passbolt/passbolt_api · error · Exception

Invalid fingerprint.

Error message

Invalid fingerprint.

What it means

fingerprintToKeyId() converts a 40-character hex OpenPGP fingerprint into the 16-character long key id by taking the last 16 chars. It throws a plain Exception('Invalid fingerprint.') when strlen($fingerprint) !== 40, because a wrong-length input would produce a meaningless key id. Called from getKeyInfo.

Solutions

1. Normalize before calling: strip spaces and uppercase: `$fp = strtoupper(str_replace(' ', '', $fingerprint));` then check strlen === 40.
2. Pass the full 40-char V4 fingerprint, not the 16-char long key id or 8-char short id.
3. Validate the format with a hex regex before calling getKeyInfo.
4. Check the data source (config/DB/form input) producing the fingerprint for truncation (e.g. VARCHAR too short).

Example fix

// before
$keyId = OpenPGPBackend::fingerprintToKeyId($fp); // $fp = '3D29 24D9 ...' with spaces
// after
$fp = strtoupper(preg_replace('/\s+/', '', $fp));
if (strlen($fp) !== 40) {
    throw new \InvalidArgumentException('fingerprint must be 40 hex chars');
}
$keyId = OpenPGPBackend::fingerprintToKeyId($fp);

$fp = strtoupper(preg_replace('/\s+/', '', $fingerprint ?? ''));
if (!preg_match('/^[0-9A-F]{40}$/', $fp)) {
    throw new \InvalidArgumentException('Expected a 40-hex-char OpenPGP fingerprint.');
}

function isValidFingerprint(mixed $fp): bool {
    return is_string($fp) && preg_match('/^[0-9A-Fa-f]{40}$/', str_replace(' ', '', $fp)) === 1;
}

try {
    $keyId = OpenPGPBackend::fingerprintToKeyId($fp);
} catch (\Exception $e) {
    if ($e->getMessage() === 'Invalid fingerprint.') {
        // normalize/log the raw value to find the data source problem
    }
    throw $e;
}

When it happens

Trigger: getKeyInfo() → fingerprintToKeyId() receives a fingerprint string whose length is not exactly 40: empty string, truncated fingerprint, key id (16 chars) passed instead of a fingerprint, or a fingerprint with spaces/whitespace inflating the length.

Common situations: Storing fingerprints with embedded spaces in config/DB then passing them untrimmed; passing a short key id where a fingerprint is expected; user-submitted keys metadata with malformed fingerprints.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• The config for the server private key fingerprint is not…
• A valid OpenPGP key must be provided.
• A valid OpenPGP key must be provided.
• A value for the theme should be provided.
• Can not upgrade. Please upgrade to the latest 1.x version…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/ec6fe7891c6c88f8. Report an issue: GitHub.

Appendix: source

Thrown at src/Utility/OpenPGP/OpenPGPBackend.php:166

            return false;
        }

        return preg_match('/^[A-F0-9]{40}$/', $fingerprint) === 1;
    }

    // ---------------------------
    // MISC UTILITIES
    // ---------------------------

    /**
     * @param string $fingerprint 40 char
     * @return string long key id 16 char
     * @throws \Exception
     */
    public static function fingerprintToKeyId(string $fingerprint): string
    {
        if (strlen($fingerprint) !== 40) {
            throw new Exception('Invalid fingerprint.');
        }

        return substr($fingerprint, -16);
    }

    /**
     * Key with extra breakline after checksum and before the end block
     * are known to cause compatibility issues with gopenpgp
     *
     * @param string $armoredKey armored key block
     * @return bool
     */
    public static function hasExtraBreakLine(string $armoredKey): bool
    {
        $armoredKey = trim($armoredKey);
        $array = explode("\n", $armoredKey);
        $size = count($array);
        if ($size < 2) {

View on GitHub (pinned to 31c1bbc10f)