This key doesn’t match any account

Hi all:

our company use passbolt on one server for a long time, and it works well. Now i want to setup a another server, and run passbolt HA

i install the software on the new server, rsync the .gnupg directory, and dump the whole database to the new server

  1. sudo su -s /bin/bash -c “gpg --list-keys” nginx command shows the same result on both server;

  2. health check seems just fine;

  3. i can recover the account, until import the private key, it shows “this key doesn’t match any account”;

i also tried using new serverkey.asc/serverkey_private.asc and using files on the old server, neither of them works

what can i do next? or is there a HA or migration document there?

thanks !

You can search the community forum for similar error messages:

And more:
https://community.passbolt.com/search?q=this%20key%20doesn%E2%80%99t%20match%20any%20account

yes i have read all of them, and none of them seems to help
my health check output:
#######################################################
Environment

[PASS] PHP version 7.2.27.
[PASS] PCRE compiled with unicode support.
[PASS] The temporary directory and its content are writable.
[PASS] The public image directory and its content are writable.
[PASS] The logs directory and its content are writable.
[PASS] GD or Imagick extension is installed.
[PASS] Intl extension is installed.
[PASS] Mbstring extension is installed.

Config files

[PASS] The application config file is present
[PASS] The passbolt config file is present

Core config

[FAIL] Debug mode is on.
[HELP] Set debug = false; in config/passbolt.php
[PASS] Cache is working.
[PASS] Unique value set for security.salt
[PASS] Full base url is set to https://passbolt.sh.ubiquant
[PASS] App.fullBaseUrl validation OK.
[FAIL] Could not reach the /healthcheck/status with the url specified in App.fullBaseUrl
[HELP] Check that the domain name is correct in config/passbolt.php
[HELP] Check the network settings

SSL Certificate

[PASS] SSL peer certificate validates
[PASS] Hostname is matching in SSL certificate.
[WARN] Using a self-signed certificate

Database

[PASS] The application is able to connect to the database
[PASS] 18 tables found
[PASS] Some default content is present
[PASS] The database schema up to date.

GPG Configuration

[PASS] PHP GPG Module is installed and loaded.
[PASS] The environment variable GNUPGHOME is set to /var/lib/nginx/.gnupg.
[PASS] The directory /var/lib/nginx/.gnupg containing the keyring is writable by the webserver user.
[PASS] The server gpg key is not the default one
[PASS] The public key file is defined in config/passbolt.php and readable.
[PASS] The private key file is defined in config/passbolt.php and readable.
[PASS] The server key fingerprint matches the one defined in config/passbolt.php.
[PASS] The server public key defined in the config/passbolt.php is in the keyring.
[PASS] There is a valid email id defined for the server key.
[PASS] The public key can be used to encrypt a message.
[PASS] The private key can be used to sign a message.
[PASS] The public and private keys can be used to encrypt and sign a message.
[PASS] The private key can be used to decrypt a message.
[PASS] The private key can be used to decrypt and verify a message.
[PASS] The public key can be used to verify a signature.

Application configuration

[FAIL] Could not connect to passbolt repository to check versions. It is not possible check if your version is up to date.
[HELP] Check the network configuration to allow this script to check for updates.
[PASS] Passbolt is configured to force SSL use.
[PASS] App.fullBaseUrl is set to HTTPS.
[PASS] Selenium API endpoints are disabled.
[PASS] Search engine robots are told not to index content.
[PASS] Registration is closed, only administrators can add users.
[PASS] Serving the compiled version of the javascript app
[PASS] All email notifications will be sent.

3 error(s) found. Hang in there!
#######################################################
i put debug = true but i can not find the debug log

in code:
passbolt.request(‘passbolt.setup.checkKeyExistRemotely’, step.data.privateKeyInfo.fingerprint)
i just want to know how this function works, all the fingerprint in the new host are equal as the old one
thx!

is the domain name need to be the same?
old: passbolt.a.com
new: passbolt.b.com
is that ok?

Yes it should be fine. The issue is most likely with the keyring (for example the server not being able to import the user key in the keyring).

i install the latest version on the new server and sync these tables:
users roles groups groups_users secrets profiles resources permissions gpgkeys favorites comments
and it works…thx