{"record":{"id":"11f221be102563d7","repo":"apereo/cas","slug":"generated-key-of-size-the-generated","errorCode":null,"errorMessage":"Generated {} key [{}] of size [{}]. The generated key MUST be added to CAS settings:\\n\\n\\t{}\\n\\n","messagePattern":"Generated (.+?) key \\[(.+?)\\] of size \\[(.+?)\\]\\. The generated key MUST be added to CAS settings:\\\\n\\\\n\\\\t(.+?)\\\\n\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseBinaryCipherExecutor.java","lineNumber":214,"sourceCode":"        }\n        this.encryptionSecretKey = genEncryptionKey;\n    }\n\n    private void ensureSigningKeyExists(final String signingSecretKey, final int signingKeySize) {\n        var signingKeyToUse = signingSecretKey;\n        if (StringUtils.isBlank(signingKeyToUse)) {\n            LOGGER.warn(\"Secret key for signing is not defined under [{}]. CAS will attempt to auto-generate the signing key\",\n                getSigningKeySetting());\n            signingKeyToUse = generateOctetJsonWebKeyOfSize(signingKeySize);\n            val prop = String.format(\"%s=%s\", getSigningKeySetting(), signingKeyToUse);\n            issueWarningToAddKeyToSettings(\"signing\", signingKeySize, signingKeyToUse, prop);\n        }\n        configureSigningKey(signingKeyToUse);\n    }\n    \n    //CHECKSTYLE:OFF\n    private static void issueWarningToAddKeyToSettings(final String keyType, final int encryptionKeySize, final String key, final String prop) {\n        LOGGER.warn(\"Generated {} key [{}] of size [{}]. The generated key MUST be added to CAS settings:\\n\\n\\t{}\\n\\n\",\n            keyType, key, encryptionKeySize, prop);\n    }\n    //CHECKSTYLE:ON\n    \n}\n","sourceCodeStart":196,"sourceCodeEnd":220,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseBinaryCipherExecutor.java#L196-L220","documentation":"Warning from BaseBinaryCipherExecutor.issueWarningToAddKeyToSettings announcing an auto-generated key (encryption or signing), its size, and the exact property line that must be added to CAS settings. It is the companion to errors 422/425: the key exists only in memory until you persist it.","triggerScenarios":"Any startup where ensureEncryptionKeyExists or ensureSigningKeyExists found a blank key and generated a new one; the log line contains the ready-to-paste 'property=value' string.","commonSituations":"Deployments that ignore WARN logs and run with ephemeral keys, causing session/ticket invalidation after every restart or mismatched keys across cluster nodes.","solutions":["Copy the 'setting=value' text from the log line verbatim into application.properties (or your config source).","Store the key in a secrets manager / vault and inject it as the CAS property instead of hardcoding.","Restart and confirm the warning no longer appears — its absence proves the key was persisted and picked up.","Distribute identical keys to all CAS nodes in a cluster."],"exampleFix":"// before: warning shows\nGenerated encryption key [abc...] of size [16]. ... settings: cas.ticket.crypto.encryption.key=abc...\n// after: property persisted in application.properties\ncas.ticket.crypto.encryption.key=abc...","handlingStrategy":"validation","validationCode":"// Post-startup check: parse logs and fail deployment if this warning appears\nif (startupLog.contains(\"The generated key MUST be added to CAS settings\")) {\n    throw new IllegalStateException(\"Ephemeral crypto key generated; persist it in configuration\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat this warning as an action item, never as benign noise.","Automate: capture the printed property and write it into your secret store.","Verify on next restart that the warning no longer appears."],"tags":["keys","configuration","logging"],"backgroundTag":"missing-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}