{"record":{"id":"c09b351c6158e8f0","repo":"apereo/cas","slug":"ticket-registry-encryption-signing-for-is-not","errorCode":null,"errorMessage":"Ticket registry encryption/signing for [{}] is not enabled explicitly in the configuration, yet signing/encryption keys are defined for ticket operations. CAS will proceed to enable the ticket registry encryption/signing functionality. If you intend to turn off this behavior, consider removing/disabling the signing/encryption keys defined in settings","messagePattern":"Ticket registry encryption/signing for \\[(.+?)\\] is not enabled explicitly in the configuration, yet signing/encryption keys are defined for ticket operations\\. CAS will proceed to enable the ticket registry encryption/signing functionality\\. If you intend to turn off this behavior, consider removing/disabling the signing/encryption keys defined in settings","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-tickets-api/src/main/java/org/apereo/cas/util/CoreTicketUtils.java","lineNumber":49,"sourceCode":"        return newTicketRegistryCipherExecutor(registry, false, registryName);\n    }\n\n    /**\n     * New ticket registry cipher executor cipher executor.\n     *\n     * @param cryptoProps         the registry\n     * @param forceIfBlankKeys the force if blank keys\n     * @param registryName     the registry name\n     * @return the cipher executor\n     */\n    public static CipherExecutor newTicketRegistryCipherExecutor(\n        final EncryptionRandomizedSigningJwtCryptographyProperties cryptoProps,\n        final boolean forceIfBlankKeys, final String registryName) {\n\n        val enabled = FunctionUtils.doIf(\n            !cryptoProps.isEnabled() && StringUtils.isNotBlank(cryptoProps.getEncryption().getKey()) && StringUtils.isNotBlank(cryptoProps.getSigning().getKey()),\n            () -> {\n                LOGGER.warn(\"Ticket registry encryption/signing for [{}] is not enabled explicitly in the configuration, yet signing/encryption keys \"\n                            + \"are defined for ticket operations. CAS will proceed to enable the ticket registry encryption/signing functionality. \"\n                            + \"If you intend to turn off this behavior, consider removing/disabling the signing/encryption keys defined in settings\", registryName);\n                LOGGER.debug(\"Defined signing key is [{}], and defined encryption key is [{}]\", cryptoProps.getSigning().getKey(),\n                    cryptoProps.getEncryption().getKey());\n                return Boolean.TRUE;\n            },\n            cryptoProps::isEnabled\n        ).get();\n\n\n        if (enabled || forceIfBlankKeys) {\n            LOGGER.debug(\"Ticket registry encryption/signing is enabled for [{}]\", registryName);\n            return new DefaultTicketCipherExecutor(\n                cryptoProps.getEncryption().getKey(),\n                cryptoProps.getSigning().getKey(),\n                cryptoProps.getAlg(),\n                cryptoProps.getSigning().getKeySize(),\n                cryptoProps.getEncryption().getKeySize(),","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-tickets-api/src/main/java/org/apereo/cas/util/CoreTicketUtils.java#L31-L67","documentation":"CoreTicketUtils.newTicketRegistryCipherExecutor detects a configuration contradiction: crypto properties declare both signing and encryption keys, but the 'enabled' flag is not explicitly turned on. CAS auto-enables the cipher executor and warns so the operator notices the implicit behavior change rather than silently ignoring defined keys.","triggerScenarios":"Setting cas.ticket.registry.crypto.encryption.key and cas.ticket.registry.crypto.signing.key while leaving cas.ticket.registry.crypto.enabled=false (or unset) when building a ticket registry cipher executor with forceIfBlankKeys semantics.","commonSituations":"Operators paste keys from docs/tutorials but skip the enabled property; upgrades where key properties were added but the enable flag was reset; template configs that pre-generate keys for all registries.","solutions":["Explicitly set cas.ticket.registry.crypto.enabled=true if you want encryption/signing (which is what CAS is now doing anyway)","Remove the encryption/signing key properties entirely to truly disable ticket registry encryption/signing","Review which registryName is reported and align its specific crypto properties (e.g. cas.ticket.registry.crypto.* vs per-registry variants)","After changing config, restart and confirm the warning no longer appears"],"exampleFix":"// before (application.yml)\ncas:\n  ticket:\n    registry:\n      crypto:\n        enabled: false\n        encryption:\n          key: \"...\n        signing:\n          key: \"...\n// after\ncas:\n  ticket:\n    registry:\n      crypto:\n        enabled: true\n        encryption:\n          key: \"...\n        signing:\n          key: \"...","handlingStrategy":"validation","validationCode":"// startup check\nif (keysDefined && !cryptoEnabled) log.warn(\"keys defined but crypto disabled; CAS will auto-enable\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep crypto.enabled and the key properties consistent: either both set or neither","Generate keys with the CAS-provided keygen tooling and commit the full property block","Audit all cas.ticket.registry.crypto.* namespaces after upgrades for drifted settings"],"tags":["configuration","crypto","ticket-registry","signing"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}