# Passbolt First Install : The OpenPGP server key defined in the config cannot be used to decrypt **URL:** \ **Category:** Installation Issues\ **Created:** [October 29, 2020, 12:57pm UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236 "2020-10-29T12:57:33Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![DaveG33](https://avatars.discourse-cdn.com/v4/letter/d/c77e96/32.png) [@DaveG33](https://community.passbolt.com/u/DaveG33)\ **Post date:** [October 29, 2020, 12:57pm UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/1 "2020-10-29T12:57:34Z")
Hi All, I’m attempting to install passbolt for testing but keep hitting a wall with the following error: ``` "Error: [Cake\Http\Exception\InternalErrorException] The OpenPGP server key defined in the config cannot be used to decrypt. Could not import the key. (/var/www/passbolt/src/Auth/GpgAuthenticate.php:284) Request URL: /auth/verify.json?api-version=v1" ``` I’ve read through similar experiences on this forum which were the result of incorrect GPG versions or keyfile references for GPG keys, both of which I think do not apply to my case. The build environment I’m using is: Virtual Machine Red Hat v7.9 Passbolt v2.12.1 (intended as I’d like to work with this previous version initially) gpg (GnuPG) v2.0.22 PHP v7.2.34 Following the build (which includes SELinux updates and 600 perms to “/usr/share/httpd/.gnupg/” I am able to register a new user and access the website but am presented with the following page when I attempt to login: ![passbolt_gpg_fail](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/1X/bcc354536ea475355fbb56f61ecaf9deb5bec8fe.png) When I inspect the GPG keys as the apache user I get the following: ``` [root@dev-passbolt passbolt]# su -s /bin/bash -c "gpg --list-keys --with-finger" apache /usr/share/httpd/.gnupg/pubring.gpg ----------------------------------- pub 2048R/EDC6CC8D 2020-10-29 Key fingerprint = E068 B649 F85B 8A3E 13F7 4EBF 2B03 4FA5 EDC6 CC8D uid dev-passbolt sub 2048R/0037CA8E 2020-10-29 [root@dev-passbolt passbolt]# su -s /bin/bash -c "gpg --list-secret-keys --with-finger" apache /usr/share/httpd/.gnupg/secring.gpg ----------------------------------- sec 2048R/EDC6CC8D 2020-10-29 Key fingerprint = E068 B649 F85B 8A3E 13F7 4EBF 2B03 4FA5 EDC6 CC8D uid dev-passbolt ssb 2048R/0037CA8E 2020-10-29 ``` Both keys were exported to the following files: ``` su -s /bin/bash -c "gpg --armor --export-secret-keys dev-passbolt@OMITTED > /var/www/passbolt/config/gpg/serverkey_private_ecc.asc" apache su -s /bin/bash -c "gpg --armor --export dev-passbolt@OMITTED > /var/www/passbolt/config/gpg/serverkey_ecc.asc" apache ``` and I compared that to the passbolt.php entry: ``` // Main server key. 'serverKey' => [ // Server private key fingerprint. 'fingerprint' => 'E068B649F85B8A3E13F74EBF2B034FA5EDC6CC8D', 'public' => CONFIG . 'gpg' . DS . 'serverkey_ecc.asc', 'private' => CONFIG . 'gpg' . DS . 'serverkey_private_ecc.asc', ``` I also ran the healthcheck which provides the following report: ![passbolt_health_2of2](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/1X/53f7e355cdd83d2119951451bfa1b520a06b2943.png) I’m at a bit of a loss and could use some guidance please. I’ll snapshot the current state and move on to building the latest release (using the installation scripts which are available instead of building from source-ish). Thanks in advance, Dave ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [October 29, 2020, 1:04pm UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/2 "2020-10-29T13:04:58Z")
Hi @DaveG33, ECC keys are not officially supported at the moment, it should work if you create a key with RSA algorithm. ---
**Author:** ![DaveG33](https://avatars.discourse-cdn.com/v4/letter/d/c77e96/32.png) [@DaveG33](https://community.passbolt.com/u/DaveG33)\ **Post date:** [October 29, 2020, 1:22pm UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/3 "2020-10-29T13:22:25Z")
Hi Remy, Thanks for your reply, somewhat oddly I believe I am using RSA keys: gpg --gen-key RSA and RSA 2048 I’ve just exported them to a confusingly named file which doesn’t represent the key type (in the vain hope of utilising the existing references in the passbolt.php file). Prior to this build attempt I’d exported them to two new files named private.key and public.key but the problem remained. Best, Dave ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [October 29, 2020, 2:20pm UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/4 "2020-10-29T14:20:46Z")
Hmm, that is strange. My guess is that there is an issue with gnupg operation from the context of the web server (apache or nginx). It works fine when you call it from PHP, so it could be maybe some SELinux policies for this context, or maybe the GNUPGHOME is different in this context. Can you try adding the following to rule the last one out: ```auto 'serverKey' => [ // add these 'keyring' => '/usr/share/httpd/.gnupg', 'putenv' => true, ``` ---
**Author:** ![DaveG33](https://avatars.discourse-cdn.com/v4/letter/d/c77e96/32.png) [@DaveG33](https://community.passbolt.com/u/DaveG33)\ **Post date:** [October 29, 2020, 3:02pm UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/5 "2020-10-29T15:02:33Z")
Thanks Remy, I tried as suggested and then created a new user but the same problem occured. Actions taken: 1. Updated passbolt.php: ‘passbolt’ =\> [ ‘gpg’ =\> [ ‘keyring’ =\> ‘/usr/share/httpd/.gnupg’, ‘putenv’ =\> true, // Main server key. ‘serverKey’ =\> [ // Server private key fingerprint. ‘fingerprint’ =\> ‘E068B649F85B8A3E13F74EBF2B034FA5EDC6CC8D’, ‘public’ =\> CONFIG . ‘gpg’ . DS . ‘serverkey\_ecc.asc’, ‘private’ =\> CONFIG . ‘gpg’ . DS . ‘serverkey\_private\_ecc.asc’, ], ], ], 2. Created a new user: su -s /bin/bash -c “./bin/cake passbolt register\_user -u [test@test.com](mailto:test@test.com) -f test -l test” apache 3. Followed the URL provided from Step2 to complete the user setup, defined a password and backed up the GPG user key to be redirected to the https://\<\>/auth/login page for Passbolt and receive the “Could not verify server key. The OpenPGP server key defined in the config cannot be used to decrypt. Could not import the key.” error - the same error is produced in the passbolt/logs/error.log file too. The SELinux contexts I added (which I didn’t share in my OP) were: \> semanage fcontext -a -t httpd\_sys\_rw\_content\_t ‘/usr/share/httpd/.gnupg(/._)?’ \> restorecon -Rv /usr/share/httpd/.gnupg \> semanage fcontext -a -t httpd\_sys\_rw\_content\_t '/var/www/passbolt/tmp(/._)?’ \> semanage fcontext -a -t httpd\_sys\_rw\_content\_t “/var/www/passbolt/webroot/img/public(/.\*)?” \> restorecon -Rv /var/www/passbolt/ \> setsebool -P httpd\_can\_network\_connect 1 Thanks again for your help, still puzzling this one out. Best, Dave ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [October 29, 2020, 3:54pm UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/6 "2020-10-29T15:54:18Z")
Summoning @diego, who did manage to make it run on RHEL a while back. ---
**Author:** ![DaveG33](https://avatars.discourse-cdn.com/v4/letter/d/c77e96/32.png) [@DaveG33](https://community.passbolt.com/u/DaveG33)\ **Post date:** [November 2, 2020, 8:42am UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/7 "2020-11-02T08:42:57Z")
Thanks Remy, Best, Dave ---
**Author:** ![diego](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/diego/32/16_2.png) [@diego](https://community.passbolt.com/u/diego)\ **Post date:** [November 3, 2020, 9:42am UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/8 "2020-11-03T09:42:43Z")
Sorry for the late reply I will try to reproduce locally today. ---
**Author:** ![DaveG33](https://avatars.discourse-cdn.com/v4/letter/d/c77e96/32.png) [@DaveG33](https://community.passbolt.com/u/DaveG33)\ **Post date:** [November 3, 2020, 11:04am UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/9 "2020-11-03T11:04:54Z")
Hi diego, No problem - I’ve solved it! 🙂 The issue was SElinux contexts, the following describes the contexts that worked: # correct SELinux contexts on new files and dirs: ``` > semanage fcontext -a -t httpd_sys_rw_content_t '/usr/share/httpd/.gnupg(/.*)?' > restorecon -Rv /usr/share/httpd/.gnupg > semanage fcontext -a -t httpd_sys_content_t '/var/www/passbolt/(/.*)?' > semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/passbolt/tmp(/.*)?' > semanage fcontext -a -t httpd_sys_content_t '/var/www/passbolt/app/tmp(/.*)?' > semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/passbolt/webroot/img/public(/.*)?" > restorecon -Rv /var/www/passbolt/ > setsebool -P httpd_can_network_connect 1 ``` Thanks both for your help in this one, much appreciated. Dave ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/b/bee7d3f9329f668000d46e9fcb2e5db1e9d31348.svg) [@system](https://community.passbolt.com/u/system)\ **Post date:** [November 8, 2020, 11:04am UTC](https://community.passbolt.com/t/passbolt-first-install-the-openpgp-server-key-defined-in-the-config-cannot-be-used-to-decrypt/3236/10 "2020-11-08T11:04:58Z")
This topic was automatically closed 5 days after the last reply. New replies are no longer allowed.