# Databag Encryption

**URL:** https://discourse.chef.io/t/databag-encryption/13277
**Category:** Chef Infra (archive)
**Created:** [July 10, 2018, 3:33pm UTC](https://discourse.chef.io/t/databag-encryption/13277 "2018-07-10T15:33:00Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![deb](https://avatars.discourse-cdn.com/v4/letter/d/ecccb3/32.png) [@deb](https://discourse.chef.io/u/deb)
#### Post date: [July 10, 2018, 3:33pm UTC](https://discourse.chef.io/t/databag-encryption/13277/1 "2018-07-10T15:33:00Z")

</div>

Hi,

We have uploaded encrypted databags to chef server,while running chef-client from node it's not decrypting the json files inside databag,Though the secret key is present in the location C:\Chef.

Decryption happens from the workstation through the command knife data bag show.

![image](https://sea2.discourse-cdn.com/flex016/images/transparent.png)

---

<div class="post-metadata">

### Author: ![Pcguy88](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@Pcguy88](https://discourse.chef.io/u/Pcguy88)
#### Post date: [July 10, 2018, 4:23pm UTC](https://discourse.chef.io/t/databag-encryption/13277/2 "2018-07-10T16:23:23Z")

</div>

I don’t know what process inside your recipe you are using to decrypt the data bag, but are you telling the recipe where to find the secret key in order for the decryption to find it?

For example here is how my logic looks in my recipes that do this:

mydatabag = data\_bag\_item('mydatabag', 'mydatabagitem', IO.read('C:\chef\cache\encrypted\_data\_bag\_secret'))

![](https://sea2.discourse-cdn.com/flex016/images/transparent.png)

![](https://sea2.discourse-cdn.com/flex016/images/transparent.png)

---

<div class="post-metadata">

### Author: ![suthir](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/suthir/32/2280_2.png) [@suthir](https://discourse.chef.io/u/suthir)
#### Post date: [July 11, 2018, 7:11am UTC](https://discourse.chef.io/t/databag-encryption/13277/3 "2018-07-11T07:11:28Z")

</div>

Hello @deb, It looks like you might have missed to specify `/encrypted_data_bag_secret` while bootstrapping the node. You can rerun the bootstrap with `--secret-file` option should resolve this issue.

---

<div class="post-metadata">

### Author: ![sandy](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@sandy](https://discourse.chef.io/u/sandy)
#### Post date: [July 11, 2018, 8:19am UTC](https://discourse.chef.io/t/databag-encryption/13277/4 "2018-07-11T08:19:06Z")

</div>

Hi suthir, actually we have migrated from hosted chef to on prem chef server. So we are not bootraping the nodes again. We are changing the old chef URL to the new one and running chef client on the node.  
That is when we are getting this error.

---

<div class="post-metadata">

### Author: ![deb](https://avatars.discourse-cdn.com/v4/letter/d/ecccb3/32.png) [@deb](https://discourse.chef.io/u/deb)
#### Post date: [July 11, 2018, 9:59am UTC](https://discourse.chef.io/t/databag-encryption/13277/5 "2018-07-11T09:59:24Z")

</div>

Hi ,

Thanks for the help, we have defined the same in the client.rb.

Regards  
Dev

---

<div class="post-metadata">

### Author: ![suthir](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/suthir/32/2280_2.png) [@suthir](https://discourse.chef.io/u/suthir)
#### Post date: [July 11, 2018, 2:22pm UTC](https://discourse.chef.io/t/databag-encryption/13277/6 "2018-07-11T14:22:52Z")

</div>

Cool. updating `encrypted data bag path` directly on `client.rb` should work as it the same as running through knife bootstrap.

---

<div class="post-metadata">

### Author: ![deb](https://avatars.discourse-cdn.com/v4/letter/d/ecccb3/32.png) [@deb](https://discourse.chef.io/u/deb)
#### Post date: [July 11, 2018, 2:27pm UTC](https://discourse.chef.io/t/databag-encryption/13277/7 "2018-07-11T14:27:15Z")

</div>

Thanks for the help @suthir