Expected a public key but got a private key instead

[James]

Hi

I have a fresh install of Passbolt (2.0.4) on centos 7

Its installed and running fine.

I have run ./bin/cake passbolt install and followed the link provided for the admin user

I installed the plugin (both chrome and firefox) and…

1 Confirm the server key
2 Create new key
3 Set pass phrase
4 set token

However after this step i get a error message for a second before it jumps to the login path

I captured the output of the error message…

{
  "error": "error importing the server key : Expected a public key but got a private key instead",
  "setup": {
    "stepId": "login_redirection",
    "stepsHistory": "domain_check/define_key/secret/backup_key/security_token",
    "user": {
      "username": "****@**********.co.uk",
      "firstname": "********",
      "lastname": "***",
      "id": "c6c6dd5e-*****************************"
    },

}

and on the login screen i see this…

Have i done something wrong, can seem to find any documentation for this part?

Many thanks!

health check below…

 ____                  __          ____
/ __ \____  _____ ____/ /_  ____  / / /_
   / /_/ / __ `/ ___/ ___/ __ \/ __ \/ / __/
  / ____/ /_/ (__  |__  ) /_/ / /_/ / / /
 /_/    \__,_/____/____/_.___/\____/_/\__/

 Open source password manager for teams
---------------------------------------------------------------
 Healthcheck shell
---------------------------------------------------------------

 Environment

 [PASS] PHP version 7.2.5.
 [PASS] PCRE compiled with unicode support.
 [PASS] The temporary directory and its content are writable.
 [PASS] The public image directory and its content are writable.
 [PASS] The logs directory and its content are writable.
 [PASS] GD or Imagick extension is installed.
 [PASS] Intl extension is installed.
 [PASS] Mbstring extension is installed.

 Config files

 [PASS] The application config file is present
 [PASS] The passbolt config file is present

 Core config

 [FAIL] Debug mode is on.
  [HELP] Set debug = false; in config/passbolt.php
 [PASS] Cache is working.
 [PASS] Unique value set for security.salt
 [PASS] Full base url is set to **********
 [PASS] App.fullBaseUrl validation OK.
 [PASS] /healthcheck/status is reachable.

 SSL Certificate

 [PASS] SSL peer certificate validates
 [PASS] Hostname is matching in SSL certificate.
 [WARN] Using a self-signed certificate

 Database

 [PASS] The application is able to connect to the database
 [PASS] 18 tables found
 [PASS] Some default content is present
 [PASS] The database schema up to date.

 GPG Configuration

 [PASS] PHP GPG Module is installed and loaded.
 [PASS] The server gpg key is not the default one
 [PASS] The environment variable GNUPGHOME is set to /var/cache/nginx/.gnupg.
 [PASS] The directory /var/cache/nginx/.gnupg containing the keyring is writable by the webserver user.
 [PASS] The public key file is defined in config/passbolt.php and readable.
 [PASS] The private key file is defined in config/passbolt.php and readable.
 [PASS] The server key fingerprint matches the one defined in config/passbolt.php.
 [PASS] The server public key defined in the config/passbolt.php is in the keyring.
 [PASS] There is a valid email id defined for the server key.
 [PASS] The public key can be used to encrypt a message.
 [PASS] The public key can be used to sign a message.
 [PASS] The public key can be used to encrypt and sign a message.
 [PASS] The private key can be used to decrypt a message.
 [PASS] The private key can be used to decrypt and verify a message.
 [PASS] The public key can be used to verify a signature.

 Application configuration

 [FAIL] This installation is not up to date. Currently using 2.0.4 and it should be v2.0.5.
  [HELP] See. https://www.passbolt.com/help/tech/update
 [PASS] Passbolt is configured to force SSL use.
 [PASS] App.fullBaseUrl is set to HTTPS.
 [PASS] Selenium API endpoints are disabled.
 [PASS] Search engine robots are told not to index content.
 [PASS] Registration is closed, only administrators can add users.
 [PASS] Serving the compiled version of the javascript app
 [PASS] All email notifications will be sent.

  2 error(s) found. Hang in there!

[remy]

What do you see when you go to yourdomain.com/auth/verify.json ?
Do you see a GPG “-----BEGIN PGP PUBLIC KEY BLOCK-----” ?
Like: https://demo.passbolt.com/auth/verify.json

Is it possible that you inverted the private and public key on the server?

[James]

@remy

yourdomain.com/auth/verify.json

I see…

{
    "header": {
        "id": "****************************",
        "status": "success",
        "servertime": 1525776596,
        "title": "app_auth_verifyGet_success",
        "message": "The operation was successful.",
        "url": "\/auth\/verify.json",
        "code": 200
    },
    "body": {
        "fingerprint": "***************************************",
        "keydata": "-----BEGIN PGP PRIVATE KEY BLOCK-----\nVersion: GnuPG v2.0.22 ************************************************************************
**********************************************************************************
**********************************************************************************
*********************************************************************************
********************************************************************************
************************************************
*****************************\n-----END PGP PRIVATE KEY BLOCK-----\n"
    }
}

Thanks!

[remy]

Yes it should be a public key there. Check your server configuration (in config/passbolt.php), you inverted the keys.

'gpg' => [
            'serverKey' => [
                'fingerprint' => '....',
                'public' => ROOT . DS . 'config' . DS . 'gpg' . DS . 'unsecure.key',
                'private' => ROOT . DS . 'config' . DS . 'gpg' . DS . 'unsecure_private.key',
            ],
           ....
        ],

[James]

Thank you!

in my haste to install i’d just edited the previous command to save time but did this…

gpg --armor --export-secret-keys SERVER_KEY@EMAIL.TEST > /var/www/passbolt/config/gpg/serverkey.asc

Thanks for the pointer!