passbolt/passbolt_api · error · BadRequestException

Invalid `passbolt.plugins.smtpSettings.security`…

Error message

Invalid `passbolt.plugins.smtpSettings.security` configuration values.

What it means

Thrown by SmtpSettingsSslOptionsGetService::getConfigOptions when the values configured under passbolt.plugins.smtpSettings.security fail CustomSslOptionsForm validation. These settings map to PHP stream SSL context options (sslVerifyPeer, sslVerifyPeerName, sslAllowSelfSigned, sslCafile); invalid types or values make the SMTP client's TLS options unusable, so a BadRequestException with the flattened per-field errors is raised instead of silently sending insecure SMTP traffic.

Solutions

1. Read the flattened field errors appended to the exception message ('Errors: ...') to identify which key is invalid
2. Set each option with the correct PHP type: 'sslVerifyPeer' => true|false (bool), 'sslVerifyPeerName' => bool, 'sslAllowSelfSigned' => bool, 'sslCafile' => valid absolute path to a readable CA file
3. Remove the passbolt.plugins.smtpSettings.security block entirely to fall back to default secure TLS behavior if custom options are not needed
4. If providing sslAllowSelfSigned => true or custom CA, ensure sslCafile points to an existing PEM file (e.g. /etc/ssl/certs/ca-certificates.crt)
5. Clear the cached config (rm -rf tmp/cache/persistent*) after editing config files so the new values are picked up

Example fix

// before (config/passbolt.php)
'security' => [
    'sslVerifyPeer' => 'false',           // string, not bool
    'sslAllowSelfSigned' => true,
    // sslCafile missing
],
// after
'security' => [
    'sslVerifyPeer' => false,
    'sslVerifyPeerName' => false,
    'sslAllowSelfSigned' => true,
    'sslCafile' => '/etc/ssl/certs/ca-certificates.crt',
],

$values = Configure::read('passbolt.plugins.smtpSettings.security', []);
$form = new \Passbolt\SmtpSettings\Form\CustomSslOptionsForm();
if (!empty($values) && !$form->validate($values)) {
    // fix before any SMTP send/read triggers the exception
    debug(Hash::flatten($form->getErrors()));
}

function sslOptionsAreValidTypes(array $v): bool
{
    return (isset($v['sslVerifyPeer']) && !is_bool($v['sslVerifyPeer'])) === false
        && (isset($v['sslVerifyPeerName']) && !is_bool($v['sslVerifyPeerName'])) === false
        && (isset($v['sslAllowSelfSigned']) && !is_bool($v['sslAllowSelfSigned'])) === false
        && (!isset($v['sslCafile']) || is_string($v['sslCafile']));
}

try {
    $sslOptions = $sslOptionsService->get();
} catch (\Cake\Http\Exception\BadRequestException $e) {
    $this->log('Invalid smtpSettings.security config: ' . $e->getMessage());
    $sslOptions = []; // default secure TLS options
}

When it happens

Trigger: Any call to SmtpSettingsSslOptionsGetService::get() or isDefault() (used when building SMTP transport options, e.g. sending a test email or reading settings) while config/passbolt.php or app.php contains `security` entries with wrong types or values — e.g. sslVerifyPeer set to string 'true' instead of boolean, a missing sslCafile file, or an unknown key combined with the wrong shape of data.

Common situations: Copy-pasting YAML/JSON config where booleans become strings ('false' vs false); pointing sslCafile to a non-existent CA bundle path; setting sslAllowSelfSigned without also providing sslCafile if the form requires it; typos like ssl_verify_peer instead of sslVerifyPeer in passbolt.plugins.smtpSettings.security.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Could not validate the smtp settings.
• Invalid request, message validation rules are missing.
• Provided root CA file does not exist
• The config for the server private key fingerprint is not…
• The OpenPGP server key defined in the config cannot be used…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/65ff77cc2cb873ac. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/SmtpSettings/src/Service/SmtpSettingsSslOptionsGetService.php:83

        return $this->default;
    }

    /**
     * @return array
     * @thows BadRequestException Any configuration value set is not of valid type.
     */
    private function getConfigOptions(): array
    {
        $values = Configure::read('passbolt.plugins.smtpSettings.security', []);

        $form = new CustomSslOptionsForm();
        $valid = $form->validate($values);
        if (!$valid) {
            $errors = Hash::flatten($form->getErrors());
            $errorMessage = __('Invalid `passbolt.plugins.smtpSettings.security` configuration values.');
            $errorMessage .= ' ' . __('Errors: ') . implode('; ', $errors);

            throw new BadRequestException($errorMessage);
        }

        return $values;
    }

    /**
     * Checks if SSL options set in configuration are defaults.
     *
     * @param array $configOptions SSL options set in configuration.
     * @return bool
     */
    private function checkDefaultOptions(array $configOptions): bool
    {
        if (count($configOptions) !== 4) {
            $this->default = false;

            return false;
        }

View on GitHub (pinned to 31c1bbc10f)