Skip to content

Use the current --enc-c flag in the SSE-C examples #1523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eknathdj wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Use the current --enc-c flag in the SSE-C examples #1523

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
27c8c6b
Use the current --enc-c flag in the SSE-C examples
eknathdj Oct 27, 2026
f378a69
Use unpadded Raw Base64 keys in the SSE-C examples
eknathdj Oct 28, 2026
911249e
docs: pass SSE-C key mappings as separate options
eknathdj Oct 29, 2026
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions source/administration/server-side-encryption/server-side-encryption-sse-c.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,10 +101,12 @@ The resulting string is appropriate for non-production environments:
.. code-block:: shell
:class: copyable

cat /dev/urandom | head -c 32 | base64 -
cat /dev/urandom | head -c 32 | base64 - | tr -d '='

Defer to your organizations requirements for generating cryptographically secure encryption keys.

Raw Base64 encoding rejects ``=``-padded keys, so the example above removes any trailing padding from the generated string.

Copy the encryption key for use in the next step.

2) Encrypt an Object using SSE-C
Expand All @@ -126,7 +128,7 @@ arguments for enabling SSE-S3 encryption:
:class: copyable

mc cp ~/data/mydata.json ALIAS/BUCKET/mydata.json \
--encrypt-key "ALIAS/BUCKET/=c2VjcmV0ZW5jcnlwdGlvbmtleWNoYW5nZW1lMTIzNAo="
--enc-c "ALIAS/BUCKET/=c2VjcmV0ZW5jcnlwdGlvbmtleWNoYW5nZW1lMTIzNAo"

- Replace :mc-cmd:`ALIAS <mc encrypt set ALIAS>` with the
:mc:`alias <mc alias>` of the MinIO deployment on which you want to write
Expand Down Expand Up @@ -158,7 +160,8 @@ arguments for enabling SSE-S3 encryption:
:class: copyable

mc cp SOURCE/BUCKET/mydata.json TARGET/BUCKET/mydata.json \
--encrypt-key "SOURCE/BUCKET/=c2VjcmV0ZW5jcnlwdGlvbmtleWNoYW5nZW1lMTIzNAo=,TARGET/BUCKET/=c2VjcmV0ZW5jcnlwdGlvbmtleWNoYW5nZW1lMTIzNAo="
--enc-c "SOURCE/BUCKET/=c2VjcmV0ZW5jcnlwdGlvbmtleWNoYW5nZW1lMTIzNAo" \
--enc-c "TARGET/BUCKET/=c2VjcmV0ZW5jcnlwdGlvbmtleWNoYW5nZW1lMTIzNAo"

- Replace :mc-cmd:`SOURCE/BUCKET <mc encrypt set ALIAS>` with the
:mc:`alias <mc alias>` of the MinIO deployment from which you are reading the
Expand Down