[horde] Horde refuses to create "secret_key" automatically on fresh install

[Ruud Baart]

Op 6-7-2026 om 15:42 schreef Sebastian Arcus:
> I'm not sure if this is particular to my own setup or a generic issue. 
> I installed Horde6 using the steps below:
>
> $ cd /srv/lighttpd/horde6.mydomain.com/
> $ composer create-project horde/bundle .
> $ composer require horde/timeobjects  horde/content
> $ cp ./vendor/horde/horde/config/conf.php.dist 
> ./var/config/horde/conf.php
>
> When trying to load https://horde6.mydomain.com, I get the error "520 
> Bad Gateway". After enabling test.php, I get the error message below:
>
>
> Error: Cannot create Horde_Secret_Cbc Root cause: 
> Horde_Core_Secret_Cbc: key_format 'hkdf-with-legacy-fallback' requires 
> a non-empty 'secret_key' constructor parameter. HKDF derivation over 
> empty master secret would produce a predictable per-session key. Set a 
> strong $conf['secret_key'] in horde/conf.php, or switch key_format to 
> 'legacy-only' (rollback mode).
>
>
>
> It all works fine if I copy manually the "secret_key" from conf.php 
> entry from a working installation of Horde, or generate one with 
> OpenSSL. Is the key supposed to be generated manually and added to 
> conf.php? Maybe it is in the instructions and I missed it?
>
>
> I am on PHP 8.4.22 and Lighttpd 1.4.82

More or less the same here. After

    composer create-project horde/bundle .

and a few

    composer require ....

I did:

    cp -a vendor/horde/horde/config/conf.php.dist var/config/horde/conf.php
    composer horde-reconfigure

I tried to load the initial page. This was shown:

Horde\Exception\HordeRuntimeException:
Horde_Core_Secret_Cbc:
key_format 'hkdf-with-legacy-fallback' requires a non-empty
'secret_key' constructor parameter.

HKDF derivation over empty master
secret would produce a predictable per-session key.
Set a strong
$conf['secret_key'] in horde/conf.php, or switch key_format to
'legacy-only' (rollback mode).

in
/home/websites/domain.com/vendor/horde/core/lib/Horde/Core/Secret/Cbc.php:206
Stack trace:

#0
/home/websites/domain.com/vendor/horde/core/lib/Horde/Core/Factory/Secret/Cbc.php(21):
Horde_Core_Secret_Cbc->__construct()

#1
/home/websites/domain.com/vendor/horde/injector/src/Binder/Factory.php(125):
Horde_Core_Factory_Secret_Cbc->create()

#2
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(409):
Horde\Injector\Binder\Factory->create()

#3
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(466):
Horde\Injector\Injector->createInstance()

#4
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(456):
Horde\Injector\Injector->get()

#5
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(627):
Horde\Injector\Injector->get()

#6
/home/websites/domain.com/vendor/horde/core/src/Session/HordeSessionFactory.php(79):
Horde\Injector\Injector->getInstance()

#7
/home/websites/domain.com/vendor/horde/injector/src/Binder/Factory.php(125):
Horde\Core\Session\HordeSessionFactory->create()

#8
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(409):
Horde\Injector\Binder\Factory->create()

#9
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(466):
Horde\Injector\Injector->createInstance()

#10
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(627):
Horde\Injector\Injector->get()

#11
/home/websites/domain.com/vendor/horde/core/lib/Horde/Registry.php(2560):
Horde\Injector\Injector->getInstance()

#12
/home/websites/domain.com/vendor/horde/core/lib/Horde/Registry.php(2364):
Horde_Registry->getAuth()

#13
/home/websites/domain.com/vendor/horde/core/lib/Horde/ErrorHandler.php(99):
Horde_Registry->isAdmin()

#14 [internal function]:
Horde_ErrorHandler::fatal()

#15 {main} Next
Horde\Injector\NotFound

Exception: Cannot create Horde_Secret_Cbc Root
cause: Horde_Core_Secret_Cbc: key_format 'hkdf-with-legacy-fallback'
requires a non-empty 'secret_key' constructor parameter. HKDF
derivation over empty master secret would produce a predictable
per-session key. Set a strong $conf['secret_key'] in horde/conf.php,
or switch key_format to 'legacy-only' (rollback mode).

in
/home/websites/domain.com/vendor/horde/injector/src/Injector.php:513
Stack trace:

#0
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(456):
Horde\Injector\Injector->get()

#1
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(627):
Horde\Injector\Injector->get()

#2
/home/websites/domain.com/vendor/horde/core/src/Session/HordeSessionFactory.php(79):
Horde\Injector\Injector->getInstance()

#3
/home/websites/domain.com/vendor/horde/injector/src/Binder/Factory.php(125):
Horde\Core\Session\HordeSessionFactory->create()

#4
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(409):
Horde\Injector\Binder\Factory->create()

#5
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(466):
Horde\Injector\Injector->createInstance()

#6
/home/websites/domain.com/vendor/horde/injector/src/Injector.php(627):
Horde\Injector\Injector->get()

#7
/home/websites/domain.com/vendor/horde/core/lib/Horde/Registry.php(2560):
Horde\Injector\Injector->getInstance()

#8
/home/websites/domain.com/vendor/horde/core/lib/Horde/Registry.php(2364):
Horde_Registry->getAuth()

#9
/home/websites/domain.com/vendor/horde/core/lib/Horde/ErrorHandler.php(99):
Horde_Registry->isAdmin()

#10 [internal function]:
Horde_ErrorHandler::fatal() #11 {main}