Skip to main content
This section describes how Veeam Backup & Replication decrypts backup files encrypted with CryptoHub. In most scenarios, decryption occurs automatically. Manual decryption is required only when Veeam cannot reach CryptoHub or when importing backups with mixed encryption history.

​
How automatic decryption works

When you restore data from a backup encrypted with CryptoHub, Veeam automatically retrieves the decryption key from CryptoHub. No manual intervention is required if the following conditions are met:
  • The Veeam Backup & Replication server has network connectivity to CryptoHub.
  • The CryptoHub KMS server is registered in Veeam with valid certificates.
  • The key used to encrypt the backup has not been destroyed on CryptoHub.
During a restore operation, Veeam performs the following steps:
  1. Reads the encrypted data encryption key (DEK) and key metadata from the backup file.
  2. Sends the encrypted DEK to CryptoHub via KMIP.
  3. CryptoHub decrypts the DEK using the stored private key and returns the plaintext DEK.
  4. Veeam uses the DEK to decrypt the backup data.
If CryptoHub supports OAEP with SHA-1, decryption occurs entirely on CryptoHub and the private key never leaves the HSM boundary. If CryptoHub does not support OAEP with SHA-1, Veeam retrieves the private key, performs decryption locally, and discards the key immediately after the operation.

​
Automatic decryption during import

When you import backup files from external media or a relocated repository, Veeam attempts automatic decryption if the backup was encrypted with a KMS key.

​
Import workflow

  1. Veeam reads the backup metadata and identifies the encryption key ID.
  2. Veeam queries all registered KMS servers for a matching key.
  3. If a match is found, Veeam decrypts the backup automatically.
  4. The backup appears under Backups > Disk (Imported) in the console.
If automatic decryption fails, the backup appears under Backups > Disk (Encrypted) and requires manual decryption.

​
When manual decryption is required

Manual decryption is required in the following scenarios:

​
Manually decrypting backups

Use the following procedure to decrypt backup files that could not be decrypted automatically.

​
Before you begin

Verify the following:
  • You have access to the Veeam Backup & Replication console.
  • CryptoHub is registered as a KMS server in Veeam, or you have configured it as part of this procedure.
  • Network connectivity exists between the Veeam server and CryptoHub.

​
Procedure

1
In the Veeam Backup & Replication console, navigate to Home > Backups > Disk (Encrypted).
2
In the working area, locate the encrypted backup.
3
Right-click the backup and select Specify Password.Alternatively, select the backup and select Specify Password from the ribbon.
4
In the Retrieve Encryption Key from KMS dialog, verify the following fields:
5
If CryptoHub is not registered in Veeam, select Manage KMS to add it. See Adding the KMS server in Veeam for the procedure.
6
Select OK.
Veeam contacts CryptoHub, retrieves the decryption key, and decrypts the backup. The backup moves from Disk (Encrypted) to Disk (Imported).

​
Decrypting backups with multiple encryption keys

If a backup chain was encrypted with multiple keys over time, you must provide all keys to fully decrypt the chain. This occurs when:
  • The KMS key was rotated on CryptoHub and Veeam created backups with both the old and new keys.
  • Encryption was changed from password-based to KMS-based (or vice versa).
  • Different backup files in the chain were encrypted with different KMS servers.

​
Import method determines key requirements

The number of keys you must provide depends on how you import the backup:
When possible, import backups using the VBM metadata file to simplify key management.

​
Procedure for multiple keys

1
In the Veeam Backup & Replication console, navigate to Home > Backups > Disk (Encrypted).
2
Right-click the backup and select Specify Password.
3
If multiple keys are required, Veeam displays the Multiple Passwords dialog with a list of encryption keys.The list shows:
4
For each KMS key in the list:a. Select the key entry.b. Select Set.c. In the dialog, select the CryptoHub server from the KMS server dropdown.d. Select OK.
5
For each password-based key in the list:a. Select the key entry.b. Select Set.c. Enter the encryption password.d. Select OK.
6
After all keys show a valid status, select OK to decrypt the backup.
Veeam decrypts all backup files in the chain using the provided keys. The backup moves to Disk (Imported).

​
Decrypting tape backups

Tape backups encrypted with CryptoHub follow a similar decryption workflow, with additional considerations for tape media handling.

​
Automatic decryption

When you catalog or restore from an encrypted tape, Veeam automatically contacts CryptoHub to retrieve the decryption key if:
  • The tape library or standalone drive is connected and the tape is loaded.
  • CryptoHub is registered in Veeam with valid certificates.
  • Network connectivity exists between the Veeam server and CryptoHub.

​
Manual decryption

If automatic decryption fails, you must decrypt the tape before cataloging or restoring.
1
In the Veeam Backup & Replication console, navigate to Tape Infrastructure > Media Pools.
2
Locate the media pool containing the encrypted tape.
3
Right-click the tape and select Specify Encryption Key.
4
Select the CryptoHub server from the KMS server dropdown.
5
Select OK.
Veeam decrypts the tape catalog and backup data using CryptoHub.
For detailed tape decryption procedures, including offline and disaster recovery scenarios, see the Veeam Backup & Replication User Guide section on tape encryption.

​
Emergency decryption with Veeam Backup Enterprise Manager

If CryptoHub is unavailable due to a disaster or permanent failure, you can decrypt backups using Veeam Backup Enterprise Manager if password loss protection was enabled when the backup was created.

​
Prerequisites

  • Veeam Backup Enterprise Manager is deployed and connected to the Veeam Backup & Replication server.
  • Password loss protection was enabled in the job or storage encryption settings at the time the backup was created.
  • You have access to the Veeam Backup Enterprise Manager web console.

​
How password loss protection works

When password loss protection is enabled, Veeam encrypts a copy of each data encryption key using the Enterprise Manager certificate. This encrypted key copy is stored in the backup file alongside the KMS-encrypted copy. If the KMS key becomes unavailable, Enterprise Manager can decrypt the backup using its own certificate.
Password loss protection must be enabled before creating the backup. You cannot retroactively enable this feature for existing backups.

​
Requesting decryption from Enterprise Manager

1
In the Veeam Backup & Replication console, navigate to Home > Backups > Disk (Encrypted).
2
Right-click the encrypted backup and select Specify Password.
3
In the dialog, select I have lost the password.
4
Veeam generates a decryption request and displays a request ID.
5
Log in to the Veeam Backup Enterprise Manager web console.
6
Navigate to Configuration > Key Management.
7
Locate the pending decryption request and select Approve.
8
Return to the Veeam Backup & Replication console and select OK in the decryption dialog.
Veeam retrieves the decryption key from Enterprise Manager and decrypts the backup. The backup moves to Disk (Imported).
For complete Enterprise Manager decryption procedures, see the Veeam Backup Enterprise Manager User Guide.

​
Troubleshooting decryption failures

Use the following table to diagnose decryption failures.

​
Verifying key availability on CryptoHub

Before troubleshooting Veeam, verify that the encryption key exists and is active on CryptoHub.
1
Log in to the CryptoHub management interface.
2
Navigate to the key management section.
3
Search for the key ID shown in the Veeam decryption dialog.
4
Verify that the key state is Active and has not been destroyed or revoked.
5
Verify that the client certificate used by Veeam has access permissions for the key.