# V2 Update issues. Server Key not loading. Healthcheck says keys are fine, but other things broken

**URL:** <https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662>\
**Category:** Installation Issues\
**Created:** [May 11, 2018, 8:28pm UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662 "2018-05-11T20:28:07Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![cinderblock](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cinderblock/32/201_2.png) [@cinderblock](https://community.passbolt.com/u/cinderblock)\
**Post date:** [May 11, 2018, 8:28pm UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/1 "2018-05-11T20:28:07Z")

</div>

This is a repost of a question that I incorrectly concluded was related to a previously asked question: [Site not loading post 1.6.10 to 2.0.5 upgrade - #14 by brenakPB](https://community.passbolt.com/t/site-not-loading-post-1-6-10-to-2-0-5-upgrade/653/14)

I followed the upgrade instructions to go from v1 to v2. I was on 1.6.9 before the upgrade but followed the v1 minor update procedure to 1.6.10 before trying v2 updates.

For completeness, here are all the steps I took, with extra steps I determined I needed to take with reasons. Most of these commands were actually run as passbolt user: `sudo -iu passbolt-src`

- Take site offline with nginx config
- Move old v1 folder to `/var/lib/passbolt.v1`
- Create new user to own passbolt source `passbolt-src` (v1 was installed as `root`)
- `git clone` …
- Upgrade to php7 (from 5.4)
- `composer install`
- `cp -R ../passbolt.v1/app/webroot/img/public/* webroot/img/public/`
- `mv webroot/img/public/images/{Profile,}Avatar`
- `cp ../passbolt.v1/app/Config/gpg/* config/gpg/`
- `cp config/passbolt.{default.,}php`
- `vim config/passbolt.php`
  - Application URL
  - database user & password
  - email settings
  - OpenPGP fingerprint. This is the first confusion I faced. `app/Config/default.php` had one fingerprint and `app/Config/app.php` had a different one. I assume the latter is the correct one.

- `bin/cake passbolt migrate --backup`
- Re-enable nginx
- `bin/cake passbolt healthcheck`

```plaintext
[FAIL] The public key file is not defined in config/passbolt.php or not readable.
 [HELP] Ensure the public key file is defined by the variable passbolt.gpg.serverKey.public in config/passbolt.php.
 [HELP] Ensure the public key defined in config/passbolt.php exists and is accessible by the webserver user.
 [HELP] See. https://www.passbolt.com/help/tech/install#toc_gpg
[FAIL] The public key file is not defined in config/passbolt.php or not readable.
 [HELP] Ensure the private key file is defined by the variable passbolt.gpg.serverKey.private in config/passbolt.php.
 [HELP] Ensure the private key defined in config/passbolt.php exists and is accessible by the webserver user.
 [HELP] See. https://www.passbolt.com/help/tech/install#toc_gpg
[FAIL] The server key fingerprint doesn't match the one defined in config/passbolt.php.
 [HELP] Double check the key fingerprint, example:
 [HELP] sudo su -s /bin/bash -c "gpg --list-keys --fingerprint --home /var/www/passbolt/.gnupg" passbolt-src | grep -i -B 2 'SERVER_KEY_EMAIL'
 [HELP] SERVER_KEY_EMAIL: The email you used when you generated the server key.
 [HELP] See. https://www.passbolt.com/help/tech/install#toc_gpg
[PASS] The server public key defined in the config/passbolt.php is in the keyring.
[FAIL] The server key does not have a valid email id.
 [HELP] Edit or generate another key with a valid email id.

```

- `cp -R /root/.gnupg ~/` I actually copied the `.gnupg` folder out of `/root` separately so that permissions wouldn’t be an issue. This is the main step that I’m not 100% confident about but it seems to have fixed the GPG configuration issues. Regardless, once that is fixed, I still have the same `healthcheck` issues:

```plaintext
cameron@server /var/www/passbolt $ sudo -u passbolt-src bin/cake passbolt healthcheck

     ______  ____
    / __\____  _________ / /_ ____ / / /_
   / /_/ / __`/___ / ___/__ \/ __\/ /__ /
  / ____/ /_/ (__ |__ ) /_/ / /_/ / / /
 /_/ \ __,_/____ / ____/_.___ /\ ____/_/\__ /

 Open source password manager for teams
---------------------------------------------------------------
 Healthcheck shell
---------------------------------------------------------------

 Environment

 [PASS] PHP version 7.0.29.
 [PASS] PCRE compiled with unicode support.
 [PASS] The temporary directory and its content are writable.
 [PASS] The public image directory and its content are writable.
 [PASS] The logs directory and its content are writable.
 [PASS] GD or Imagick extension is installed.
 [PASS] Intl extension is installed.
 [PASS] Mbstring extension is installed.

 Config files

 [PASS] The application config file is present
 [PASS] The passbolt config file is present

 Core config

 [PASS] Debug mode is off.
 [PASS] Cache is working.
 [PASS] Unique value set for security.salt
 [PASS] Full base url is set to https://passbolt.domain.com
 [PASS] App.fullBaseUrl validation OK.
 [FAIL] Could not reach the /healthcheck/status with the url specified in App.fullBaseUrl
  [HELP] Check that the domain name is correct in config/passbolt.php
  [HELP] Check the network settings

 SSL Certificate

 [FAIL] SSL peer certificate does not validate
 [FAIL] Hostname does not match when validating certificates.
 [WARN] Using a self-signed certificate

 Database

 [PASS] The application is able to connect to the database
 [PASS] 19 tables found
 [PASS] Some default content is present
 [PASS] The database schema up to date.

 GPG Configuration

 [PASS] PHP GPG Module is installed and loaded.
 [PASS] The server gpg key is not the default one
 [PASS] The environment variable GNUPGHOME is set to /var/www/passbolt/.gnupg.
 [PASS] The directory /var/www/passbolt/.gnupg containing the keyring is writable by the webserver user.
 [PASS] The public key file is defined in config/passbolt.php and readable.
 [PASS] The private key file is defined in config/passbolt.php and readable.
 [PASS] The server key fingerprint matches the one defined in config/passbolt.php.
 [PASS] The server public key defined in the config/passbolt.php is in the keyring.
 [PASS] There is a valid email id defined for the server key.
 [PASS] The public key can be used to encrypt a message.
 [PASS] The public key can be used to sign a message.
 [PASS] The public key can be used to encrypt and sign a message.
 [PASS] The private key can be used to decrypt a message.
 [PASS] The private key can be used to decrypt and verify a message.
 [PASS] The public key can be used to verify a signature.

 Application configuration

 [PASS] Using latest passbolt version (2.0.7).
 [PASS] Passbolt is configured to force SSL use.
 [PASS] App.fullBaseUrl is set to HTTPS.
 [PASS] Selenium API endpoints are disabled.
 [PASS] Search engine robots are told not to index content.
 [PASS] Registration is closed, only administrators can add users.
 [PASS] Serving the compiled version of the javascript app
 [PASS] All email notifications will be sent.

  3 error(s) found. Hang in there!

```

Looking into the what I believe is the healthcheck source code, it looks like it actually tries to hit `/healthcheck/status.json`. A local curl shows an error:

```plaintext
cameron@server /var/www/passbolt $ curl https://passbolt.domain.com/healthcheck/status.json
{"header":{"id":"6c2fb460-1316-49d9-9ebe-e58cf30af3ec","status":"error","servertime":1525989870,"title":"app_healthcheck_status_error","message":"An Internal Error Has Occurred.","url":"\/healthcheck\/status.json","code":500},"body":null}

```

Interestingly, the http version of the status page gives a 404 page.

Maybe related, but healthcheck is also weirdly complaining about my https certificates. I’m using real, non-self signed, https certificates provided by `certbot`. What is the healthcheck actually testing?

To top it all off, I still cannot log into my passbolt instance. I get the following at the login page.

> Could not verify server key. The OpenPGP server key defined in the config could not be found in the GnuPG keyring.

I tried various config settings for the `serverKey.public/private` to no avail. I’ve tried removing the `config/gpg` folder to confirm passbolt was really using them. `healthcheck` also seems to have complained until I moved the original root keys to the new dedicated passbolt-src user’s `~/.gnupg` which indicates that passbolt is using both locations which seems redundant and potentially confusing. Maybe this is causing our problems?

---

<div class="post-metadata">

**Author:** ![cinderblock](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cinderblock/32/201_2.png) [@cinderblock](https://community.passbolt.com/u/cinderblock)\
**Post date:** [May 12, 2018, 11:30pm UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/2 "2018-05-12T23:30:05Z")

</div>

To add some information I missed previously:

> ```plaintext
> CentOS Linux release 7.5.1804 (Core)
> nginx version: nginx/1.12.2
> mysql Ver 15.1 Distrib 5.5.56-MariaDB, for Linux (x86_64) using readline 5.1
> PHP 7.0.29 (cli) (built: Mar 30 2018 08:06:59) ( NTS )
> Passbolt: v2.0.7 1c07f215b57a7a47dc8addb177b031782b62b8f7
> 
> ```

* * *

I checked the gpgauth/database encoding issue. [[v2.0.0] That version of GPGAuth is not supported](https://community.passbolt.com/t/v2-0-0-that-version-of-gpgauth-is-not-supported/314)

```mysql
SELECT table_schema, table_name, column_name, character_set_name, collation_name
FROM information_schema.columns
WHERE collation_name = 'utf8mb4_general_ci';
# Empty set (0.02 sec)

```

* * *

I believe my https certificates are setup correctly and signed by a 3rd party. `curl` is happy:

```plaintext
cameron@myserver /var/www/passbolt $ curl -v https://passbolt.domain.com
* About to connect() to passbolt.domain.com port 443 (#0)
* Trying 2607:5300:201:3100::3c13...
* Connected to passbolt.domain.com (2607:5300:201:3100::3c13) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
* subject: CN=passbolt.domain.com
* start date: May 10 07:26:50 2018 GMT
* expire date: Aug 08 07:26:50 2018 GMT
* common name: passbolt.domain.com
* issuer: CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: passbolt.domain.com
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: nginx/1.12.2
< Date: Sat, 12 May 2018 22:41:49 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Keep-Alive: timeout=5
< X-Powered-By: PHP/7.0.29
< Set-Cookie: CAKEPHP=mjek06q0cia1c7f8u1m0mb5mu4; path=/; secure; HttpOnly
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< strict-transport-security: max-age=31536000; includeSubDomains
< Location: https://passbolt.domain.com/auth/login
< x-permitted-cross-domain-policies: all
< referrer-policy: same-origin
< x-frame-options: sameorigin
< x-xss-protection: 1; mode=block
< x-download-options: noopen
< x-content-type-options: nosniff
< X-GPGAuth-Version: 1.3.0
< X-GPGAuth-Login-URL: /auth/login
< X-GPGAuth-Logout-URL: /auth/logout
< X-GPGAuth-Verify-URL: /auth/verify
< X-GPGAuth-Pubkey-URL: /auth/verify.json
< Access-Control-Expose-Headers: X-GPGAuth-Verify-Response, X-GPGAuth-Progress, X-GPGAuth-User-Auth-Token, X-GPGAuth-Authenticated, X-GPGAuth-Refer, X-GPGAuth-Debug, X-GPGAuth-Error, X-GPGAuth-Pubkey, X-GPGAuth-Logout-Url, X-GPGAuth-Version,X-GPG-Body-Signature
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Strict-Transport-Security: max-age=31536000; includeSubdomains;
<
* Connection #0 to host passbolt.domain.com left intact

```

I’m confused why healthcheck is reporting that I’m using self signed keys. I’m betting it’s something in how `healthcheck` tests the ssl as it gets the wrong hostname, according to this:

> `[FAIL] Hostname does not match when validating certificates.`

* * *

I’m betting my server GPGkey issues has something to do with how I moved keys from `root`. I’m however unsure how this would the the case. When I installed v1 (1.6.9), I’m pretty sure I created the keys as `root`. I remember running these commands and exporting the keys to a passbolt config location:

```bash
gpg --armor --export-secret-keys root@myserver.domain.com > /var/www/passbolt/config/gpg/serverkey_private.asc
gpg --armor --export root@myserver.domain.com > /var/www/passbolt/config/gpg/serverkey.asc

```

I also noticed two different `fingerprints` in my v1 configuration files:

```plaintext
cameron@myserver /var/www/passbolt $ grep "'fingerprint'" ../passbolt.v1/app/Config/*
../passbolt.v1/app/Config/app.php: 'fingerprint' => '0DEF6E8D3011558C242476A5A37EAF8B3C29B2BC',
../passbolt.v1/app/Config/app.php.default: 'fingerprint' => '2FC8945833C51946E937F9FED47B0811573EE67E',
../passbolt.v1/app/Config/default.php: 'fingerprint' => '2FC8945833C51946E937F9FED47B0811573EE67E',

```

Looks like the `2FC...` is some random fingerprint that comes with the source and `0DEF...` is the fingerprint of the key I generated for root:

```plaintext
cameron@myserver /var/www/passbolt $ sudo gpg --list-keys --fingerprint
/root/.gnupg/pubring.gpg
------------------------
pub 2048R/3C29B2BC 2018-02-10
      Key fingerprint = 0DEF 6E8D 3011 558C 2424 76A5 A37E AF8B 3C29 B2BC
uid MyOrg - myserver <root@myserver.domain.com>
sub 2048R/472E030E 2018-02-10

```

And so I copied `/root/.gnupg` to `/var/www/passbolt/` (which is `$HOME` for `passbolt-src` user). As I described above, this fixed the `healthcheck` `[FAIL]`s. As far as I can tell, the following is exactly what is expected:

```plaintext
cameron@myserver /var/www/passbolt $ sudo -u passbolt-src gpg --list-keys --fingerprint
/var/www/passbolt/.gnupg/pubring.gpg
------------------------------------
pub 2048R/3C29B2BC 2018-02-10
      Key fingerprint = 0DEF 6E8D 3011 558C 2424 76A5 A37E AF8B 3C29 B2BC
uid MyOrg - myserver <root@myserver.domain.com>
sub 2048R/472E030E 2018-02-10

```

I also copied the keys from the old v1 config and believe I have set the configuration to load those files specifically:

```plaintext
cameron@myserver /var/www/passbolt $ grep "'fingerprint'" -A 2 config/passbolt.php

```

```php
                'fingerprint' => '0DEF6E8D3011558C242476A5A37EAF8B3C29B2BC',
                'public' => CONFIG . 'gpg' . DS . 'serverkey.asc',
                'private' => CONFIG . 'gpg' . DS . 'serverkey_private.asc',

```

```plaintext
cameron@myserver /var/www/passbolt $ ls -l config/gpg
total 20
-rw-r--r-- 1 passbolt-src nginx 0 May 10 22:52 empty
-rw-r--r-- 1 passbolt-src nginx 1739 May 10 22:52 serverkey.asc
-rw-r--r-- 1 passbolt-src nginx 3505 May 10 22:52 serverkey_private.asc
-rw-r--r-- 1 passbolt-src nginx 3147 May 10 22:52 unsecure.key
-rw-r--r-- 1 passbolt-src nginx 6647 May 10 22:52 unsecure_private.key

```

Maybe GPG is refusing to use keys that have `r`ead permissions for all users?

I just realized that while the `passbolt-src` user has a keychain with the right key, `nginx` is the actual user running the PHP. Maybe it needs its own copy of the keys?

* * *

To summarize and clarify, I believe I am currently seeing 3 issues that might be related:

- `[FAIL]` on `/healthcheck/status` check. Likely because passbolt api is refusing to run because of GPGkey issues.
- `[FAIL]` on `https` for issues that I know are not true.
- No indication of GPGkey failure on `healthcheck` when website reports:

> Could not verify server key. The OpenPGP server key defined in the config could not be found in the GnuPG keyring.

---

<div class="post-metadata">

**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\
**Post date:** [May 14, 2018, 4:23am UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/3 "2018-05-14T04:23:44Z")

</div>

@cinderblock thank you for the detailed report, and sorry for the leaving your hanging for the last two days.

The user that needs keyring is indeed nginx, and the default location unless you set $GNUPGHOME for that user is ‘/var/lib/nginx/.gnupg’. Also in my experience there are issues when re-using a gnupg keyring created by the root user (gnupg is very opiniated on what rights and ownership its wants on the keyring).

Could you try to delete the keyring in /var/www (if that’s the one you’re setting in the GNUPGHOME or passbolt config), then re-create it with your web server user and import the keys using the nginx user?

This should do:

```auto
$ sudo su -s /bin/bash -c "gpg --list-keys" nginx
$ sudo su -s /bin/bash -c "gpg --import-key /var/www/passbolt/config/gpg/serverkey_private.asc" nginx

```

If that doesn’t cut it, also check if SE Linux is giving you an errors.

---

<div class="post-metadata">

**Author:** ![cinderblock](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cinderblock/32/201_2.png) [@cinderblock](https://community.passbolt.com/u/cinderblock)\
**Post date:** [May 14, 2018, 5:19pm UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/4 "2018-05-14T17:19:30Z")

</div>

Thank you for the reply. No worries on the slow reply, I hope you enjoyed your weekend 🙂

I’m pretty sure `$GNUPGHOME` is not set:

```plaintext
cameron@myserver /var/www/passbolt $ sudo su -s /bin/bash -c 'echo $USER:$GNUPGHOME:$HOME' nginx
nginx::/var/lib/nginx
cameron@myserver /var/www/passbolt $ sudo su -s /bin/bash -c 'echo $USER:$GNUPGHOME:$HOME' passbolt-src
passbolt-src::/var/www/passbolt

```

It is my preference, for daemons/services, to not rely on configuration files that are in some location relative to a user’s `$HOME` as this imho always leads to confusion.

From reading the configurations, it’s not 100% clear when passbolt will use one from `~/.gnupg` or one specified in the config. I’m not sure familiar with gpg but I’m confused why the key’s fingerprint is needed when a key is specified. I can understand why it is needed when a key file is not specified and passbolt loads all of the user’s gpg keys and needs some way to pick the right one. But when I tell passbolt specifically to load certain specific public/private key files, is there more than one key in there?

I’m scared to delete anything - I’d rather not lose my saved passwords. I have backups but they’re a pain to use.

I tried the commands you suggested:

```plaintext
cameron@myserver /var/www/passbolt $ sudo su -s /bin/bash -c "gpg --list-keys" nginx
cameron@myserver /var/www/passbolt $

```

Maybe I’m on a different version of `gpg` because I don’t have the `--import-key` option.

```plaintext
cameron@myserver /var/www/passbolt $ gpg --version
gpg (GnuPG) 2.0.22

```

I do have `--import` however:

```plaintext
cameron@myserver /var/www/passbolt $ sudo su -s /bin/bash -c "gpg --import /var/www/passbolt/config/gpg/serverkey_private.asc" nginx
gpg: key 3C29B2BC: secret key imported
gpg: key 3C29B2BC: public key "myserver <root@myserver.domain.com>" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
gpg: secret keys read: 1
gpg: secret keys imported: 1

```

This seems to have fixed the issues I was previously facing. `healthcheck` is all green and web interface does not complain about server keys.

Unfortunately, I’m not out of the woods yet. Now I cannot log in. If I try a wrong passphrase, the interface tells me as much. If I try the correct passphrase, the login box is replaced with the following message:

> There was a server error. No additional information provided(502)

> ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/1X/04540f5be4848879f06aa4a255fbc3145c8f6555.png)

---

<div class="post-metadata">

**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\
**Post date:** [May 15, 2018, 4:44am UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/5 "2018-05-15T04:44:02Z")

</div>

Hi @cinderblock,

There is 502 http code like the server is over capacity. I have never seen this error before in relation to passbolt.

Can you check the extension background page debug console sees if there is any more information?  
You need to go to chrome://extensions/ and click on index.html in “inspect views”.

Also check for anything in your server web logs for any information. Check if there are anything related to Linux SE warnings.

Concerning your question as of why passbolt request the fingerprint is because once the key is imported in the keyring it is identified for later user using the fingerprint. We could indeed read it once that from the armored key and temporary save it for somewhere for later use.

> But when I tell passbolt specifically to load certain specific public/private key files, is there more than one key in there?

The keyring also contains the users keys, they are imported on the fly at login if they are not already in there.

---

<div class="post-metadata">

**Author:** ![cinderblock](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cinderblock/32/201_2.png) [@cinderblock](https://community.passbolt.com/u/cinderblock)\
**Post date:** [May 17, 2018, 7:54am UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/6 "2018-05-17T07:54:39Z")

</div>

From `index.html` console during failed login:

```nohighlight
vendors.min.js:82340 POST https://passbolt.mydomain.com/auth/login.json?api-version=v1 502 (Bad Gateway)
index.min.js:1455 There was a server error. No additional information provided(502)

```

* * *

There is a small chance SE linux is stomping on things but I don’t think it has before. Wait no, it is disabled:

```auto
cameron@myserver /var/www/passbolt $ sudo sestatus
SELinux status: disabled

```

* * *

Just noticed the nginx error logs during failed login:

```auto
==> /var/log/nginx/error.log <==
2018/05/17 10:17:13 [error] 847#0: *228598 FastCGI sent in stderr: "PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133
PHP message: PHP Warning: file_put_contents(/var/www/passbolt/logs/error.log): failed to open stream: Permission denied in /var/www/passbolt/vendor/cakephp/cakephp/src/Log/Engine/FileLog.php on line 133" while reading response header from upstream, client: 12.34.56.789, server: passbolt.mydomain.com, request: "POST /auth/login.json?api-version
2018/05/17 10:17:13 [error] 847#0: *228598 upstream sent too big header while reading response header from upstream, client: 12.34.56.789, server: passbolt.mydomain.com, request: "POST /auth/login.json?api-version=v1 HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm.sock:", host: "passbolt.mydomain.com"

```

So, when I switched the user accounts around, I didn’t fix permissions with regards to nginx.

```auto
cameron@myserver ~ $ ls -l /var/www/passbolt/logs
total 0
cameron@myserver ~ $ ls -l /var/www/passbolt/logs -d
drwxr-xrwx 2 passbolt-src nginx 4096 May 10 22:48 /var/www/passbolt/logs

```

Fix that real quick

```auto
cameron@myserver ~ $ sudo chmod g+w,o-w /var/www/passbolt/logs

```

Now I don’t get the `502` error but I get bumped right back to the login page.

```auto
cameron@myserver ~ $ cat /var/www/passbolt/logs/error.log | egrep -v '^\s*$'
2018-05-17 07:23:25 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:26 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:26 Warning: Warning (512): /var/www/passbolt/tmp/cache/models/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:26 Warning: Warning (512): _cake_model_ cache was unable to write 'default_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:26 Warning: Warning (512): _cake_model_ cache was unable to write 'default_gpgkeys' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:26 Warning: Warning (512): _cake_model_ cache was unable to write 'default_roles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:26 Warning: Warning (512): _cake_model_ cache was unable to write 'default_groups_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:26 Warning: Warning (512): _cake_model_ cache was unable to write 'default_profiles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:26 Warning: Warning (512): _cake_model_ cache was unable to write 'default_file_storage' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:26 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:26 Warning: Warning (2): session_start(): open(/var/lib/php/session/sess_op2eq0d7gjqavho0kvnpju8f01, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 335]
2018-05-17 07:23:26 Warning: Warning (2): session_write_close(): open(/var/lib/php/session/sess_op2eq0d7gjqavho0kvnpju8f01, O_RDWR) failed: Permission denied (13) in [Unknown, line 0]
2018-05-17 07:23:26 Warning: Warning (2): session_write_close(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in [Unknown, line 0]
2018-05-17 07:23:31 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:31 Warning: Warning (512): /var/www/passbolt/tmp/cache/models/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:31 Warning: Warning (512): _cake_model_ cache was unable to write 'default_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:31 Warning: Warning (512): _cake_model_ cache was unable to write 'default_gpgkeys' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:31 Warning: Warning (512): _cake_model_ cache was unable to write 'default_roles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:31 Warning: Warning (512): _cake_model_ cache was unable to write 'default_groups_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:31 Warning: Warning (512): _cake_model_ cache was unable to write 'default_profiles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:31 Warning: Warning (512): _cake_model_ cache was unable to write 'default_file_storage' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:31 Warning: Warning (512): _cake_model_ cache was unable to write 'default_authentication_tokens' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:32 Warning: Warning (512): /var/www/passbolt/tmp/cache/models/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:32 Warning: Warning (512): _cake_model_ cache was unable to write 'default_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (512): _cake_model_ cache was unable to write 'default_gpgkeys' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (512): _cake_model_ cache was unable to write 'default_roles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (512): _cake_model_ cache was unable to write 'default_groups_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (512): _cake_model_ cache was unable to write 'default_profiles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (512): _cake_model_ cache was unable to write 'default_file_storage' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (512): _cake_model_ cache was unable to write 'default_authentication_tokens' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:32 Warning: Warning (2): session_start(): open(/var/lib/php/session/sess_op2eq0d7gjqavho0kvnpju8f01, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 335]
2018-05-17 07:23:32 Warning: Warning (2): session_regenerate_id(): open(/var/lib/php/session/sess_qus91rhrbj7j5jr85uuunoj9u6, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 578]
2018-05-17 07:23:32 Warning: Warning (4096): session_regenerate_id(): Failed to create(read) session ID: files (path: /var/lib/php/session) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 578]
2018-05-17 07:23:32 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:32 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:33 Warning: Warning (2): session_start(): open(/var/lib/php/session/sess_hjo3799hsopum7bamo9nc8c7v7, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 335]
2018-05-17 07:23:33 Warning: Warning (2): session_write_close(): open(/var/lib/php/session/sess_hjo3799hsopum7bamo9nc8c7v7, O_RDWR) failed: Permission denied (13) in [Unknown, line 0]
2018-05-17 07:23:33 Warning: Warning (2): session_write_close(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in [Unknown, line 0]
2018-05-17 07:23:33 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:33 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:33 Warning: Warning (512): /var/www/passbolt/tmp/cache/models/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:33 Warning: Warning (512): _cake_model_ cache was unable to write 'default_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:33 Warning: Warning (512): _cake_model_ cache was unable to write 'default_gpgkeys' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:33 Warning: Warning (512): _cake_model_ cache was unable to write 'default_roles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:33 Warning: Warning (512): _cake_model_ cache was unable to write 'default_groups_users' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:33 Warning: Warning (512): _cake_model_ cache was unable to write 'default_profiles' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:33 Warning: Warning (512): _cake_model_ cache was unable to write 'default_file_storage' to Cake\Cache\Engine\FileEngine cache in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Cache.php, line 286]
2018-05-17 07:23:33 Warning: Warning (512): /var/www/passbolt/tmp/cache/persistent/ is not writable in [/var/www/passbolt/vendor/cakephp/cakephp/src/Cache/Engine/FileEngine.php, line 437]
2018-05-17 07:23:33 Warning: Warning (2): session_start(): open(/var/lib/php/session/sess_hjo3799hsopum7bamo9nc8c7v7, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 335]
2018-05-17 07:23:33 Warning: Warning (2): session_write_close(): open(/var/lib/php/session/sess_hjo3799hsopum7bamo9nc8c7v7, O_RDWR) failed: Permission denied (13) in [Unknown, line 0]
2018-05-17 07:23:33 Warning: Warning (2): session_write_close(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in [Unknown, line 0]

```

Looks like I didn’t fix all of the permissions that needed fixing.

I would like it for nginx to not be able to modify files it shouldn’t need to modify. I guess that’s what I was thinking with creating a `passbolt-src` user. Also so that that user could run git updates without nginx permissions. Alas, I see your installations instructions say to just let `nginx` own everything…

```auto
cameron@myserver /var/www/passbolt $ sudo chown -R nginx: .

```

Hmmm. Still not logging in. nginx Access logs show things happening…

```auto
==> /var/log/nginx/access.log <==
12.34.56.789 - - [17/May/2018:10:38:57 +0300] "POST /auth/login.json?api-version=v1 HTTP/1.1" 200 1097 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"
12.34.56.789 - - [17/May/2018:10:38:57 +0300] "POST /auth/login.json?api-version=v1 HTTP/1.1" 200 3995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"
12.34.56.789 - - [17/May/2018:10:38:57 +0300] "GET /auth/checkSession.json?api-version=v1 HTTP/1.1" 403 263 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"
12.34.56.789 - - [17/May/2018:10:38:57 +0300] "GET / HTTP/1.1" 302 5 "https://passbolt.mydomain.com/auth/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"
12.34.56.789 - - [17/May/2018:10:38:57 +0300] "GET /auth/login HTTP/1.1" 200 5611 "https://passbolt.mydomain.com/auth/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"
12.34.56.789 - - [17/May/2018:10:38:59 +0300] "POST /auth/verify.json?api-version=v1 HTTP/1.1" 200 1916 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"
12.34.56.789 - - [17/May/2018:10:38:59 +0300] "GET /settings.json?api-version=v2 HTTP/1.1" 200 326 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"

```

Oh! More errors in `/var/www/passbolt/logs/error.log` (that I overlooked before):

```nohighlight
2018-05-17 07:38:57 Warning: Warning (2): session_start(): open(/var/lib/php/session/sess_047i6tj20dvnm28ccrogasj561, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 335]
2018-05-17 07:38:57 Warning: Warning (2): session_regenerate_id(): open(/var/lib/php/session/sess_kvmtav4e1sddkb29mdd14fddb7, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 578]
2018-05-17 07:38:57 Warning: Warning (4096): session_regenerate_id(): Failed to create(read) session ID: files (path: /var/lib/php/session) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 578]
2018-05-17 07:38:57 Warning: Warning (2): session_start(): open(/var/lib/php/session/sess_3l4ftb10bo0m1eip6rtp48log3, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 335]
2018-05-17 07:38:57 Warning: Warning (2): session_write_close(): open(/var/lib/php/session/sess_3l4ftb10bo0m1eip6rtp48log3, O_RDWR) failed: Permission denied (13) in [Unknown, line 0]
2018-05-17 07:38:57 Warning: Warning (2): session_write_close(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in [Unknown, line 0]
2018-05-17 07:38:59 Warning: Warning (2): session_start(): open(/var/lib/php/session/sess_3l4ftb10bo0m1eip6rtp48log3, O_RDWR) failed: Permission denied (13) in [/var/www/passbolt/vendor/cakephp/cakephp/src/Network/Session.php, line 335]
2018-05-17 07:38:59 Warning: Warning (2): session_write_close(): open(/var/lib/php/session/sess_3l4ftb10bo0m1eip6rtp48log3, O_RDWR) failed: Permission denied (13) in [Unknown, line 0]
2018-05-17 07:38:59 Warning: Warning (2): session_write_close(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/var/lib/php/session) in [Unknown, line 0]

```

Stupid php update changes the permissions on `/var/lib/php/session` to `apache`.

```auto
cameron@myserver ~ $ sudo ls -ld /var/lib/php/session
drwxrwx--- 2 root apache 4096 Apr 28 11:22 /var/lib/php/session
cameron@myserver ~ $ sudo chgrp nginx /var/lib/php/session

```

And we’re all set!

Thanks for the help debugging this. Hope the documentation of my tribulations will help someone else eventually.

---

<div class="post-metadata">

**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\
**Post date:** [May 17, 2018, 7:58am UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/7 "2018-05-17T07:58:49Z")

</div>

Good catch @cinderblock, i’m glad you figured it out!  
Thanks for the write up, it will certainly be useful for other people in a similar case.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/b/bee7d3f9329f668000d46e9fcb2e5db1e9d31348.svg) [@system](https://community.passbolt.com/u/system)\
**Post date:** [May 22, 2018, 7:58am UTC](https://community.passbolt.com/t/v2-update-issues-server-key-not-loading-healthcheck-says-keys-are-fine-but-other-things-broken/662/8 "2018-05-22T07:58:59Z")

</div>

This topic was automatically closed 5 days after the last reply. New replies are no longer allowed.