{"record":{"id":"e499ec8f0f3e9c08","repo":"apereo/cas","slug":"could-not-locate-rsa-json-web-key-from-keystore","errorCode":null,"errorMessage":"Could not locate RSA JSON web key from keystore","messagePattern":"Could not locate RSA JSON web key from keystore","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java","lineNumber":104,"sourceCode":"\n    @Override\n    public String encode(final Serializable value, final Object[] parameters) {\n        configureSigningParametersForEncoding();\n        configureEncryptionParametersForEncoding();\n        return super.encode(value, parameters);\n    }\n\n    @Override\n    public String decode(final Serializable value, final Object[] parameters) {\n        configureSigningParametersForDecoding();\n        configureEncryptionParametersForDecoding();\n        return super.decode(value, parameters);\n    }\n\n    private void configureSigningParametersForDecoding() {\n        val result = findRsaJsonWebKeyByProvidedKeyId(webKeySet.getJsonWebKeys());\n        if (result.isEmpty()) {\n            throw new IllegalArgumentException(\"Could not locate RSA JSON web key from keystore\");\n        }\n        val key = result.get();\n        if (key.getPublicKey() == null) {\n            throw new IllegalArgumentException(\"Public key located from keystore for key id \" + key.getKeyId() + \" is undefined\");\n        }\n        setSigningKey(key.getPublicKey());\n    }\n\n    private void configureEncryptionParametersForDecoding() {\n        FunctionUtils.doUnchecked(param -> {\n            if (httpsJkws.isEmpty()) {\n                LOGGER.debug(\"No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped\");\n            } else {\n                val keys = this.httpsJkws.get().getJsonWebKeys();\n                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);\n\n                if (encKeyResult.isEmpty()) {\n                    throw new IllegalArgumentException(\"Could not locate RSA JSON web key from endpoint\");","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java#L86-L122","documentation":"While preparing decoding (signature verification) parameters, no RSA JWK matching the configured key id was found in the locally configured JWK set (webKeySet keystore). IllegalArgumentException aborts decode because a payload signed with the corresponding key cannot be verified. The input at fault is the keystore JWKS content or the keyIdToUse setting.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:104 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the JWK set resource (keystore JWKS) is loaded and contains an RSA key","Check the configured key id matches a kid present in the JWK set","Regenerate/synchronize the signing key pair between the encrypting and verifying parties"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}