Check whether fernet key is existed

Looks like the fernet key that was used to encrypt the token when Keystone had issued it has been already rotated out and/or is simply not present on a keystone node that attempts to validate this token. In effect, Keystone can not decrypt the token as the decryption produces garbage which is "not a recognized Fernet token" as error says.

So I suggest you:

• check that your keys are properly distributed after they have been rotated, see https://docs.openstack.org/keystone/l...
• check the number of fernet keys and how frequently are they rotated vs how long your token expiration is to ensure fernet keys are not rotated out too soon. Also you have to factor in service auth if it is enabled (which allows to validate expired tokens for some additional time). See https://docs.openstack.org/keystone/l... for more details

Hey, which OpenStack version you're using? Logs from /varr/log/keystone/* might provide some more details.