Generated key [ ] of size [ ]. The generated key MUST be…

Error message

Generated {} key [{}] of size [{}]. The generated key MUST be added to CAS settings:\n\n\t{}\n\n

What it means

Warning from BaseBinaryCipherExecutor.issueWarningToAddKeyToSettings announcing an auto-generated key (encryption or signing), its size, and the exact property line that must be added to CAS settings. It is the companion to errors 422/425: the key exists only in memory until you persist it.

Solutions

Copy the 'setting=value' text from the log line verbatim into application.properties (or your config source).
Store the key in a secrets manager / vault and inject it as the CAS property instead of hardcoding.
Restart and confirm the warning no longer appears — its absence proves the key was persisted and picked up.
Distribute identical keys to all CAS nodes in a cluster.

Example fix

// before: warning shows
Generated encryption key [abc...] of size [16]. ... settings: cas.ticket.crypto.encryption.key=abc...
// after: property persisted in application.properties
cas.ticket.crypto.encryption.key=abc...

Defensive patterns

Strategy: validation

Validate before calling

// Post-startup check: parse logs and fail deployment if this warning appears
if (startupLog.contains("The generated key MUST be added to CAS settings")) {
    throw new IllegalStateException("Ephemeral crypto key generated; persist it in configuration");
}

Prevention

Treat this warning as an action item, never as benign noise.
Automate: capture the printed property and write it into your secret store.
Verify on next restart that the warning no longer appears.

When it happens

Trigger: Any startup where ensureEncryptionKeyExists or ensureSigningKeyExists found a blank key and generated a new one; the log line contains the ready-to-paste 'property=value' string.

Common situations: Deployments that ignore WARN logs and run with ephemeral keys, causing session/ticket invalidation after every restart or mismatched keys across cluster nodes.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/11f221be102563d7. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseBinaryCipherExecutor.java:214

        }
        this.encryptionSecretKey = genEncryptionKey;
    }

    private void ensureSigningKeyExists(final String signingSecretKey, final int signingKeySize) {
        var signingKeyToUse = signingSecretKey;
        if (StringUtils.isBlank(signingKeyToUse)) {
            LOGGER.warn("Secret key for signing is not defined under [{}]. CAS will attempt to auto-generate the signing key",
                getSigningKeySetting());
            signingKeyToUse = generateOctetJsonWebKeyOfSize(signingKeySize);
            val prop = String.format("%s=%s", getSigningKeySetting(), signingKeyToUse);
            issueWarningToAddKeyToSettings("signing", signingKeySize, signingKeyToUse, prop);
        }
        configureSigningKey(signingKeyToUse);
    }
    
    //CHECKSTYLE:OFF
    private static void issueWarningToAddKeyToSettings(final String keyType, final int encryptionKeySize, final String key, final String prop) {
        LOGGER.warn("Generated {} key [{}] of size [{}]. The generated key MUST be added to CAS settings:\n\n\t{}\n\n",
            keyType, key, encryptionKeySize, prop);
    }
    //CHECKSTYLE:ON
    
}

View on GitHub (pinned to e7288fc434)