Cloudflare configuration issue causing Chrome extension errors

Installation Issues
1

Checklist
I have read intro post: https://community.passbolt.com/t/about-the-installation-issues-category/12
I have read the tutorials, help and searched for similar issues
I provide relevant information about my server (component names and versions, etc.)
I provide a copy of my logs and healthcheck
I describe the steps I have taken to trouble shoot the problem
I describe the steps on how to reproduce the issue

Yes to all the above. I have been using Passbolt for years now and have not had any issues during reboots, restarts, etc.

all of a sudden this past week I had a power surge that killed power for hours and when everything came back up my Docker container for Passbolt failed to start. I was able to fix that issue but the Chrome extension no longer works. I even restored my SSL certs from cloudflare and still not working. I am at a loss to what the issue is. I have the newest version runnng as well.
If someone could shed some light on some more things to check.
I am behind a Zero trust setup with “NO TLS VERIFY” turned off because I route it correctly with the SSL certs something I did awhile ago which has always worked so not sure if thats an issue or not. (Doubt it)
I am also using a standard passbolt.php wth env variables for everything this way it stays cleaner so I shouldnt have to mess with any code or configs at all. I even tried spinning up a new instance and routing to another domain of mine and it does the same thing so I am missing something somewhere.

2

also to add to this, the IOS app says Http Forbidden now too. so I cannot access anything at this moment

4

Hello,

Thanks for reaching out. To be able to help you effectively, please provide the information listed in the installation issues checklist:

  • The output of the Passbolt healthcheck (/healthcheck/status.json)
  • Relevant logs from your server and/or container
  • Details about your environment (OS, Docker version, database, webserver, etc.)
  • The steps you have already tried to troubleshoot

Without this information, it’s unfortunately not possible for us to properly investigate your case.

Regarding your last comment: it was removed because spreading unfounded claims (such as “the community is dead” or “support has been dropped”) is not constructive. There are currently no other confirmed reports of a similar widespread issue, so this looks more like an environment or network-related problem rather than a Passbolt software issue. Still, we’re happy to look into it with the right diagnostic data.

Please keep discussions respectful and focused on solving the technical problem. If you’re willing to share the requested information, the community will gladly try to help.

Thank you for your understanding.

5

not sure why my account was restricted then deleted.

I am not here to put shame on anything I just need help. Not sure what else you need for information besides, i have now spun up 3 instances and all 3 do not work from any of my sources. This is in 3 different locations (physical and under different Cloudflare setups)
They are all experiencing the same thing, the system health check says its self assigned but its clearly not its got Orgin Certs from Cloudflare on it, My main one that I noticed the issue on was working until the reboot, which the reboot did trigger an update so its something on 5.4.1 thats doing it.

below is the health check,

Environment

[INFO] Linux 6dba3b05f0f8 5.15.0-151-generic #161-Ubuntu SMP Tue Jul 22 14:25:40 UTC 2025 x86_64 GNU/Linux
[PASS] PHP version 8.2.29.
[PASS] PHP version is 8.2 or above.
[PASS] 64-bit architecture system detected.
[INFO] gpg (GnuPG) 2.2.40 / libgcrypt 1.10.1
[PASS] PCRE compiled with unicode support.
[PASS] Mbstring extension is installed.
[PASS] Intl extension is installed.
[PASS] GD or Imagick extension is installed.
[PASS] The temporary directory and its content are writable and not executable.
[PASS] The logs directory /var/log/passbolt/ and its content are writable.
[WARN] System clock and NTP service information cannot be found.
[HELP] See timedatectl | grep -i -A 1 clock. More information: https://www.passbolt.com/docs/hosting/configure/ntp/

Config files

[PASS] The application config file is present
[PASS] The passbolt config file is present

Core config

[PASS] Cache is working.
[PASS] Debug mode is off.
[PASS] Unique value set for security.salt
[PASS] Full base url is set to
[PASS] App.fullBaseUrl validation OK.
[FAIL] Could not reach the /healthcheck/status with the url specified in App.fullBaseUrl
[HELP] Check that the domain name is correct in /etc/passbolt/passbolt.php
[HELP] Check the network settings

SSL Certificate

[WARN] SSL peer certificate does not validate.
[WARN] Hostname does not match when validating certificates.
[WARN] Using a self-signed certificate.
[HELP] Check https://help.passbolt.com/faq/hosting/troubleshoot-ssl

SMTP settings

[PASS] The SMTP Settings plugin is enabled.
[PASS] SMTP Settings coherent. You may send a test email to validate them.
[PASS] The SMTP Settings source is: database.
[WARN] The SMTP Settings plugin endpoints are enabled.
[HELP] It is recommended to disable the plugin endpoints.
[HELP] Set the PASSBOLT_SECURITY_SMTP_SETTINGS_ENDPOINTS_DISABLED environment variable to true.
[HELP] Or set passbolt.security.smtpSettings.endpointsDisabled to true in /etc/passbolt/passbolt.php.
[PASS] No custom SSL configuration for SMTP server.

JWT Authentication

[PASS] The JWT Authentication plugin is enabled.
[PASS] The /etc/passbolt/jwt/ directory is not writable.
[PASS] A valid JWT key pair was found.

GPG Configuration

[PASS] PHP GPG Module is installed and loaded.
[PASS] The environment variable GNUPGHOME is set to /var/lib/passbolt/.gnupg.
[PASS] The directory /var/lib/passbolt/.gnupg containing the keyring is writable by the webserver user.
[PASS] The server OpenPGP key is not the default one.
[PASS] The public key file is defined in /etc/passbolt/passbolt.php and readable.
[PASS] The private key file is defined in /etc/passbolt/passbolt.php and readable.
[PASS] The server key fingerprint matches the one defined in /etc/passbolt/passbolt.php.
[PASS] The server public key defined in the /etc/passbolt/passbolt.php (or environment variables) is in the keyring.
[PASS] There is a valid email id defined for the server key.
[PASS] The public key can be used to encrypt a message.
[PASS] The private key can be used to sign a message.
[PASS] The public and private keys can be used to encrypt and sign a message.
[PASS] The private key can be used to decrypt a message.
[PASS] The private key can be used to decrypt and verify a message.
[PASS] The public key can be used to verify a signature.
[PASS] The server public key format is Gopengpg compatible.
[PASS] The server private key format is Gopengpg compatible.

Application configuration

[PASS] Using latest passbolt version (5.4.1).
[FAIL] Passbolt is not configured to force SSL use.
[HELP] Set passbolt.ssl.force to true in /etc/passbolt/passbolt.php.
[PASS] App.fullBaseUrl is set to HTTPS.
[PASS] Selenium API endpoints are disabled.
[PASS] Search engine robots are told not to index content.
[INFO] The Self Registration plugin is enabled.
[INFO] Registration is closed, only administrators can add users.
[PASS] The deprecated self registration public setting was not found in /etc/passbolt/passbolt.php.
[WARN] Host availability checking is disabled.
[HELP] Make sure this instance is not publicly available on the internet.
[HELP] Or set the PASSBOLT_EMAIL_VALIDATE_MX environment variable to true.
[HELP] Or set passbolt.email.validate.mx to true in /etc/passbolt/passbolt.php.
[PASS] Serving the compiled version of the javascript app.
[WARN] Some email notifications are disabled by the administrator.
[PASS] The database schema is up to date.

Database

[PASS] The application is able to connect to the database
[PASS] 34 tables found.
[PASS] Some default content is present.

Metadata

[PASS] The server is able to decrypt the metadata private key.
[PASS] Active metadata key found or not required.
[PASS] The server has access to the metadata keys or does not require access to it.
[PASS] The server metadata private key is valid.

[FAIL] 2 error(s) found. Hang in there!

all 3 instances are showing this same thing, they are all running under a Docker Instance. I could also spin up a full server for it if need be just to test that as well, but it seems either something got broken in the latest update config wise thats preventing the browser extension to load correctly. If you need more logs please let me know. and again I apologize if I came off strong but I push this software to many of people and right now it seems every new install is breaking things so I am at a stand still and including my own environment being broke lol.

6

I am assuming here its something between Cloudflare and PassboltServer that is the issue but nothing changed on my end other than a server reboot, but again I spun this up at another location and the same issue is happening but they also use Cloudflare so again I think its an SSL issue between Cloudflare and the Passbolt server I just do not know where to look.
I have replaced the Certs wth new ones, I have even added a CA cert to the chain. On the New instances I used the passbolt.default.php and renamed to passbolt.php but I get as far as the extension loading and back to the same issue.
hope thats enough info if not please don’t hesitate to ask more.

7

It would be helpful to provide the Passbolt log output, the Docker run command, or the Compose file with environment variables… anything needed to try to reproduce the issue or check for any errors or misconfigurations.

Also, I’m assuming you’re using Cloudflare Tunneling. What about the Cloudflare logs? Are the containers visible to each other on the same Docker network?

It might be helpful to try running a local instance to check if the issue is with Passbolt or Cloudflare.

8

I didn’t find anything useful in Cloudflare logs honestly. The containers do see each other, they are not on the same docker network though because they are actually 2 different hosts, but I have policies on Local Firewall that allows that Cloudflared container to see all Docker Hosts and the networks. will see if I can get the cloudflare logs when I get back, Thanks for helping.

9

just updating this I spun up another instance just local using local ip to access it and it works fine. so its def something between Cloudflare and the passbolt instance thats causing the issue. I am also using a Self Assigned cert on the local instance.

10

Well.. I figured out the issue on Cloudflare’s Side the issue was somehow my rule for my API headers was blocking this not sure when that started happening, But I fixed it by changing that rule to spefic urls instead of all urls to my domain. Hope that makes sense… On a side not now im still stuck because I do not have the most recent password private key so it looks like I lost everything anyways unless someone knows how to recover this without this private key.
lesson learned i guess dont only backup your servers but backup keys too apparently because a reboot will break things. (as a side note my keys were on my storage server but they are not correct apparently as its not loading)
This can be closed. I was also able to get the recovery kit to work, durng the troubleshooting I forgot i did change the fingerprint on accident by updating certs so i reverted back to my old certs and that solved the issue. thanks.