Manage encryption keys

Encryption keys are used to encrypt data entries (connections, user vault, documentation, and attachments). They are generated and stored in the encryption.config file on the server only. To encrypt the data stored in the database, we use our open-source cryptography library.

The encryption.config file cannot be moved directly to another system. It is encrypted using the data protection API (DPAPI), which binds the file to the system where it was originally encrypted. As a result, the file cannot be read or used on a different machine.

To use the encryption configuration on another system, you must export the encryption keys from the original system and then import them on the target system.

The same encryption keys must be used by all Devolutions Server instances in a high availability or load balancing topology that share the same SQL database. The same requirement also applies when performing a migration.

1. Open the Devolutions Server Console.

2. In the Tools tab, click on Export.

   

3. Enter a destination Filename and path, then set a password to protect the file.

   We strongly recommend storing the encryption keys file in a secure storage outside of Devolutions Server such as Devolutions Hub Business, Azure Key Vault, or AWS Key Management Service.

   

4. Click Ok.

Your encryption keys have been exported to the specified destination.

1. Open the Devolutions Server Console on the server.

2. In the Tools tab, click on Import.

   

3. Select the encryption keys file, then enter the password.

   

4. Click Ok.

Once the operation is complete, the new encryption keys are applied to the data in the database.

There may be situations where you need to regenerate the encryption keys, for example if you suspect that your database has been compromised. The following steps explain how to perform this operation.

1. Create a full backup of the database and ensure that the backup is valid and usable.

2. Back up the Devolutions Server web application folder.

3. Export the existing encryption keys. See the export procedure in this page.

4. In the Server tab, switch the Devolutions Server instance to offline mode by clicking Go offline.

   

5. Go to the Tools tab and click on Regenerate.

   

6. Enter a destination Filename and path, then set a password to protect the file.

   We strongly recommend storing the encryption keys file in a secure storage outside of Devolutions Server such as Devolutions Hub Business, Azure Key Vault, or AWS Key Management Service.

   

7. Click Ok.

8. A final warning appears before the regeneration process begins. Click OK again to proceed.

   

The regeneration process will start. Once completed, the status will indicate that the operation has finished.

If errors occur during the regeneration process, follow these instructions to restore the Devolutions Server instance to its previous state:

1. Restore your database to the backup taken just prior to the key regeneration.

2. Navigate to the App_Data folder at the root of your Devolutions Server instance.

3. Rename the encryption.config file to encryption.config.bak (Devolutions Server will now ignore this file).

4. Rename the most recent encryption.<date and time>.config file to encryption.config.

5. Restart the application pool if needed.