Azure Backup
An Azure backup service that provides built-in management at scale.
1,299 questions
Restore backups created with Azure Backup Vault
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 59%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Sofie Svensson
0
Reputation points
I have a backup vault in Azure that store long term backups of my Azure Database for PostgreSQL - Flexible Servers.
Problem is that I can't restore the backups. When I restore the backups in the portal, the .sql files are restored to the selected blob storage as they should. I can download the file 'database.sql' but the content is encrypted. The database and the backup vault use different customer managed keys (CMK). I have access to both RSA keys, but decryption won't work
% openssl pkeyutl -decrypt -inkey rsa.pem -in database.sql -out decrypted_database.sql
Public Key operation error 000C82FE01000000:error:0200006C:rsa routines:rsa_ossl_private_decrypt:data greater than mod len:crypto/rsa/rsa_ossl.c:561:
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 0%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESW%3C/text%3E%3C/svg%3E)
Silvia Wibowo 4,006 Reputation points Microsoft Employee2024-11-27T04:30:28.4333333+00:00 Hi @Sofie Svensson , did you use:
- Back up Azure Database for PostgreSQL Flexible server with long-term retention (preview)?
- pg_dump? If this is the case: to restore your server from manual backups by using tools like pg_dump, you can first create an Azure Database for PostgreSQL flexible server instance and then restore your databases to the server by using pg_restore.
As far as I know, you can't use CMK manually to decrypt data, as Azure Backup and Azure Storage have their own mechanism to encrypt/decrypt using CMK. CMK is the KEK (key encryption key), while the key to encrypt/decrypt the data is DEK (data encryption key). DEK is stored in the Azure Storage, encrypted with KEK. KEK is asymmetric encryption, DEK is symmetric encryption.
Sign in to comment
Sign in to answer