{"record":{"id":"e4ec05346050c465","repo":"apereo/cas","slug":"provided-signing-key-as-a-json-web-key-does-not-ca","errorCode":null,"errorMessage":"Provided signing key as a JSON web key does not carry a private key","messagePattern":"Provided signing key as a JSON web key does not carry a private key","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseStringCipherExecutor.java","lineNumber":203,"sourceCode":"\n    private void configureSigningParameters(final String secretKeySigning) {\n        var signingKeyToUse = secretKeySigning;\n        if (StringUtils.isBlank(signingKeyToUse)) {\n            LOGGER.warn(\"Secret key for signing is not defined for [{}]. CAS will attempt to auto-generate the signing key\", getName());\n            signingKeyToUse = EncodingUtils.generateJsonWebKey(this.signingKeySize);\n            val prop = String.format(\"%s=%s\", getSigningKeySetting(), signingKeyToUse);\n            //CHECKSTYLE:OFF\n            LOGGER.warn(\"Generated signing key [{}] of size [{}] for [{}]. The generated key MUST be added to CAS settings:\\n\\n\\t{}\\n\\n\",\n                signingKeyToUse, this.signingKeySize, getName(), prop);\n            //CHECKSTYLE:ON\n        } else {\n            try {\n                val jwk = (PublicJsonWebKey) EncodingUtils.newJsonWebKey(signingKeyToUse);\n                LOGGER.trace(\"Parsed signing key as a JSON web key for [{}] with kid [{}]\", getName(), jwk.getKeyId());\n                if (jwk.getPrivateKey() == null) {\n                    val msg = \"Provided signing key as a JSON web key does not carry a private key\";\n                    LOGGER.error(msg);\n                    throw new RuntimeException(msg);\n                }\n                setSigningKey(jwk.getPrivateKey());\n            } catch (final Exception e) {\n                LOGGER.trace(\"Unable to recognize signing key for [{}] as a JSON web key: [{}].\", getSigningKeySetting(), e.getMessage());\n                LOGGER.debug(\"Using pre-defined signing key to use for [{}]\", getSigningKeySetting());\n            }\n        }\n        configureSigningKey(signingKeyToUse);\n    }\n\n    private void configureEncryptionParameters(final String secretKeyEncryption, final String contentEncryptionAlgorithmIdentifier) {\n        var secretKeyToUse = secretKeyEncryption;\n        if (StringUtils.isBlank(secretKeyToUse)) {\n            LOGGER.warn(\"Secret key for encryption is not defined for [{}]; CAS will attempt to auto-generate the encryption key\", getName());\n            secretKeyToUse = EncodingUtils.generateJsonWebKey(this.encryptionKeySize);\n            val prop = String.format(\"%s=%s\", getEncryptionKeySetting(), secretKeyToUse);\n            //CHECKSTYLE:OFF\n            LOGGER.warn(\"Generated encryption key [{}] of size [{}] for [{}]. The generated key MUST be added to CAS settings:\\n\\n\\t{}\\n\\n\",","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseStringCipherExecutor.java#L185-L221","documentation":"During signing-key configuration, the provided signing secret parsed as a JSON web key (JWK), but that JWK carries no private key material. Signing requires the private key, so configuration aborts with RuntimeException. The input at fault is the signing key property: a public-only JWK was supplied where a private/public JWK pair is required.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseStringCipherExecutor.java:203 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a JWK that includes the private key ('d' parameter) for signing","Generate a fresh key pair via CAS key-generation endpoints or jose tooling and store the full JWK","If only signing/verification is intended, configure the key so the public-key path is used instead"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}