passbolt/passbolt_api · error · InternalErrorException

The OpenPGP server key cannot be used to decrypt the SMTP…

Error message

The OpenPGP server key cannot be used to decrypt the SMTP settings stored in database.

What it means

Thrown by SmtpSettingsGetSettingsInDbService::decrypt when the OpenPGP server key is correctly set up, but decryption of the SMTP settings blob stored in organization_settings still fails. The stored ciphertext was encrypted with a different/rotated server key (or is corrupted), so the current key cannot open it; passbolt raises HTTP 500 and advises re-configuring the SMTP server.

Solutions

1. Re-configure the SMTP settings (admin UI SMTP settings page or POST /smtp/settings) so the payload is re-encrypted with the current server key — this is the fix the error message itself recommends
2. Verify which key encrypted the data: compare the current `passbolt.gpg.serverKey.fingerprint` with the one used when settings were saved; restore the old key into the keyring if you still have it
3. If the old key is lost, delete the stale row (organization_settings where property = 'smtp') so the app falls back to file-based SMTP config, then re-save settings from the UI
4. Corruption check: re-export the organization_settings row and confirm the ASCII-armored PGP block is complete (begins with -----BEGIN PGP MESSAGE----- and ends properly) before assuming key mismatch

Example fix

-- before
SELECT * FROM organization_settings WHERE property = 'smtp'; -- stale ciphertext from old key
-- after (re-save via UI, or clear so file config is used)
DELETE FROM organization_settings WHERE property = 'smtp';
-- then POST /smtp/settings or use the admin UI to re-encrypt with the current server key

try {
    (new SmtpSettingsGetSettingsInDbService())->getSettings();
} catch (\Cake\Http\Exception\InternalErrorException $e) {
    if (str_contains($e->getMessage(), 'cannot be used to decrypt the SMTP settings')) {
        // stale ciphertext: settings must be re-saved or cleared
    }
}

function isStaleSmtpCiphertext(\Cake\Http\Exception\InternalErrorException $e): bool
{
    return str_contains($e->getMessage(), 'SMTP settings stored in database');
}

try {
    $settings = $this->SmtpSettingsGetSettingsInDb->getSettings();
} catch (\Cake\Http\Exception\InternalErrorException $e) {
    $this->log('SMTP settings in DB are undecryptable, falling back to file config: ' . $e->getMessage());
    $settings = null; // app falls back to passbolt.emailTransports in config files
}

When it happens

Trigger: Reading SMTP settings from the DB (GET /smtp/settings, health checks, test email) after the server OpenPGP key was regenerated or replaced since the settings were saved; the organization_settings.value was copied from another instance encrypted with a different key; the stored value is truncated or otherwise corrupted.

Common situations: Server key rotation without re-saving SMTP settings; restoring a database dump from instance A onto instance B whose server keys differ; Docker/VM rebuilds where keys are regenerated on startup; manual edits or partial imports of the organization_settings table.

Related errors

• The OpenPGP server key defined in the config cannot be used…
• The challenge cannot be decrypted.
• The OpenPGP server key defined in the config cannot be used…
• The SCIM settings could not be decrypted with the server…
• The SSO setting cannot be decrypted.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/971b7892201ff199. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/SmtpSettings/src/Service/SmtpSettingsGetSettingsInDbService.php:128

            $gpg->setDecryptKeyFromFingerprint($keyFingerprint, $passphrase);
        } catch (CakeException $exception) {
            try {
                $gpg->importServerKeyInKeyring();
                $gpg->setDecryptKeyFromFingerprint($keyFingerprint, $passphrase);
            } catch (CakeException $exception) {
                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';
                $msg .= $exception->getMessage();
                throw new InternalErrorException($msg);
            }
        }

        try {
            return $gpg->decrypt($encryptedValue);
        } catch (Throwable $e) {
            $msg = __('The OpenPGP server key cannot be used to decrypt the SMTP settings stored in database.');
            $msg .= ' ' . __('To fix this problem, you need to configure the SMTP server again.') . ' ';
            $msg .= $e->getMessage();
            throw new InternalErrorException($msg, 500, $e);
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)