I get this error message when trying to active encryption at rest for a certain user:

Questions
1

Your question

This item references another item that does not exist.

2

The error “This item references another item that does not exist” means the encryptionAtRest field on the user’s AccountSettings singleton is pointing to a PublicKey id that no longer exists (or was never successfully created).

Encryption at rest works in two steps:

  1. A PublicKey object must be registered first (containing the OpenPGP key or S/MIME certificate).
  2. The AccountSettings singleton’s encryptionAtRest field references that key by id.

If step 1 was skipped, failed, or the key was later deleted, you will get exactly this kind of “references another item that does not exist” error when trying to activate or update encryption. The fix is to:

  1. Upload/register a valid public key first via the self-service portal (the /crypto endpoint) or via the JMAP API as a PublicKey object.
  2. Then set encryptionAtRest on the account, referencing the id of the key you just registered.

If you are working via the WebUI’s account manager, make sure the key upload step completed successfully before clicking to enable encryption.

More details are in the Encryption at Rest - Management documentation page.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

i tried it several times with the web ui, but it doesn’t work.
how is the correct syntax for doing this with stalwart-cli?

4

The Error ist quite persistent. Even deleting and recreating of the account didn’t make the error go away.

Please Help!
“This item references another item that does not exist.”

5

A shot in the dark but you could try going to Actions and clearing the caches.

6

thanks for your proposal, but this didn’t solve it.

7

That message is a foreign-key error: the encryption-at-rest setting is pointing at a public key that does not exist for that account, which is also why clearing the caches did not change anything. The order matters here: you need to register a public key (an OpenPGP key or an S/MIME certificate) for the account first, and then enable encryption at rest referencing that key.

The flow is documented at Management | Stalwart. If you already created a key, double-check the key id you are referencing still exists.