passbolt/passbolt_api · critical · InvalidJwtKeyPairException

The JWT public key details could not be read.

Error message

The JWT public key details could not be read.

What it means

Thrown by JwksGetService::getDetails when the key parsed successfully but openssl_pkey_get_details() returns false, i.e. OpenSSL cannot extract the key's details (type, RSA components) needed to build the JWKS.

Solutions

1. Regenerate an RSA key pair with bin/cake passbolt create_jwt_keys
2. Confirm key type: openssl pkey -pubin -in config/jwt/jwt.public.key -text -noout (should show RSA)
3. Ensure the private/public pair matches (compare modulus hashes)
4. Check the PHP OpenSSL extension version supports the key format in use

Example fix

// before: EC or broken key
// after: regenerate RSA pair
bin/cake passbolt create_jwt_keys

$details = openssl_pkey_get_details(openssl_pkey_get_public(file_get_contents($path)));
if (($details['type'] ?? null) !== OPENSSL_KEYTYPE_RSA) throw new RuntimeException('JWT key must be RSA');

try { $size = $service->getSecretKeySize(); } catch (InvalidJwtKeyPairException $e) { regenerateRsaKeys(); }

When it happens

Trigger: getPublicKey or getSecretKeySize called when the loaded key resource yields no details — typically a non-RSA or unsupported key type parsed by openssl_pkey_get_public.

Common situations: JWT key pair generated with an unsupported algorithm/type (e.g. EC or Ed25519 where RSA is expected); OpenSSL version quirks; corrupted-but-parseable key material.

Related errors

• The JWT public key could not be extracted.
• Cannot parse JWKS endpoint response.
• Failed to public key properties from certificate
• Failed to read certificate
• Failed to read public key from certificate

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/18475ed711a7fbe8. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwksGetService.php:68

        $details = $this->getDetails();

        return $details['bits'] ?? 0;
    }

    /**
     * @return array
     * @throws \Passbolt\JwtAuthentication\Error\Exception\AccessToken\InvalidJwtKeyPairException if the public key file is not parsable.
     */
    private function getDetails(): array
    {
        $pubKey = $this->readKeyFileContent();
        $res = openssl_pkey_get_public($pubKey);
        if ($res === false) {
            throw new InvalidJwtKeyPairException(__('The JWT public key could not be extracted.'));
        }
        $details = openssl_pkey_get_details($res);
        if ($details === false) {
            throw new InvalidJwtKeyPairException(__('The JWT public key details could not be read.'));
        }

        return $details;
    }

    /**
     * @return string|false
     * @throws \Passbolt\JwtAuthentication\Error\Exception\AccessToken\InvalidJwtKeyPairException if the public key file is not found or not readable.
     */
    public function getRawPublicKey(): string|false
    {
        return $this->readKeyFileContent();
    }
}

View on GitHub (pinned to 31c1bbc10f)