> ## Documentation Index
> Fetch the complete documentation index at: https://cockroachlabs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# cockroach debug encryption-decrypt

export const InternalLink = ({version, path = "", children, ...props}) => {
  let detectedVersion = version || "stable";
  if (typeof window !== 'undefined' && !version) {
    const match = window.location.pathname.match(/\/docs\/([^/]+)/);
    if (match) {
      detectedVersion = match[1];
    }
  }
  const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
  return <a href={`/docs/${detectedVersion}/${normalizedPath}`} {...props}>
      {children}
    </a>;
};

<Danger>
  We strongly recommend only using `cockroach debug encryption-decrypt` when working directly with the <InternalLink path="support-resources">Cockroach Labs support team</InternalLink>.
</Danger>

The <InternalLink path="cockroach-commands">`cockroach debug encryption-decrypt`</InternalLink> command decrypts store files on a node that are <InternalLink path="encryption">encrypted at rest</InternalLink> so that they can be examined to add more context to logs gathered from the <InternalLink path="cockroach-debug-zip">`cockroach debug zip`</InternalLink> command. Unless they are decrypted, Cockroach Labs cannot examine store files that are encrypted at rest.

## Synopsis

```shell theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
cockroach debug encryption-decrypt {store_directory} {input_file} {output_file} --enterprise-encryption={encryption_spec} {flags}
```

Replace:

* <code>{'{encryption_spec}'}</code>: The cluster's <InternalLink path="encryption#starting-a-node-with-encryption">encryption details</InternalLink>.
* <code>{'{store_directory}'}</code>: The directory where the node <InternalLink path="cockroach-start#store">stores data files</InternalLink>.
* <code>{'{input_file}'}</code>: The name of an encrypted store file.
* <code>{'{output_file}'}</code>: A name for the decrypted store file. If not specified, the command will output the decrypted contents to `stdout`.

Run the command locally on a node. It does not support the `--url` flag.

After running the command, you can send the requested decrypted file to Cockroach Labs.

## Subcommands

While the `cockroach debug` command has a few subcommands, users are expected to use only the <InternalLink path="cockroach-debug-zip">`zip`</InternalLink>, <InternalLink path="cockroach-debug-encryption-active-key">`encryption-active-key`</InternalLink>, <InternalLink path="cockroach-debug-merge-logs">`merge-logs`</InternalLink>, <InternalLink path="cockroach-debug-list-files">`list-files`</InternalLink>, <InternalLink path="cockroach-debug-tsdump">`tsdump`</InternalLink>, and <InternalLink path="cockroach-debug-ballast">`ballast`</InternalLink> subcommands.

We recommend using the <InternalLink path="cockroach-debug-encryption-decrypt">`encryption-decrypt`</InternalLink> and <InternalLink path="cockroach-debug-job-trace">`job-trace`</InternalLink> subcommands only when directed by the <InternalLink path="support-resources">Cockroach Labs support team</InternalLink>.

The other `debug` subcommands are useful only to Cockroach Labs. Output of `debug` commands may contain sensitive or secret information.

## Flags

The `debug encryption-decrypt` subcommand supports the following [general-use](#general) and [client connection](#client-connection) flags.

### General

| Flag        | Description                                                                                                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--timeout` | Return an error if the command does not conclude within a specified nonzero value. The timeout is suffixed with `s` (seconds), `m` (minutes), or `h` (hours). For example:<br /><br />`--timeout=2m` |

### Client connection

| Flag                                                       | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--user`<br /><br />`-u`                                   | The <InternalLink path="create-user">SQL user</InternalLink> that will own the client session.<br /><br />**Env Variable:** `COCKROACH_USER`<br />**Default:** `root`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| `--insecure`                                               | Use an insecure connection.<br /><br />**Env Variable:** `COCKROACH_INSECURE`<br />**Default:** `false`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| <a id="flags-cert-principal-map" /> `--cert-principal-map` | A comma-separated list of `<cert-principal:<db-principal` mappings. This allows mapping the principal in a certificate to a DB principal such as `node` or `root` or any SQL user. This is intended for use in situations where the certificate management system places restrictions on the `Subject.CommonName` or `SubjectAlternateName` fields in the certificate (e.g., disallowing a `CommonName` like `node` or `root`). If multiple mappings are provided for the same `<cert-principal`, the last one specified in the list takes precedence. A principal not specified in the map is passed through as-is via the identity function. A certificate is allowed to authenticate a DB principal if the DB principal name is contained in the mapped `CommonName` or DNS-type `SubjectAlternateName` fields. |
| `--certs-dir`                                              | The path to the <InternalLink path="cockroach-cert">certificate directory</InternalLink> containing the CA and client certificates and client key.<br /><br />**Env Variable:** `COCKROACH_CERTS_DIR`<br />**Default:** `${HOME}/.cockroach-certs/`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |

## Files

The `cockroach debug encryption-decrypt` command will output the decrypted store file to the specified location. If no location is specified, the decrypted contents are sent to`stdout`.

## See also

* <InternalLink path="support-resources">Support Resources</InternalLink>
* <InternalLink path="cockroach-commands">`cockroach` Commands Overview</InternalLink>
* <InternalLink path="troubleshooting-overview">Troubleshooting Overview</InternalLink>
* <InternalLink path="support-resources">Support Resources</InternalLink>