Sample Script for Generating BYOK Secrets for Backup & Recover Next and Data 360

2025_dc_rootkeygen.sh file contents. You can run this script on Linux or MacOs systems.

This script generates a secure root key that’s compatible with Backup & Recover Next and Data 360 data stores. You provide the import token and certificate that you generated on the BYOK page.

• Check that a certificate name is passed in and that it’s retrievable. Exit on failure.
• Extract the public key from the certificate. Exit on failure.
• Create the actual key material (in this script we use a 32-bit random number) as a file named PlainTextKeyMaterial.bin.
• Use openssl to wrap (encrypt) the PlainTextKeyMaterial.bin file with the certificate public key using the RSAES_OAEP_SHA_256 and RSA_4096 wrapping protocols. This process produces the EncryptedKeyMaterial.bin file.
• Optionally delete the interim plaintext files and the PublicKey.b64 input file.

You can then upload the EncryptedKeyMaterial.bin file and original import token to Salesforce.

#!/bin/bash
## BYOK for Backup & Recover Next Data 360 sample script to generate and prepare a root key for upload.
## Pass in as parameter: Certificate file (.crt) downloaded from the
##  Generate Certificate page (referred in this script as certificate.crt or CERT_FILE).

## Validate input parameter
if [ -z "$1" ]; then
    echo "Error: Please provide a certificate file as parameter."
    echo "Usage: ./2025_dc_rootkeygen.sh certificate.crt."
    exit 1
fi

if [ ! -f "$1" ]; then
    echo "Error: File '$1' not found."
    exit 1
fi

CERT_FILE="$1"
PUBLIC_KEY_FILE="public_key.pem"

## Step 1: Extract public key from certificate
echo "Extracting public key from certificate..."
openssl x509 -in "$CERT_FILE" -pubkey -noout > "$PUBLIC_KEY_FILE"

if [ $? -ne 0 ]; then
    echo "Error: Failed to extract public key from certificate."
    exit 1
fi

echo "Public key extracted to $PUBLIC_KEY_FILE."

## 3.0 Generate Key material as PlaintextKeyMaterial.bin
openssl rand -out PlaintextKeyMaterial.bin 32

## 3.1 wrap key material
# Note: we are using RSAES_OAEP_SHA_256 and RSA_4096 for wrapping
# Using PEM format public key directly
openssl pkeyutl \
    -encrypt \
    -in PlaintextKeyMaterial.bin \
    -out EncryptedKeyMaterial.bin \
    -inkey "$PUBLIC_KEY_FILE" \
    -keyform PEM \
    -pubin \
    -pkeyopt rsa_padding_mode:oaep \
    -pkeyopt rsa_oaep_md:sha256 \
    -pkeyopt rsa_mgf1_md:sha256

echo "=== Output file:"
echo "    EncryptedKeyMaterial.bin created." 

## Optional cleanup. Remove the # from the next two lines if you want to delete the files automatically
# rm PlaintextKeyMaterial.bin
# rm "$PUBLIC_KEY_FILE"