{"record":{"id":"ecc08a33ddb706d2","repo":"passbolt/passbolt_api","slug":"the-jwt-private-key-could-not-be-created","errorCode":null,"errorMessage":"The JWT private key could not be created.","messagePattern":"The JWT private key could not be created\\.","errorType":"http","errorClass":"InvalidJwtKeyPairException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwtKeyPairService.php","lineNumber":74,"sourceCode":"    public function createKeyPair(bool $force = false): void\n    {\n        // If pair exists but force to false, exit silently\n        if ($this->keyPairExists() && !$force) {\n            return;\n        }\n\n        $config = [\n            'digest_alg' => JwtTokenCreateService::JWT_ALG,\n            'private_key_bits' => $this->getKeyLength(),\n            'private_key_type' => OPENSSL_KEYTYPE_RSA,\n        ];\n        $secretKeyPath = $this->getSecretKeyPath();\n        $publicKeyPath = $this->getPublicKeyPath();\n\n        try {\n            $pk = openssl_pkey_new($config);\n            if ($pk === false) {\n                throw new Exception('The JWT private key could not be created.');\n            }\n            $export = openssl_pkey_export_to_file($pk, $secretKeyPath);\n            if ($export === false) {\n                throw new Exception('The JWT private key could not be written.');\n            }\n            $publicKey = openssl_pkey_get_details($pk)['key'] ?? false;\n            if ($publicKey === false) {\n                throw new Exception('The JWT public key could not be extracted.');\n            }\n            $export = file_put_contents($publicKeyPath, $publicKey);\n            if ($export === false) {\n                throw new Exception('The JWT public key could not be written.');\n            }\n\n            $permission = 0640;\n            $res = chmod($secretKeyPath, $permission);\n            if (!$res) {\n                throw new Exception(\"The permission of $secretKeyPath could not be set to $permission.\");","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwtKeyPairService.php#L56-L92","documentation":"JwtKeyPairService::createKeyPair() calls openssl_pkey_new($config) to generate the RSA JWT key pair. When OpenSSL fails to create the key resource (returns false), this error is thrown and later wrapped in InvalidJwtKeyPairException. It means the local OpenSSL library refused to generate a key with the supplied configuration.","triggerScenarios":"Running the JWT key pair generation command (execute -> createKeyPair) when openssl_pkey_new returns false, typically because the openssl.cnf path is wrong/missing or the config lacks an 'rsKeys'/'req' section (e.g. OPENSSL_CONF pointing at an empty file, default 'private_key_bits'/'private_key_type' unsupported).","commonSituations":"Docker/minimal images without a valid openssl.cnf; OPENSSL_CONF env var pointing to a nonexistent file; OpenSSL 3.x strictness with legacy config; passboltEmail or CLI user environment missing default openssl config.","solutions":["Verify the openssl.cnf exists and OPENSSL_CONF points to it (php -i | grep openssl; check `openssl version -d`)","Set a valid config in createKeyPair's $config, e.g. 'config' => a path to a working openssl.cnf with [req] distinguished_name and [rsa] sections","Ensure the PHP openssl extension is loaded and functioning (php -m | grep openssl; openssl_pkey_new smoke test)","Check the container image ships /etc/ssl/openssl.cnf; if not, add one"],"exampleFix":"// before\n$pk = openssl_pkey_new($config); // fails: no config\n// after\n$config = [\n  'private_key_bits' => 4096,\n  'private_key_type' => OPENSSL_KEYTYPE_RSA,\n  'config' => '/etc/ssl/openssl.cnf',\n];\n$pk = openssl_pkey_new($config);","handlingStrategy":"try-catch","validationCode":"if (!extension_loaded('openssl')) { throw new \\RuntimeException('openssl extension missing'); }\nif (!is_file('/etc/ssl/openssl.cnf')) { /* warn: OpenSSL config missing */ }","typeGuard":"$pk = openssl_pkey_new($config);\nif (!is_resource($pk) && !($pk instanceof \\OpenSSLAsymmetricKey)) { /* handle failure */ }","tryCatchPattern":"try {\n    $service->createKeyPair();\n} catch (\\Passbolt\\JwtAuthentication\\Error\\Exception\\AccessToken\\InvalidJwtKeyPairException $e) {\n    // inspect openssl_error_string() and OPENSSL_CONF before retrying\n}","preventionTips":["Ship a valid openssl.cnf in container images","Set OPENSSL_CONF explicitly in CLI and web SAPI environments","Smoke-test openssl_pkey_new in deploy health checks"],"tags":["openssl","jwt","key-generation","config"],"backgroundTag":"openssl-key-generation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}