{"record":{"id":"b88a74543264b26e","repo":"passbolt/passbolt_api","slug":"500-the-openpgp-server-key-defined-in-the-config-cannot-be","errorCode":"500","errorMessage":"The OpenPGP server key defined in the config cannot be used to decrypt. ","messagePattern":"The OpenPGP server key defined in the config cannot be used to decrypt\\. ","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltEe/DirectorySync/src/Utility/DirectoryOrgSettings.php","lineNumber":459,"sourceCode":"        $gpgConfig = Configure::read('passbolt.gpg');\n        $fingerprint = $gpgConfig['serverKey']['fingerprint'];\n        $passphrase = $gpgConfig['serverKey']['passphrase'];\n        $gpg = OpenPGPBackendFactory::get();\n\n        try {\n            $gpg->setSignKeyFromFingerprint($fingerprint, $passphrase);\n            $gpg->setEncryptKeyFromFingerprint($fingerprint);\n        } catch (Exception $exception) {\n            try {\n                // Try again by importing key into keyring\n                $gpg->importServerKeyInKeyring();\n                $gpg->setSignKeyFromFingerprint($fingerprint, $passphrase);\n                $gpg->setEncryptKeyFromFingerprint($fingerprint);\n            } catch (Exception $exception) {\n                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';\n                $msg .= $exception->getMessage();\n\n                throw new InternalErrorException($msg, 500, $exception);\n            }\n        }\n\n        return $gpg->encrypt($data, true);\n    }\n\n    /**\n     * Decrypt the organization settings\n     *\n     * @param string $data The message to decrypt\n     * @return string\n     */\n    protected static function decrypt(string $data): string\n    {\n        $gpgConfig = Configure::read('passbolt.gpg');\n        $keyid = $gpgConfig['serverKey']['fingerprint'];\n        $passphrase = $gpgConfig['serverKey']['passphrase'];\n        $gpg = OpenPGPBackendFactory::get();","sourceCodeStart":441,"sourceCodeEnd":477,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/DirectorySync/src/Utility/DirectoryOrgSettings.php#L441-L477","documentation":"DirectoryOrgSettings::encrypt signs/encrypts the directory settings payload with the server OpenPGP key. If loading the sign/encrypt key from the configured fingerprint fails (bad fingerprint, missing keyring, wrong passphrase), the original exception is wrapped into an InternalErrorException with this message, HTTP 500.","triggerScenarios":"Calling save() on DirectoryOrgSettings when passbolt.gpg.serverKey fingerprint is wrong, the key is absent from the GNUPG keyring, or the passphrase is incorrect, making setSignKeyFromFingerprint/setEncryptKeyFromFingerprint throw.","commonSituations":"Server key regenerated or rotated without updating config; GNUPGHOME not writable/missing for the web server user; fingerprint casing/whitespace typo in config; moving to a new server without importing the key.","solutions":["Verify passbolt.gpg.serverKey.fingerprint matches a key present in the web server user's keyring (`gpg --list-keys --homedir $GNUPGHOME`)","Re-import the server key pair into the keyring and set correct ownership/permissions on GNUPGHOME","Check the configured passphrase (passbolt.gpg.serverKey.passphrase) is correct for the key","Run `ddev exec su -m -c \"bin/cake passbolt healthcheck\" www-data` or the GPG healthcheck to validate the key setup"],"exampleFix":"// config/passbolt.php\n// before\n'serverKey' => [\n    'fingerprint' => '2FC8945813C4883A68FA4E1D2A4B7E30XXXXXXXX',\n    'passphrase' => 'wrong-passphrase',\n],\n// after\n'serverKey' => [\n    'fingerprint' => '2FC8945813C4883A68FA4E1D2A4B7E30AAAAAAAA', // fingerprint from gpg --list-keys\n    'passphrase' => 'correct-passphrase',\n],","handlingStrategy":"validation","validationCode":"$fp = Configure::read('passbolt.gpg.serverKey.fingerprint');\n$gpg = new gnupg();\n$gpg->sethomedir(Configure::read('passbolt.gpg.keyring'));\n$info = $gpg->keyinfo($fp);\nif (empty($info)) { /* key missing: import before saving settings */ }","typeGuard":null,"tryCatchPattern":"try {\n    $settings->save($data);\n} catch (InternalErrorException $e) {\n    $this->log($e->getMessage());\n    return $this->respondWithError('500', __('Server OpenPGP key is misconfigured; verify fingerprint, keyring and passphrase.'));\n}","preventionTips":["Verify the server key fingerprint with gpg --list-keys after any key rotation","Ensure GNUPGHOME is owned and writable by the web server user","Keep the passphrase in sync with the configured key","Run the GPG healthcheck after server migrations"],"tags":["gpg","encryption","configuration","ldap"],"backgroundTag":"missing-credentials","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}