apereo/cas · error · IllegalArgumentException

Could not locate RSA JSON web key from keystore

Error message

Could not locate RSA JSON web key from keystore

What it means

While preparing decoding (signature verification) parameters, no RSA JWK matching the configured key id was found in the locally configured JWK set (webKeySet keystore). IllegalArgumentException aborts decode because a payload signed with the corresponding key cannot be verified. The input at fault is the keystore JWKS content or the keyIdToUse setting.

Solutions

1. Verify the JWK set resource (keystore JWKS) is loaded and contains an RSA key
2. Check the configured key id matches a kid present in the JWK set
3. Regenerate/synchronize the signing key pair between the encrypting and verifying parties

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:104 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/e499ec8f0f3e9c08. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:104

    @Override
    public String encode(final Serializable value, final Object[] parameters) {
        configureSigningParametersForEncoding();
        configureEncryptionParametersForEncoding();
        return super.encode(value, parameters);
    }

    @Override
    public String decode(final Serializable value, final Object[] parameters) {
        configureSigningParametersForDecoding();
        configureEncryptionParametersForDecoding();
        return super.decode(value, parameters);
    }

    private void configureSigningParametersForDecoding() {
        val result = findRsaJsonWebKeyByProvidedKeyId(webKeySet.getJsonWebKeys());
        if (result.isEmpty()) {
            throw new IllegalArgumentException("Could not locate RSA JSON web key from keystore");
        }
        val key = result.get();
        if (key.getPublicKey() == null) {
            throw new IllegalArgumentException("Public key located from keystore for key id " + key.getKeyId() + " is undefined");
        }
        setSigningKey(key.getPublicKey());
    }

    private void configureEncryptionParametersForDecoding() {
        FunctionUtils.doUnchecked(param -> {
            if (httpsJkws.isEmpty()) {
                LOGGER.debug("No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped");
            } else {
                val keys = this.httpsJkws.get().getJsonWebKeys();
                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);

                if (encKeyResult.isEmpty()) {
                    throw new IllegalArgumentException("Could not locate RSA JSON web key from endpoint");

View on GitHub (pinned to e7288fc434)