{"record":{"id":"9ca57acbd1b19218","repo":"passbolt/passbolt_api","slug":"the-openpgp-server-key-defined-in-the-config-cannot-be-used-9ca57a","errorCode":null,"errorMessage":"The OpenPGP server key defined in the config cannot be used to decrypt.","messagePattern":"The OpenPGP server key defined in the config cannot be used to decrypt\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltCe/SmtpSettings/src/Service/SmtpSettingsGetSettingsInDbService.php","lineNumber":118,"sourceCode":"     * @throw InternalErrorException If the smtp settings cannot be decrypted\n     */\n    protected function decrypt(string $encryptedValue): string\n    {\n        $keyFingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n        $passphrase = Configure::read('passbolt.gpg.serverKey.passphrase');\n        $gpg = OpenPGPBackendFactory::get();\n\n        // set the key to be used for decrypting\n        try {\n            $gpg->setDecryptKeyFromFingerprint($keyFingerprint, $passphrase);\n        } catch (CakeException $exception) {\n            try {\n                $gpg->importServerKeyInKeyring();\n                $gpg->setDecryptKeyFromFingerprint($keyFingerprint, $passphrase);\n            } catch (CakeException $exception) {\n                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';\n                $msg .= $exception->getMessage();\n                throw new InternalErrorException($msg);\n            }\n        }\n\n        try {\n            return $gpg->decrypt($encryptedValue);\n        } catch (Throwable $e) {\n            $msg = __('The OpenPGP server key cannot be used to decrypt the SMTP settings stored in database.');\n            $msg .= ' ' . __('To fix this problem, you need to configure the SMTP server again.') . ' ';\n            $msg .= $e->getMessage();\n            throw new InternalErrorException($msg, 500, $e);\n        }\n    }\n}\n","sourceCodeStart":100,"sourceCodeEnd":132,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/SmtpSettings/src/Service/SmtpSettingsGetSettingsInDbService.php#L100-L132","documentation":"Thrown by SmtpSettingsGetSettingsInDbService::decrypt when the OpenPGP server key configured via passbolt.gpg.serverKey cannot be loaded into the keyring or set as the decryption key. Passbolt encrypts SMTP settings with the server key before storing them in organization_settings; if the key import or setDecryptKeyFromFingerprint fails, no decryption key exists and the read fails with an HTTP 500 InternalErrorException whose message includes the underlying GnuPG error.","triggerScenarios":"Any code path that reads SMTP settings from the DB (readConfigInDB -> decrypt), e.g. GET /smtp/settings or sending a test email, when the configured server key fingerprint does not match a key present/importable in the GPG keyring, the key file defined in passbolt.gpg.serverKey.public/private is missing or unreadable, or the passphrase in the config is wrong.","commonSituations":"Migrating passbolt to a new server without copying the server OpenPGP keys; changing the fingerprint in passbolt.php or the environment after settings were already encrypted; gnupg home directory (GNUPGHOME) permission problems after running the app as a different user; rotating the server key; Docker volume not mounting the key files.","solutions":["Restore the original server OpenPGP key files and make sure passbolt.gpg.serverKey.fingerprint, .public and .private in config point to them, then re-run the request","Run `su -s /bin/bash -c \"gpg --home /var/lib/passbolt/.gnupg --list-keys\" <webserver-user>` (or inspect GNUPGHOME) to verify the key with the configured fingerprint exists in the keyring; re-import it with `passbolt import_private_key` / gpg --import if missing","Check the passphrase in passbolt.gpg.serverKey.passphrase matches the key's passphrase; fix and clear cache (`rm -f tmp/cache/*`)","Fix filesystem permissions on the key files and the gnupg home so the web server user can read/write them (chmod 700 ~/.gnupg, chown webserver-user)","As a last resort, re-configure the SMTP settings via the UI/`passbolt send_test_email` so they are re-encrypted with the current server key"],"exampleFix":"// before (config/passbolt.php)\n'fingerprint' => 'ABCOLD123...',\n'public' => CONFIG . 'gpg' . DS . 'serverkey.asc',\n// after\n'fingerprint' => sha1(file_get_contents(CONFIG . 'gpg' . DS . 'serverkey_private.asc')), // must match imported key\n'public' => CONFIG . 'gpg' . DS . 'serverkey.asc',\n'private' => CONFIG . 'gpg' . DS . 'serverkey_private.asc', // and ensure the key file is copied to the new host","handlingStrategy":"try-catch","validationCode":"$fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n$home = getenv('GNUPGHOME') ?: (Configure::read('passbolt.gpg.keyring') ?? '~/.gnupg');\n$output = shell_exec(\"gpg --homedir $home --list-keys $fingerprint 2>/dev/null\");\nif (!$output) { throw new \\RuntimeException('Server key not in keyring: ' . $fingerprint); }","typeGuard":"function serverKeyIsUsable(array $gpgConfig): bool\n{\n    return !empty($gpgConfig['fingerprint'])\n        && is_readable($gpgConfig['public'] ?? '')\n        && is_readable($gpgConfig['private'] ?? '');\n}","tryCatchPattern":"try {\n    $settings = (new SmtpSettingsGetSettingsInDbService())->getSettings();\n} catch (\\Cake\\Http\\Exception\\InternalErrorException $e) {\n    $this->log('SMTP settings decryption failed: ' . $e->getMessage(), 'error');\n    $settings = Configure::read('passbolt.emailTransports.smtp'); // fallback to file config\n}","preventionTips":["Copy serverkey.asc/serverkey_private.asc to the new host whenever migrating and keep fingerprints in sync with config","Pin passbolt.gpg.serverKey.fingerprint to the actual key fingerprint (output of gpg --fingerprint), never a hand-typed value","Set correct ownership/permissions (700 on .gnupg, owned by web server user) in Docker images and deployment scripts","Include a health check that verifies the server key is importable before assuming SMTP settings reads will work"],"tags":["gpg","decryption","smtp-settings","server-key","config"],"backgroundTag":"invalid-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}