log('Bad SSO SSL config: ' . $e->getMessage());\n    // abort SSO flow and prompt admin to fix passbolt.security.sso.sslCafile\n}","preventionTips":["Schema-validate passbolt.php types (bool for sslVerify, string path for sslCafile) at deploy time","Never set sslCafile to true — remove the key for default system CAs","Check the CA file exists and is readable by the PHP user after deployment","Keep sslCafile settings in one reviewed config section with comments showing correct usage"],"tags":["sso","ssl","configuration","config-type-error"],"backgroundTag":"config-type-mismatch","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}