Don\u2019t you hate mysterious, scary errors?\u00a0 How about this one?<\/p>\n
A critical incident has occurred where the Secure Store service application errored out because the master encryption key was not found.<\/strong><\/p>\n Another error:<\/p>\n The Microsoft Secure Store Service application Secure Store Services failed to retrieve the master secret key.\u00a0 The error returned was: \u2018Unable to obtain master key.<\/strong><\/p>\n While obscure, this was easily solved. It seems the Secure Store Service encrypts the database of credentials.\u00a0 When a new server joins the farm, it doesn\u2019t yet have the decryption key.\u00a0 Hence the above error occurs when the\u00a0Secure Store Service<\/strong>\u00a0is started on the newly joined farm server.<\/p>\n To fix it, in Central Admin, go to the Manage Service Applications, select Secure Store Service and click on \u201cRefresh Key\u201d.\u00a0 This propagates the key to all servers.<\/p>\n I did a Generate New Key for good measure, requiring a Passphrase (entered twice, of sufficient complexity).<\/p>\n I waited a minute for it to propagate, and started the service on the server, and checked ULS logs to confirm all was well in my happy farm.<\/p>\n With my small set of Secure Store Application IDs (ten or so) my Secure Store database size was around 11MB, comparatively tiny.<\/p>\n Then again, how much space could a dozen credentials take up?<\/p>\n Additional Read<\/strong><\/p>\n