{"record":{"id":"06e701e404270583","repo":"apereo/cas","slug":"secret-key-for-encryption-defined-under-is-no","errorCode":null,"errorMessage":"Secret key for encryption defined under [{}] is not Base64 encoded. Clear the setting to regenerate (Recommended) or replace with [{}].","messagePattern":"Secret key for encryption defined under \\[(.+?)\\] is not Base64 encoded\\. Clear the setting to regenerate \\(Recommended\\) or replace with \\[(.+?)\\]\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseBinaryCipherExecutor.java","lineNumber":190,"sourceCode":"                keyGenerator.init(encryptionKeySize);\n                val secretKey = keyGenerator.generateKey();\n                genEncryptionKey = secretKey.getEncoded();\n                val encodedKey = EncodingUtils.encodeBase64(genEncryptionKey);\n                val prop = String.format(\"%s=%s\", getEncryptionKeySetting(), encodedKey);\n                issueWarningToAddKeyToSettings(\"encryption\", encryptionKeySize, encodedKey, prop);\n            }\n        } else if (encryptionKeySize <= MINIMUM_ENCRYPTION_KEY_LENGTH) {\n            val base64 = EncodingUtils.isBase64(encryptionSecretKey);\n            val key = base64 ? EncodingUtils.decodeBase64(encryptionSecretKey) : ArrayUtils.EMPTY_BYTE_ARRAY;\n            if (base64 && key.length == encryptionKeySize) {\n                LOGGER.trace(\"Secret key for encryption defined under [{}] is Base64 encoded.\", getEncryptionKeySetting());\n                genEncryptionKey = key;\n            } else if (encryptionSecretKey.length() != encryptionKeySize) {\n                LOGGER.warn(\"Secret key for encryption defined under [{}] is Base64 encoded but the size does not match the key size [{}].\",\n                    getEncryptionKeySetting(), encryptionKeySize);\n                genEncryptionKey = encryptionSecretKey.getBytes(StandardCharsets.UTF_8);\n            } else {\n                LOGGER.warn(\"Secret key for encryption defined under [{}] is not Base64 encoded. Clear the setting to regenerate (Recommended) or replace with\"\n                            + \" [{}].\", getEncryptionKeySetting(), EncodingUtils.encodeBase64(encryptionSecretKey));\n                genEncryptionKey = encryptionSecretKey.getBytes(StandardCharsets.UTF_8);\n            }\n        } else {\n            genEncryptionKey = EncodingUtils.decodeBase64(encryptionSecretKey);\n        }\n        this.encryptionSecretKey = genEncryptionKey;\n    }\n\n    private void ensureSigningKeyExists(final String signingSecretKey, final int signingKeySize) {\n        var signingKeyToUse = signingSecretKey;\n        if (StringUtils.isBlank(signingKeyToUse)) {\n            LOGGER.warn(\"Secret key for signing is not defined under [{}]. CAS will attempt to auto-generate the signing key\",\n                getSigningKeySetting());\n            signingKeyToUse = generateOctetJsonWebKeyOfSize(signingKeySize);\n            val prop = String.format(\"%s=%s\", getSigningKeySetting(), signingKeyToUse);\n            issueWarningToAddKeyToSettings(\"signing\", signingKeySize, signingKeyToUse, prop);\n        }","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseBinaryCipherExecutor.java#L172-L208","documentation":"Warning from BaseBinaryCipherExecutor.ensureEncryptionKeyExists when the configured encryption key is neither validly sized Base64 nor missing: it is not Base64 at all (or the length branch did not match). CAS uses the raw UTF-8 bytes of the string as the AES key and suggests clearing the setting so a proper key is regenerated.","triggerScenarios":"Setting cas.*.crypto.encryption.key to a plain-text string (not Base64) whose length also equals the key size — e.g. a 16-character ASCII password used directly as the encryption key.","commonSituations":"Operators typing a human-readable secret instead of a generated Base64 key; keys copied from another system that hex- or URL-encodes rather than Base64; whitespace or prefix corruption that invalidates Base64 decoding.","solutions":["Clear the property and restart so CAS auto-generates a proper Base64 key (recommended by the message), then persist the printed key.","Replace the value with the Base64 encoding of the existing secret if you must keep the same key material.","Validate the value is Base64 (java.util.Base64.getDecoder().decode throws on invalid input) before configuring it."],"exampleFix":"// before\ncas.ticket.crypto.encryption.key=my-secret-password\n// after\ncas.ticket.crypto.encryption.key=bXktc2VjcmV0LXBhc3N3b3Jk","handlingStrategy":"validation","validationCode":"try {\n    java.util.Base64.getDecoder().decode(configuredKey);\n} catch (IllegalArgumentException e) {\n    throw new IllegalStateException(\"Encryption key is not Base64 encoded: re-generate or Base64-encode it\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always paste the exact 'property=value' line CAS prints when generating keys.","Do not type human-readable secrets as cipher keys.","Strip whitespace/quotes when copying keys into properties files.","Prefer clearing the setting and letting CAS regenerate (then persist) over hand-rolling keys."],"tags":["encryption","base64","invalid-config-value"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}