# This key does not match any account

**URL:** <https://community.passbolt.com/t/this-key-does-not-match-any-account/5587>\
**Category:** Installation Issues\
**Created:** [July 15, 2022, 1:18pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587 "2022-07-15T13:18:07Z")\
**Posts on this page:** 12\
**Page:** 2

<div class="post-metadata">

**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\
**Post date:** [July 20, 2022, 4:59pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/22 "2022-07-20T16:59:34Z")

</div>

@gewurzt The private key for the user is unique and should not be the private key for the server. The public key(s) for the user(s) are found in the server db and server keyring but the private key for a user is not stored on the server. It must be kept safe by the user after it’s created for them to download in the setup process.

---

<div class="post-metadata">

**Author:** ![gewurzt](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gewurzt](https://community.passbolt.com/u/gewurzt)\
**Post date:** [July 20, 2022, 5:31pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/23 "2022-07-20T17:31:48Z")

</div>

Hi @garrett,  
Thanks for your quick answer.  
I confirm the user key is not the server key. The server key is 3072bits and the user key is 2048bits.  
May be you got confused because I obfuscated my server key id by the same way in another of my post. Sorry about that.

> $ gpg --list-keys  
> /home/www-data/.gnupg/pubring.kbx  
> ---------------------------------  
> → this is the server key  
> pub rsa3072 2019-09-28 [SC]  
> uid [ultime] Passbolt server [admin@mail.com](mailto:admin@mail.com)  
> sub rsa3072 2019-09-28 [E]

→ this is the user key

> pub rsa2048 2019-10-02 [SC]  
> XXXXXXXXXXXXXXXXXXXXXXXX0123456789ABCDEF  
> uid [ultime] My user [my@mail.com](mailto:my@mail.com)  
> sub rsa2048 2019-10-02 [E]

The user key found in the server keyring contains only the public key, which I find normal.  
As a proof of that, I can export the public key from the keyring :

> $ gpg --export --armor XXXXXXXXXXXXXXXXXXXXXXXX0123456789ABCDEF  
> -----BEGIN PGP PUBLIC KEY BLOCK-----
> 
> […]  
> -----END PGP PUBLIC KEY BLOCK-----

But not the private key :

> $ gpg --export-secret-key --armor XXXXXXXXXXXXXXXXXXXXXXXX0123456789ABCDEF  
> gpg: Attention : rien n’a été exporté

(btw, now you now I’m French 😉 )

Thanks.

---

<div class="post-metadata">

**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\
**Post date:** [July 20, 2022, 6:30pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/24 "2022-07-20T18:30:37Z")

</div>

I am able to get the error `This key does not match any account` if the related `.gnupg` folders for the webserver user is not properly permissioned. Maybe check ownership permissions. For example, if the directory looks like:

```auto
root@server:/home/www-data/.gnupg# ll
total 56
drwx------ 4 www-data www-data 4096 Jul 20 14:27 ./
drwxr-xr-x 3 www-data www-data 4096 Dec 21 2021 ../
drwx------ 2 www-data www-data 4096 Dec 20 2021 openpgp-revocs.d/
drwx------ 2 root root 4096 Dec 20 2021 private-keys-v1.d/
-rw-rw-r-- 1 www-data www-data 15110 Dec 20 2021 pubring.kbx
-rw-rw-r-- 1 www-data www-data 13739 Dec 20 2021 pubring.kbx~
-rw------- 1 www-data www-data 600 Jul 19 17:31 random_seed
srwx------ 1 www-data www-data 0 Jul 17 18:23 S.gpg-agent=
srwx------ 1 www-data www-data 0 Jul 17 18:23 S.gpg-agent.browser=
srwx------ 1 www-data www-data 0 Jul 17 18:23 S.gpg-agent.extra=
srwx------ 1 www-data www-data 0 Jul 17 18:23 S.gpg-agent.ssh=
-rw------- 1 www-data www-data 1280 Dec 20 2021 trustdb.gpg

```

They were all owned by www-data before I modified for the example.

---

<div class="post-metadata">

**Author:** ![gewurzt](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gewurzt](https://community.passbolt.com/u/gewurzt)\
**Post date:** [July 20, 2022, 10:24pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/25 "2022-07-20T22:24:20Z")

</div>

Thanks for for time. I have already checked that, unfortunately, I don’t see any issues with the ownership :

```auto
> root@server:/home/www-data/.gnupg# ls -al
> total 104
> drwx------ 3 www-data www-data 4096 juil. 21 00:03 .
> drwxr-xr-x 7 www-data www-data 4096 juil. 18 15:34 ..
> drwx------ 2 www-data www-data 4096 sept. 28 2019 private-keys-v1.d
> -rw-r--r-- 1 www-data www-data 6604 juil. 18 16:18 pubring.kbx
> -rw-r--r-- 1 www-data www-data 4685 juil. 18 16:18 pubring.kbx~
> -rw------- 1 www-data www-data 600 juil. 20 20:26 random_seed
> srwx------ 1 www-data www-data 0 juil. 19 10:45 S.gpg-agent
> srwx------ 1 www-data www-data 0 juil. 19 10:45 S.gpg-agent.browser
> srwx------ 1 www-data www-data 0 juil. 19 10:45 S.gpg-agent.extra
> srwx------ 1 www-data www-data 0 juil. 19 10:45 S.gpg-agent.ssh
> -rw-r--r-- 1 www-data www-data 49152 sept. 28 2021 tofu.db
> -rw------- 1 www-data www-data 1440 juil. 13 17:44 trustdb.gpg

```

Besides from that, the server is working fine and I can access my passwords with a previously configured laptop.  
I’ve also tried to re-export my private key from the web ui and it matches perfectly the one I used to configure the new laptop.

One thing that has been bugging me is that the public key in the keyring is different from the public key recorded in the gpgkeys table for my user. Yet, if I save the key recorded in the table to a file and ask for its keyid (with gpg --list-packets), it is the same as the one in the keyring. Since I am not a gpg expert, is that normal ?  
Apart from that, the other fields in the database seem ok. And if they weren’t, I wouldn’t be able to use the account on my previous laptop, would I ?

---

<div class="post-metadata">

**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\
**Post date:** [July 21, 2022, 12:49am UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/26 "2022-07-21T00:49:29Z")

</div>

> [@gewurzt](#):
>
> One thing that has been bugging me is that the public key in the keyring is different from the public key recorded in the gpgkeys table for my user. Yet, if I save the key recorded in the table to a file and ask for its keyid (with gpg --list-packets), it is the same as the one in the keyring. Since I am not a gpg expert, is that normal ?

This is okay. It’s probably pretty much the same in the middle of it. There are probably minor differences in the beginning or end, but the fingerprint should be the same.

> [@gewurzt](#):
>
> Apart from that, the other fields in the database seem ok. And if they weren’t, I wouldn’t be able to use the account on my previous laptop, would I ?

That’s correct. At this point, don’t get rid of your laptop! 🙂

What version gpg are you running? Mine:

```auto
sudo su -s /bin/bash -c "gpg --home=/home/www-data/.gnupg --version" www-data
gpg (GnuPG) 2.2.19
libgcrypt 1.8.5
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/www-data/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

```

Also, what browser/version are you running? Can you also verify extension version?

---

<div class="post-metadata">

**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\
**Post date:** [July 21, 2022, 1:24am UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/27 "2022-07-21T01:24:51Z")

</div>

> [@gewurzt](#):
>
> One final thing I noticed : with a packet capture on the server (tshark), I can see that the error message appears right away : there is no communication between the client and the server when I click on “Next”. Is this the expected behaviour ?

Regarding this, you can debug the extension:  
On Chrome:  
New tab \> go to chrome://extensions \> look for passbolt card \> (click Developer Mode if not enabled) \> details \> inspect views section \> click index.html \> unfold and copy errors under console tab

On Firefox:  
New tab \> go to about:debugging#/runtime/this-firefox \> look for passbolt card \> Click inspect \> unfold and copy errors under console tab

You should see something like  
 ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/9/972657da5c3d4b9a857cbdf1dbe9511d2f43c95e.png)

And a call in the NGINX logs showing `POST /auth/verify.json?api-version=v2`

---

<div class="post-metadata">

**Author:** ![gewurzt](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gewurzt](https://community.passbolt.com/u/gewurzt)\
**Post date:** [July 21, 2022, 8:14am UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/28 "2022-07-21T08:14:31Z")

</div>

> [@garrett](#):
>
> What version gpg are you running?

I have the same result as you :

```auto
$ sudo su -s /bin/bash -c "gpg --home=/home/www-data/.gnupg --version" www-data
gpg (GnuPG) 2.2.19
libgcrypt 1.8.5
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/www-data/.gnupg
Algorithmes pris en charge :
Clef publique : RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Chiffrement : IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256,
              TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256
Hachage : SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression : Non compressé, ZIP, ZLIB, BZIP2

```

> [@garrett](#):
>
> Also, what browser/version are you running? Can you also verify extension version?

I’m using Firefox with extension v3.6.2 on Firefox 102.0 (64 bits) :

```auto
## [3.6.2] - 2022-06-03
### Improved
- PB-16651 As LU I want to get a clear message if I enroll to a disabled account recovery program
- PB-15677 As LU I want to see openpgp assertions messages translated into my language

### Fixed
- PB-16736 Fix as AN I can accept a new server key([GITHUB-150]([https://github.com/passbolt/passbolt_browser_extension/issues/150](https://outgoing.prod.mozaws.net/v1/dfe26e176d5324fd99bffc61d979a5515ffe8210aa2d1bea07d7bc5960c04010/https%3A//github.com/passbolt/passbolt_browser_extension/issues/150)))

```

> [@garrett](#):
>
> Regarding this, you can debug the extension:

Yes, I see a GpgKeyError :

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/7/7c5337388ca6d7f9966bfd1db4de3691b890e26e.png)

> [@garrett](#):
>
> And a call in the NGINX logs showing `POST /auth/verify.json?api-version=v2`

No, I don’t see any POST, neither in the debug console nor in the logs and neither before the GpgKeyError nor after. My webserver is Apache v2.4.41.

```auto
$ apache2 -v
Server version: Apache/2.4.41 (Ubuntu)
Server built: 2022-06-14T13:30:55

```

Below are the logs. These logs appear when the recovery page loads. There is nothing afterwards :

```auto
192.168.1.64 - - [21/Jul/2022:11:53:57 +0200] "GET /setup/recover/x-x-x-x-x/x-x-x-x-x?case=default HTTP/1.1" 200 2737 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"
192.168.1.64 - - [21/Jul/2022:11:53:58 +0200] "GET /js/app/api-recover.js?v=3.6.0 HTTP/1.1" 200 36999 "https://passbolt.domain.com/setup/recover/x-x-x-x-x/x-x-x-x-x?case=default" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0" 
192.168.1.64 - - [21/Jul/2022:11:53:58 +0200] "GET /settings.json?api-version=v2 HTTP/1.1" 200 2617 "https://passbolt.domain.com/setup/recover/x-x-x-x-x/x-x-x-x-x?case=default" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0" 
192.168.1.64 - - [21/Jul/2022:11:53:58 +0200] "GET /users/csrf-token.json?api-version=v2 HTTP/1.1" 200 1966 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"
192.168.1.64 - - [21/Jul/2022:11:53:58 +0200] "GET /settings.json?api-version=v2 HTTP/1.1" 200 2293 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"
192.168.1.64 - - [21/Jul/2022:11:53:59 +0200] "GET /auth/verify.json?api-version=v2 HTTP/1.1" 200 4114 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"
192.168.1.64 - - [21/Jul/2022:11:53:59 +0200] "GET /setup/recover/start/x-x-x-x-x/x-x-x-x-x.json?api-version=v2 HTTP/1.1" 200 2438 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"
192.168.1.64 - - [21/Jul/2022:11:53:59 +0200] "GET /setup/recover/x-x-x-x-x/x-x-x-x-x.json?api-version=v2 HTTP/1.1" 200 2431 "https://passbolt.domain.com/setup/recover/x-x-x-x-x/x-x-x-x-x?case=default" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"

```

Hope this helps.

---

<div class="post-metadata">

**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\
**Post date:** [July 21, 2022, 12:36pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/29 "2022-07-21T12:36:36Z")

</div>

@gewurzt Here is the relevant extension code [passbolt\_browser\_extension/importRecoverPrivateKeyController.js at f66ca3f5a440c5b6bd1288ca69ec79016a891d72 · passbolt/passbolt\_browser\_extension · GitHub](https://github.com/passbolt/passbolt_browser_extension/blob/f66ca3f5a440c5b6bd1288ca69ec79016a891d72/src/all/background_page/controller/recover/importRecoverPrivateKeyController.js)

It suggests that the message is generic at the moment but a timeout or failed call will produce this result, as you are describing.

Since you are attempting to establish connection on a new machine I think reinstalling the extension is a next step.

If that does not work and you are open to it, try installing the extension on Chrome or Edge to see if you can get past this point. I normally use FF but my extension was installed already. Chrome was working on for me yesterday.

My other thought is what other extension (or something in the network) might be interfering.

---

<div class="post-metadata">

**Author:** ![gewurzt](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gewurzt](https://community.passbolt.com/u/gewurzt)\
**Post date:** [July 21, 2022, 1:57pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/30 "2022-07-21T13:57:37Z")

</div>

> [@garrett](#):
>
> @gewurzt Here is the relevant extension code [https://github.com/passbolt/passbolt\_browser\_extension/blob/f66ca3f5a440c5b6bd1288ca69ec79016a891d72/src/all/background\_page/controller/recover/importRecoverPrivateKeyController.js](https://github.com/passbolt/passbolt_browser_extension/blob/f66ca3f5a440c5b6bd1288ca69ec79016a891d72/src/all/background_page/controller/recover/importRecoverPrivateKeyController.js)
> 
> It suggests that the message is generic at the moment but a timeout or failed call will produce this result, as you are describing.

Thanks for pointing to the code. I’m not a dev so I apologize in advance for any clumsiness.  
Am I right in assuming that  
`this.legacyAuthModel.verify(domain, serverPublicArmoredKey, fingerprint);`  
should be calling GpgAuth.verify here : [https://github.com/passbolt/passbolt\_browser\_extension/blob/73c06104b159fb0ba6d2450516754881007ff75d/src/all/background\_page/model/gpgauth.js](https://github.com/passbolt/passbolt_browser_extension/blob/73c06104b159fb0ba6d2450516754881007ff75d/src/all/background_page/model/gpgauth.js)  
And since all errors are handled in there and I don’t get any of them, GpgAuth.verify is somehow not called ?

> [@garrett](#):
>
> Since you are attempting to establish connection on a new machine I think reinstalling the extension is a next step.

It unfortunately gives the same result : error right away after Next and no POST.

> [@garrett](#):
>
> If that does not work and you are open to it, try installing the extension on Chrome or Edge to see if you can get past this point. I normally use FF but my extension was installed already. Chrome was working on for me yesterday.

Chrome (freshly installed with .deb file) gives the same error and no POST.

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/b/b75be399791e63ddaf70abc52586fd2e00ca0304.png)

> [@garrett](#):
>
> My other thought is what other extension (or something in the network) might be interfering.

Since Chrome was freshly installed, Passbolt is the only extension in there ☹

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/a/a2d1480a8a88e5dc722934e95cba0fd25c8311d1.png)

The new laptop is on the same LAN as the server, so nothing in between, no iptables rules…

According to my records, the last time I imported successfully the key on a new computer was in May 2021. Would something have changed on this recovery part since then, on the server or on the extension ?

---

<div class="post-metadata">

**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\
**Post date:** [July 21, 2022, 2:35pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/31 "2022-07-21T14:35:56Z")

</div>

@gewurzt If the private key was in bad format it would catch that and tell you, so I believe it attempts to make the call at the bottom of the page of that linked code… but cannot, and returns the error.

Can you try Chrome on the old laptop and see if that works?

---

<div class="post-metadata">

**Author:** ![gewurzt](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gewurzt](https://community.passbolt.com/u/gewurzt)\
**Post date:** [July 21, 2022, 6:12pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/32 "2022-07-21T18:12:16Z")

</div>

> [@garrett](#):
>
> Can you try Chrome on the old laptop and see if that works?

Nope, still the same error without POST.

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/3/359a973d95d24f81a2c50d0efd4ff5c59f30bce7.png)

I’ve also tried with FF on the old laptop, after having logged out, same error ☹

---

<div class="post-metadata">

**Author:** ![gewurzt](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gewurzt](https://community.passbolt.com/u/gewurzt)\
**Post date:** [July 21, 2022, 10:24pm UTC](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587/33 "2022-07-21T22:24:13Z")

</div>

Thanks to @garrett hard work, we’ve figured out that :

- the server key in keyring matched the server key used by passbolt,
- but the server key used by passbolt was expired
- althought the server key was expired, logging in the extension and using it was still operational

You can see how I checked the server key files and renewed them in this post :

> [@Could not enroll user on Android app](https://community.passbolt.com/t/could-not-enroll-user-on-android-app/5608/2):
>
> Thanks to @garrett advices in another thread, I figured the keys in the files used by the server were expired : root@server:~# gpg --list-packets /var/www/passbolt/config/gpg/serverkey.asc # off=0 ctb=99 tag=6 hlen=3 plen=397 :public key packet: version 4, algo 1, created 1569702234, expires 0 pkey[0]: [3072 bits] pkey[1]: [17 bits] keyid: xx # off=400 ctb=b4 tag=13 hlen=2 plen=21 :user ID packet: xx # off=423 ctb=89 tag=2 hlen=3 plen=468 :signature packet: algo 1, keyid xx version 4…

[Previous page](https://community.passbolt.com/t/this-key-does-not-match-any-account/5587.md?page=1)