{"record":{"id":"971b7892201ff199","repo":"passbolt/passbolt_api","slug":"the-openpgp-server-key-cannot-be-used-to-decrypt-the-smtp","errorCode":null,"errorMessage":"The OpenPGP server key cannot be used to decrypt the SMTP settings stored in database.","messagePattern":"The OpenPGP server key cannot be used to decrypt the SMTP settings stored in database\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/SmtpSettings/src/Service/SmtpSettingsGetSettingsInDbService.php","lineNumber":128,"sourceCode":"            $gpg->setDecryptKeyFromFingerprint($keyFingerprint, $passphrase);\n        } catch (CakeException $exception) {\n            try {\n                $gpg->importServerKeyInKeyring();\n                $gpg->setDecryptKeyFromFingerprint($keyFingerprint, $passphrase);\n            } catch (CakeException $exception) {\n                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';\n                $msg .= $exception->getMessage();\n                throw new InternalErrorException($msg);\n            }\n        }\n\n        try {\n            return $gpg->decrypt($encryptedValue);\n        } catch (Throwable $e) {\n            $msg = __('The OpenPGP server key cannot be used to decrypt the SMTP settings stored in database.');\n            $msg .= ' ' . __('To fix this problem, you need to configure the SMTP server again.') . ' ';\n            $msg .= $e->getMessage();\n            throw new InternalErrorException($msg, 500, $e);\n        }\n    }\n}\n","sourceCodeStart":110,"sourceCodeEnd":132,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/SmtpSettings/src/Service/SmtpSettingsGetSettingsInDbService.php#L110-L132","documentation":"Thrown by SmtpSettingsGetSettingsInDbService::decrypt when the OpenPGP server key is correctly set up, but decryption of the SMTP settings blob stored in organization_settings still fails. The stored ciphertext was encrypted with a different/rotated server key (or is corrupted), so the current key cannot open it; passbolt raises HTTP 500 and advises re-configuring the SMTP server.","triggerScenarios":"Reading SMTP settings from the DB (GET /smtp/settings, health checks, test email) after the server OpenPGP key was regenerated or replaced since the settings were saved; the organization_settings.value was copied from another instance encrypted with a different key; the stored value is truncated or otherwise corrupted.","commonSituations":"Server key rotation without re-saving SMTP settings; restoring a database dump from instance A onto instance B whose server keys differ; Docker/VM rebuilds where keys are regenerated on startup; manual edits or partial imports of the organization_settings table.","solutions":["Re-configure the SMTP settings (admin UI SMTP settings page or POST /smtp/settings) so the payload is re-encrypted with the current server key — this is the fix the error message itself recommends","Verify which key encrypted the data: compare the current `passbolt.gpg.serverKey.fingerprint` with the one used when settings were saved; restore the old key into the keyring if you still have it","If the old key is lost, delete the stale row (organization_settings where property = 'smtp') so the app falls back to file-based SMTP config, then re-save settings from the UI","Corruption check: re-export the organization_settings row and confirm the ASCII-armored PGP block is complete (begins with -----BEGIN PGP MESSAGE----- and ends properly) before assuming key mismatch"],"exampleFix":"-- before\nSELECT * FROM organization_settings WHERE property = 'smtp'; -- stale ciphertext from old key\n-- after (re-save via UI, or clear so file config is used)\nDELETE FROM organization_settings WHERE property = 'smtp';\n-- then POST /smtp/settings or use the admin UI to re-encrypt with the current server key","handlingStrategy":"try-catch","validationCode":"try {\n    (new SmtpSettingsGetSettingsInDbService())->getSettings();\n} catch (\\Cake\\Http\\Exception\\InternalErrorException $e) {\n    if (str_contains($e->getMessage(), 'cannot be used to decrypt the SMTP settings')) {\n        // stale ciphertext: settings must be re-saved or cleared\n    }\n}","typeGuard":"function isStaleSmtpCiphertext(\\Cake\\Http\\Exception\\InternalErrorException $e): bool\n{\n    return str_contains($e->getMessage(), 'SMTP settings stored in database');\n}","tryCatchPattern":"try {\n    $settings = $this->SmtpSettingsGetSettingsInDb->getSettings();\n} catch (\\Cake\\Http\\Exception\\InternalErrorException $e) {\n    $this->log('SMTP settings in DB are undecryptable, falling back to file config: ' . $e->getMessage());\n    $settings = null; // app falls back to passbolt.emailTransports in config files\n}","preventionTips":["Never rotate or regenerate the server OpenPGP key without re-saving SMTP settings afterward","Keep database dumps and server keys as matched pairs when restoring backups (dump from instance A requires keys from instance A)","Do not copy organization_settings rows between environments with different server keys","After any key change, immediately re-save SMTP settings via the UI so the blob is re-encrypted with the current key"],"tags":["gpg","decryption","smtp-settings","key-rotation","database"],"backgroundTag":"decryption-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}