ARTIFACTORY: How to Resolve Key Pair Was Not Verified / BadSecretUriException When Creating GPG Key from Vault Connector

Introduction

This article explains why adding a GPG (or RSA) signing key pair from a HashiCorp Vault connector in Artifactory can fail with Key Pair was not verified, even when the Vault connector Test / Verify succeeds, and how to correct the Vault secret path so Artifactory/Access can resolve the secret.

The most common cause is that the Secret Path entered in Add GPG Key does not include the Vault KV secrets engine mount prefix (for example, secret/, kv/, or a custom mount such as production-secrets/). Access then treats the first path segment as a mount that does not exist and fails with Cannot find a mount path for vault.



Issue

When creating a new signing key from a Vault connector under Administration → Security → Keys Management (or Keys & Certificates, depending on version):

The Vault connector (for example, Vaultx1) tests successfully (HTTP 200).

Adding a GPG/RSA key from that connector fails with Key Pair was not verified.

Artifactory / Access logs show Vault secret URI resolution failures, such as:

 - VaultException$BadSecretUriException: Cannot find a mount path for vault  - Warnings from KeyPairServiceVaultImpl  - Errors from PGPKeyParser (for example, no public key material retrieved)

Typical incorrect URI pattern:

vault://<Vault-Integration-ID>/<secret-name>#<field-name>

Example of an incorrect path (missing mount):

vault://Vaultx1/testkey#publicKey

Here, testkey is interpreted as the mount point itself, which does not exist on Vault, so key retrieval fails.



Cause

Artifactory and Access parse Vault URIs as:

vault://[Vault-Integration-ID]/[Secret-Path]#[Key-Name]

URI segment	Meaning
Vault-Integration-ID	Vault connector name configured in Artifactory (for example, Vaultx1)
Secret-Path	Full path to the secret, including the KV secrets engine mount
Key-Name	JSON field inside the secret that holds the key material (for example, pub_key, publicKey)

Important:

Connector verification only confirms that Artifactory can authenticate to Vault and reach the configured secrets engine. It does not validate the secret path you enter later when adding a GPG key.

If Secret-Path does not begin with a registered, active secrets engine mount (for example, secret/, kv/, or a custom mount), Access cannot resolve the mount and returns Cannot find a mount path for vault.

Less common related cause (usually only if connector verification also fails or mount listing is blocked):

The AppRole/token used by the connector lacks permission to list mounts (for example,/v1/sys/mounts), so Access cannot resolve the mount structure.



Evidence to look for in a Support Bundle/logs:

Access log — BadSecretUriException: Cannot find a mount path for vault when adding the key.

Artifactory log — KeyPairServiceVaultImpl warnings and PGPKeyParser errors at the same timestamps.

Access request log — connector verify succeeds, for example:

POST|/api/v1/access/vault/configs/verify/<ConnectorName>|200

Customer UI — Key Pair was not verified despite a healthy connector test.



Resolution

Step-by-step instructions



1. Identify the Vault secrets engine mount

On the Vault side, list mounts and note the KV engine path used for signing keys:

vault secrets list

Common mounts: secret/, kv/, or a custom mount (for example, production-secrets/).

Also, confirm that the Secret Engine Path configured on the Vault connector in Artifactory matches that mount (see Hashicorp Vault Setup Instructions (https://jfrog.com/help/r/hashicorp-vault-setup-instructions/hashicorp-vault-setup-instructions)).



2. Store secrets under the mount prefix

Store public key, private key, and passphrase under the mount, for example with the default secret engine:

vault kv put secret/gpg_pub_key pub_key=@public.keykv put secret/gpg_priv_key
priv_key=@private.keykv put secret/passphrase pp='YourPassphrase'

For a custom mount (for example production-secrets):

vault kv put production-secrets/gpg_pub_key pub_key=@public.keykv put
production-secrets/gpg_priv_key priv_key=@private.keykv put production-secrets/passphrase
pp='YourPassphrase'

Verify (redact sensitive values when sharing):

vault kv get <mount>/<secret-name>



3. Use the mount in the Artifactory Secret Path

When adding the GPG key:

Go to Administration → Security → Keys Management (or Keys & Certificates).

```
Select Add Key Pair → GPG (or RSA).
```
```
Choose the Vault connector.
```

Set Secret Path to include the mount (for example secret/gpg_pub_key).

Set Key ID to the JSON field name (for example pub_key).

```
Click Test, then Add GPG Key.
```

Correct URI examples:

vault://<Vault-Integration-ID>/secret/gpg_pub_key#pub_key://<Vault-Integration-ID>/kv/gpg_pub_key#pub_key://<Vault-Integration-ID>/production-secrets/testkey#publicKey

Incorrect (missing mount - will fail):

vault://<Vault-Integration-ID>/testkey#publicKey://<Vault-Integration-ID>/gpg_pub_key#pub_key



4. Optional: upload keys without Vault

If Vault integration is not required, generate a GPG key pair locally, export the public and private keys, and note the passphrase. In Keys Management, add a GPG key pair and upload or paste the keys with the passphrase. Leave the Vault Connector field empty. Refer to Security Keys Management and follow this article to Generate GPG Keys



Conclusion

Key Pair was not verified when adding a GPG key from Vault while the connector itself verifies successfully almost always means the Secret Path is missing the KV secrets engine mount. Include the mount in every secret path (for example secret/gpg_pub_key or production-secrets/testkey), match the connector’s Secret Engine Path to Vault, then Test and add the key again.



Related Resources

Adding the GPG key from Vault to Artifactory