# Unable to restore encrypted backups in 7.x

**URL:** <https://forums.foundationdb.org/t/unable-to-restore-encrypted-backups-in-7-x/4717>\
**Category:** Using FoundationDB\
**Created:** [November 29, 2024, 5:26pm UTC](https://forums.foundationdb.org/t/unable-to-restore-encrypted-backups-in-7-x/4717 "2024-11-29T17:26:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamesreprise](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/jamesreprise/32/1854_2.png) [@jamesreprise](https://forums.foundationdb.org/u/jamesreprise)\
**Post date:** [November 29, 2024, 5:26pm UTC](https://forums.foundationdb.org/t/unable-to-restore-encrypted-backups-in-7-x/4717/1 "2024-11-29T17:26:04Z")

</div>

By providing `--encryption-key-file` to `fdbbackup`, I have been able to create encrypted backups in AWS S3. I generated this key using `openssl rand 32 > key`.

However, when attempting to restore those backups using `fdbrestore` with `--encryption-key-file` pointed to the same key, I am unable to begin the restore process. The initial error is:

```auto
ERROR: HTTP response code not received or indicated failure

```

Upon digging further with `--knob_http_verbose_level=3`, the error is:

```auto
-- RESPONSE CONTENT--
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidRange</Code><Message>The requested range is not satisfiable</Message><RangeRequested>bytes=4096-8191</RangeRequested><ActualObjectSize>14</ActualObjectSize><RequestId>[REDACTED_REQUEST_ID]</RequestId><HostId>[REDACTED_HOST_ID]</HostId></Error>

```

Where it seems the restore process requested: `Request Header: Range: bytes=4096-8191` of `log_end_version`, where S3 previously informed the process it only has `Reponse Header: Content-Length: 14`. In some instances, the same type of error (requesting more bytes than are available) occurs for `mutation_log_type` rather than `log_end_version`.

This problem does not occur when the `--encryption-key-file` flag is not present.

I have observed this behaviour in 7.1.65, 7.3.37 and 7.3.57.

Has anyone managed to successfully backup and restore data simply using `--encryption-key-file`? If so, I would be grateful if you could provide the commands used to start the backup as well as the restore.

---

<div class="post-metadata">

**Author:** ![jzhou](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/jzhou/32/445_2.png) [@jzhou](https://forums.foundationdb.org/u/jzhou)\
**Post date:** [December 4, 2024, 1:48am UTC](https://forums.foundationdb.org/t/unable-to-restore-encrypted-backups-in-7-x/4717/2 "2024-12-04T01:48:28Z")

</div>

You are on the bleeding edge! 😅 The `--encryption-key-file` is a community contributed feature that we haven’t really tested/used.

---

<div class="post-metadata">

**Author:** ![jamesreprise](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/jamesreprise/32/1854_2.png) [@jamesreprise](https://forums.foundationdb.org/u/jamesreprise)\
**Post date:** [December 4, 2024, 9:20am UTC](https://forums.foundationdb.org/t/unable-to-restore-encrypted-backups-in-7-x/4717/3 "2024-12-04T09:20:56Z")

</div>

I see! I took from all the activity from 2020-2021 that this was merged in and supported [Add --encryption\_key\_file command line argument to fdbbackup and fdbr… · apple/foundationdb@f5aa3df · GitHub](https://github.com/apple/foundationdb/commit/f5aa3df917b90363fd1324b34bfd720ec0af085b)

This feature would be valuable right now - again curious if anyone is actively using it. Perhaps the Snowflake team as they seem to have added this?