phacility/phabricator · error · Exception

Keyring is configured with a "%s" key, but the PHP OpenSSL e

Error message

Keyring is configured with a "%s" key, but the PHP OpenSSL extension is not installed. Install the OpenSSL extension to enable encryption.

What it means

When a keyring entry declares type 'aes-256-cbc' but function_exists('openssl_encrypt') is false in the validating PHP process, the config is rejected: encryption requires the PHP OpenSSL extension, which is not loaded. This checks the actual runtime, not just configuration, because the key would be unusable otherwise.

Source

Thrown at src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php:65

      $name = $spec['name'];
      if (isset($map[$name])) {
        throw new Exception(
          pht(
            'Keyring configuration is invalid: it describes multiple keys '.
            'with the same name ("%s"). Each key must have a unique name.',
            $name));
      }
      $map[$name] = true;

      if (idx($spec, 'default')) {
        $defaults[] = $name;
      }

      $type = $spec['type'];
      switch ($type) {
        case 'aes-256-cbc':
          if (!function_exists('openssl_encrypt')) {
            throw new Exception(
              pht(
                'Keyring is configured with a "%s" key, but the PHP OpenSSL '.
                'extension is not installed. Install the OpenSSL extension '.
                'to enable encryption.',
                $type));
          }

          $material = $spec['material.base64'];
          $material = base64_decode($material, true);
          if ($material === false) {
            throw new Exception(
              pht(
                'Keyring specifies an invalid key ("%s"): key material '.
                'should be base64 encoded.',
                $name));
          }

          if (strlen($material) != 32) {

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Install the extension: apt-get install php-openssl (or your distro's equivalent), or uncomment extension=openssl / compile PHP with --with-openssl
2. Restart php-fpm and the web server after enabling, then verify with `php -m | grep openssl`
3. Confirm both SAPIs can see it: php -r 'var_dump(function_exists("openssl_encrypt"));' on web and CLI

Example fix

; before (php.ini)
; extension=openssl

; after
extension=openssl

# then restart the PHP process and verify
php -m | grep openssl

if (!function_exists('openssl_encrypt')) {
  // This PHP runtime cannot use aes-256-cbc keys; install/enable ext-openssl
  // before configuring encryption or setting files.default-format.
}

When it happens

Trigger: Setting the keyring on an install whose PHP lacks ext-openssl; CLI using a different php.ini than the web SAPI (openssl enabled for php-fpm but not php-cli, or vice versa); extension commented out or the package not installed.

Common situations: Minimal distro or hardened Docker PHP images that omit ext-openssl by default; upgrades that replaced php.ini and dropped extension=openssl; running bin/config on a different host class than the web nodes.

Related errors

• Failed to openssl_decrypt() data: %s
• The PHP 'openssl' extension is not installed. You must insta
• Before you can set up or use LDAP, you need to install the P
• Unable to imagesavealpha() a new empty image: %s
• Unable to imagecolorallocatealpha() a new empty image: %s

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/37dccae049f2646f. Report an issue: GitHub.