passbolt/passbolt_api · error · InternalErrorException

Failed to public key properties from certificate

Error message

Failed to public key properties from certificate: {0}

What it means

Thrown by AzureProvider::parseJwksKeys when openssl_pkey_get_details() fails on a public key resource that was successfully obtained from the certificate. The provider needs the PEM string of the public key ($pkey_array['key']) to build the Firebase\JWT Key object; without details it cannot produce a usable verification key.

Solutions

1. Check PHP/OpenSSL version and upgrade PHP to a maintained release with a current OpenSSL build.
2. Confirm the certificate's key type is RSA (Azure uses RS256/RSA) by inspecting it with openssl x509 -text.
3. Re-fetch the JWKS endpoint to rule out corrupted payloads, then retry.
4. If persistent, report/inspect with openssl_pkey_get_errors() locally to diagnose the OpenSSL failure.

Example fix

null

$pkey = openssl_pkey_get_public($certObject);
if ($pkey === false || openssl_pkey_get_details($pkey) === false) {
    throw new RuntimeException('OpenSSL cannot extract key details from certificate');
}

function canExtractKeyDetails($certObject): bool {
    $pkey = openssl_pkey_get_public($certObject);
    $details = $pkey !== false ? openssl_pkey_get_details($pkey) : false;
    return is_array($details) && isset($details['key']);
}

try {
    $keys = $provider->getJwtVerificationKeys();
} catch (InternalErrorException $e) {
    if (str_starts_with($e->getMessage(), 'Failed to public key properties')) {
        Log::error('openssl_pkey_get_details failed: ' . openssl_error_string());
    }
    throw $e;
}

When it happens

Trigger: openssl_pkey_get_details() returns false for a valid-looking public key resource — typically due to an OpenSSL memory/constraint problem or an unsupported/edge-case key in the x5c certificate. Very rare with Azure AD RSA certificates.

Common situations: Outdated or oddly compiled PHP OpenSSL extension; extremely constrained server memory; custom JWKS fixtures with exotic key types. Note the message itself has a typo ('Failed to public key properties...').

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to read public key from certificate
• Failed to read certificate
• Invalid JWKS endpoint response. Keys missing.
• No JWT key defined for Azure service.
• Cannot parse JWKS endpoint response.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/19fcca8ce49eca24. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/Azure/Provider/AzureProvider.php:219

                    $cert_object = openssl_x509_read($cert);

                    if ($cert_object === false) {
                        throw new InternalErrorException(__('Failed to read certificate: {0}', $encodedkey));
                    }

                    $pkey_object = openssl_pkey_get_public($cert_object);

                    if ($pkey_object === false) {
                        $msg = __('Failed to read public key from certificate: {0}', $encodedkey);
                        throw new InternalErrorException($msg);
                    }

                    $pkey_array = openssl_pkey_get_details($pkey_object);

                    if ($pkey_array === false) {
                        $msg = __('Failed to public key properties from certificate: {0}', $encodedkey);
                        throw new InternalErrorException($msg);
                    }

                    $publicKey = $pkey_array['key'];

                    $keys[$keyinfo['kid']] = new Key($publicKey, 'RS256');
                }
            }
        }

        if (empty($keys)) {
            throw new InternalErrorException('No JWT key defined for Azure service.');
        }

        return $keys;
    }
}

View on GitHub (pinned to 31c1bbc10f)