OpenSSL Decrypt Failure After Migration – Email in BPMN & User Passwords Lost

[esendino]

We migrated our EspoCRM installation from one Ubuntu server to another.

Original Setup & Migration Details:

• EspoCRM Version: 8.0.6

• Advanced Pack: 3.0.14

• PHP Version: 8.1 (same on both servers)

• Backup included:

• MySQL database dump

• Custom directory

• Upload directory

• Backup did NOT include: config.php or config-internal.php

After the migration, EspoCRM auto-generated config.php and config-internal.php.

• Issues Encountered:

BPMN Processes Can’t Send Emails

• When BPMN attempts to send an email, the log shows:

[2025-03-13 12:40:03] ERROR: Process 67d2d1e960e07fa65 element 8660u0frnt send message error: OpenSSL decrypt failure.

• However, sending a test email from the UI works fine (#Admin/outboundEmails).

User Passwords Were Lost After Migration

• All users had to manually reset their passwords.What We've Investigated:

• Likely cause: Since config-internal.php was missing, EspoCRM generated a new cryptKey and hashSecretKey.

• Impact: The old passwords and email credentials stored in the database are encrypted with the old key and cannot be decrypted with the new one.

• Manually resetting the outbound email password didn’t solve the BPMN email issue.

Looking for answers on these three points:
1- Is there any way to manually re-encrypt the email password in config-internal.php to make it work with the new keys?
2- Could there be another cause for the BPMN process email failure beyond the cryptographic issue?
3- Are there any workarounds to recover lost encrypted data, given that we no longer have access to the original keys?



It is not an option to restart the process from the beginning (do a new backup and so on) as there have been several transactions that already updated the new DB.

Any guidance would be greatly appreciated!

Additional Investigation & Attempts:

-We checked file permissions and confirmed that config-internal.php has correct ownership (www-data:www-data) and readable permissions.
-Cron Jobs are running, but BPMN email sending still fails.
-Tried manually reconfiguring the outbound email password from the UI, but BPMN processes still can’t send emails.
-We regenerated cryptKey and hashSecretKey manually, but it did not resolve the issue.
-Checked whether Apache, MySQL, and PHP were properly restarted after changes (systemctl restart mysql, systemctl restart apache2, php command.php rebuild).
-No other system logs indicate permission or OpenSSL errors outside of EspoCRM.

[esendino]

Hi everyone,

I wanted to update this thread with the solution in case it helps someone else facing a similar issue.

In our case, the root cause was not a cryptographic mismatch due to missing config.php and config-internal.php, as we initially suspected. The situation was complicated because our hosting provider did not include these files in the backup, which misled our analysis. This made us believe that stored credentials were encrypted with an old hash that was no longer available, preventing us from decrypting email addresses and causing the BPMN email failure. Actual Solution


Despite all sources pointing us to reset the outbound email password at:
➡️ https://mydomain.com/#Admin/outboundEmails

We did this multiple times with no success.

However, the key step we were missing was resetting the passwords in group email accounts at:
➡️ https://mydomain.com/#Admin/groupEmailAccounts

Once we updated the credentials there, BPMN processes were able to send emails again, resolving the issue. Key Takeaway


If you're facing a similar OpenSSL decrypt failure in BPMN email processes after migration:

1. Yes, resetting the outbound email password is necessary, but
2. Don’t forget to also update credentials in the Group Email Accounts section.

Hope this helps someone else in the future! 🚀