Ticket registry encryption/signing for

Error message

Ticket registry encryption/signing for [{}] is not enabled explicitly in the configuration, yet signing/encryption keys are defined for ticket operations. CAS will proceed to enable the ticket registry encryption/signing functionality. If you intend to turn off this behavior, consider removing/disabling the signing/encryption keys defined in settings

What it means

CoreTicketUtils.newTicketRegistryCipherExecutor detects a configuration contradiction: crypto properties declare both signing and encryption keys, but the 'enabled' flag is not explicitly turned on. CAS auto-enables the cipher executor and warns so the operator notices the implicit behavior change rather than silently ignoring defined keys.

Solutions

Explicitly set cas.ticket.registry.crypto.enabled=true if you want encryption/signing (which is what CAS is now doing anyway)
Remove the encryption/signing key properties entirely to truly disable ticket registry encryption/signing
Review which registryName is reported and align its specific crypto properties (e.g. cas.ticket.registry.crypto.* vs per-registry variants)
After changing config, restart and confirm the warning no longer appears

Example fix

// before (application.yml)
cas:
  ticket:
    registry:
      crypto:
        enabled: false
        encryption:
          key: "...
        signing:
          key: "...
// after
cas:
  ticket:
    registry:
      crypto:
        enabled: true
        encryption:
          key: "...
        signing:
          key: "...

Defensive patterns

Strategy: validation

Validate before calling

// startup check
if (keysDefined && !cryptoEnabled) log.warn("keys defined but crypto disabled; CAS will auto-enable");

Prevention

Keep crypto.enabled and the key properties consistent: either both set or neither
Generate keys with the CAS-provided keygen tooling and commit the full property block
Audit all cas.ticket.registry.crypto.* namespaces after upgrades for drifted settings

When it happens

Trigger: Setting cas.ticket.registry.crypto.encryption.key and cas.ticket.registry.crypto.signing.key while leaving cas.ticket.registry.crypto.enabled=false (or unset) when building a ticket registry cipher executor with forceIfBlankKeys semantics.

Common situations: Operators paste keys from docs/tutorials but skip the enabled property; upgrades where key properties were added but the enable flag was reset; template configs that pre-generate keys for all registries.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/c09b351c6158e8f0. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-tickets-api/src/main/java/org/apereo/cas/util/CoreTicketUtils.java:49

        return newTicketRegistryCipherExecutor(registry, false, registryName);
    }

    /**
     * New ticket registry cipher executor cipher executor.
     *
     * @param cryptoProps         the registry
     * @param forceIfBlankKeys the force if blank keys
     * @param registryName     the registry name
     * @return the cipher executor
     */
    public static CipherExecutor newTicketRegistryCipherExecutor(
        final EncryptionRandomizedSigningJwtCryptographyProperties cryptoProps,
        final boolean forceIfBlankKeys, final String registryName) {

        val enabled = FunctionUtils.doIf(
            !cryptoProps.isEnabled() && StringUtils.isNotBlank(cryptoProps.getEncryption().getKey()) && StringUtils.isNotBlank(cryptoProps.getSigning().getKey()),
            () -> {
                LOGGER.warn("Ticket registry encryption/signing for [{}] is not enabled explicitly in the configuration, yet signing/encryption keys "
                            + "are defined for ticket operations. CAS will proceed to enable the ticket registry encryption/signing functionality. "
                            + "If you intend to turn off this behavior, consider removing/disabling the signing/encryption keys defined in settings", registryName);
                LOGGER.debug("Defined signing key is [{}], and defined encryption key is [{}]", cryptoProps.getSigning().getKey(),
                    cryptoProps.getEncryption().getKey());
                return Boolean.TRUE;
            },
            cryptoProps::isEnabled
        ).get();


        if (enabled || forceIfBlankKeys) {
            LOGGER.debug("Ticket registry encryption/signing is enabled for [{}]", registryName);
            return new DefaultTicketCipherExecutor(
                cryptoProps.getEncryption().getKey(),
                cryptoProps.getSigning().getKey(),
                cryptoProps.getAlg(),
                cryptoProps.getSigning().getKeySize(),
                cryptoProps.getEncryption().getKeySize(),

View on GitHub (pinned to e7288fc434)