phacility/phabricator · error · Exception

Keyring configuration is invalid: it describes multiple defa

Error message

Keyring configuration is invalid: it describes multiple default encryption keys. No more than one key may be the default key. Keys currently configured as defaults: %s.

What it means

While walking the keyring list, the validator collects names of entries with "default": true; if more than one accumulates, the config is rejected listing the offending names. PhabricatorKeyring::getDefaultKeyName() returns a single default, so an ambiguous default set is a configuration error, not a first-wins situation.

Source

Thrown at src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php:102

            throw new Exception(
              pht(
                'Keyring specifies an invalid key ("%s"): key material '.
                'should be 32 bytes (256 bits) but has length %s.',
                $name,
                new PhutilNumber(strlen($material))));
          }
          break;
        default:
          throw new Exception(
            pht(
              'Keyring configuration is invalid: it describes a key with '.
              'type "%s", but this type is unknown.',
              $type));
      }
    }

    if (count($defaults) > 1) {
      throw new Exception(
        pht(
          'Keyring configuration is invalid: it describes multiple default '.
          'encryption keys. No more than one key may be the default key. '.
          'Keys currently configured as defaults: %s.',
          implode(', ', $defaults)));
    }
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Keep exactly one default entry — the newest key — and remove "default": true (or set false) on all others
2. The message lists the current default names; use it to find the entries to edit

Example fix

// before
[
  {"name": "prod-2023", "type": "aes-256-cbc", "material.base64": "<OLD>", "default": true},
  {"name": "prod-2024", "type": "aes-256-cbc", "material.base64": "<NEW>", "default": true}
]

// after
[
  {"name": "prod-2023", "type": "aes-256-cbc", "material.base64": "<OLD>"},
  {"name": "prod-2024", "type": "aes-256-cbc", "material.base64": "<NEW>", "default": true}
]

$defaults = array();
foreach ($value as $spec) {
  if (idx($spec, 'default')) {
    $defaults[] = $spec['name'];
  }
}
if (count($defaults) > 1) {
  // Multiple defaults: " . implode(', ', $defaults) . " — keep exactly one.
}

When it happens

Trigger: Marking the new rotation key as default without removing the flag from the old one; merging two keyring configs where each had a default.

Common situations: Key rotation procedures that add a key and set default:true but forget to clear the previous entry's flag.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Keyring configuration is not valid: value must be a list of
• Keyring configuration is not valid: each entry in the list m
• Keyring configuration has an invalid key specification (at i
• Keyring configuration is invalid: it describes multiple keys
• Keyring specifies an invalid key ("%s"): key material should

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/69d779b50c80dc6f. Report an issue: GitHub.