i have this issue with openssl when i try to run a pipeline in circle ci. Decrypting the encrypted server key in my sfdx project fails.

this is the command i use to decrypt

 - run:
      name: Decrypt server key
        openssl enc -nosalt -aes-256-cbc -d -in assets/server.key.enc -out assets/server.key -base64 -K $DECRYPT_KEY -iv $DECRYPT_IV

but i get this error

#!/bin/bash -eo pipefail
 openssl enc -nosalt -aes-256-cbc -d -in assets/server.key.enc -out assets/server.key -base64 -K 
 Extra arguments given. 
 enc: Use -help for summary.

Exited with code exit status 1 
CircleCI received exit code 1
  • Does your $DECRYPT_KEY or $DECRYPT_IV environment variables contain spaces or special characters? Most likely you'll want to quote them
    – David Reed
    Commented Dec 29, 2020 at 21:00
  • when you say quote them how do you mean ?
    – Soji
    Commented Dec 29, 2020 at 21:06
  • @DavidReed i understand what you mean now. And it seems you were right. Now i get an hex string is too long , hex value is invalid. I suspect that this has to do with the passphrase i might have used in encrypting the key file initially right ?
    – Soji
    Commented Dec 29, 2020 at 21:35

1 Answer 1


The first problem appears to be that you haven't quoted your environment variables and they contain whitespace or special characters:

openssl enc -nosalt -aes-256-cbc -d -in assets/server.key.enc -out assets/server.key -base64 \

After fixing this, you've mentioned that you're receiving an error

hex string is too long , hex value is invalid.

It's not immediately obvious to me why this is the case since I cannot see (and you should on no account show me!) your keyfile and encryption passphrase. I would suggest beginning by reviewing all of your secrets for correctness and ensuring that you can decrypt the keyfile locally.

Then, I'd go through the Salesforce DX Developer Guide's section on Continuous Integration using CircleCI, which it looks like you're probably following but might have missed a step on.

If you're observing different results locally and on CircleCI, validate that you have the same versions of OpenSSL installed - at least once in the past a version difference has also come with a difference in the default hash algorithm, which can result in divergent results. You may want to try redoing your setup and explicitly specifying a hash algorithm, such as -md sha512, to ensure you're using the same one everywhere.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .