Database encryption after upgrade to 2.4.0.0

coral6691 · September 23, 2026, 8:05am

I upgraded to 2.4.0.0 on my Ubuntu 24.04.05 machine. Duplicati seemed to run fine after rebooting (successfully completed a LAN backup) but got this message on start (from terminal only):

The database appears to be encrypted, but no key was specified. Opening the database will likely fail. Use the environment variable SETTINGS_ENCRYPTION_KEY to specify the key.

I do not remember setting an encryption key, so I followed the instructions in the changelog to create a new encryption key using a preload.json file. Unfortunately Duplicati now crashes on start with “Encryption key used to encrypt target settings does not match current key.” This is the full crash message:

Duplicati.Library.Interface.UserInformationException: Server crashed on startup
—> System.Exception: A serious error occurred in Duplicati: Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key.
at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key)
at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key)
at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.b__0(IDataReader rd)
at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext() at System.Linq.Enumerable.<ToArray>g__EnumerableToArray|324_0[TSource](IEnumerable1 source)
at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep)
at Duplicati.Server.Database.Connection.GetSettings(Int64 id)
at Duplicati.Server.Database.ServerSettings.ReloadSettings()
at Duplicati.Server.Database.ServerSettings..ctor(Connection con)
at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter)
at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption) at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args) ---> Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key. at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key) at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key) at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.<GetSettings>b__0(IDataReader rd) at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext()
at System.Linq.Enumerable.g__EnumerableToArray|324_0[TSource](IEnumerable1 source) at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep) at Duplicati.Server.Database.Connection.GetSettings(Int64 id) at Duplicati.Server.Database.ServerSettings.ReloadSettings() at Duplicati.Server.Database.ServerSettings..ctor(Connection con) at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter) at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption)
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args)
— End of inner exception stack trace —
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args)
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper.<>c__DisplayClass5_0.<.ctor>b__0(Object _)
— End of inner exception stack trace —
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper..ctor(IApplicationSettings applicationSettings, String[] args)
at Duplicati.GUI.TrayIcon.Program.RunMain(String[] _args)
at Duplicati.GUI.TrayIcon.Program.Main(String[] _args)

I have tried to remove the preload.json file but that made no difference. Any idea how to fix this? I can live with no encryption of the local database as this system is not critical, if that helps.

kenkendk · September 23, 2026, 10:15am

This is a logic bug where the check for the encryption key is done too early. The encryption key is then in the default secret provider. For Ubuntu, you can open “Seahorse” and you should see the duplicati-server-encryption-key secret in there.

That is because the settings are encrypted with a different key, and the preload.json overrides the default value, so now it fails.

It should fix the issue if you remove the preload.json because you are then back to the default secret provider.

There are a few options.

Ignore the warning on startup. It is wrong.
Start with --disable-db-encryption to remove encryption
Use the key from Seahorse in preload.json so they agree.

coral6691 · September 23, 2026, 12:25pm

Hi Ken,

First, thank you for the quick response. Unfortunately Duplicati is still failing to load. I created a new preload.json with the key from Seahorse. Loading from the command line generates this:

Crash!
Duplicati.Library.Interface.UserInformationException: Server crashed on startup
—> System.Exception: A serious error occurred in Duplicati: Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key.
at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key)
at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key)
at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.b__0(IDataReader rd)
at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext() at System.Linq.Enumerable.<ToArray>g__EnumerableToArray|324_0[TSource](IEnumerable1 source)
at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep)
at Duplicati.Server.Database.Connection.GetSettings(Int64 id)
at Duplicati.Server.Database.ServerSettings.ReloadSettings()
at Duplicati.Server.Database.ServerSettings..ctor(Connection con)
at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter)
at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption) at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args) ---> Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key. at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key) at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key) at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.<GetSettings>b__0(IDataReader rd) at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext()
at System.Linq.Enumerable.g__EnumerableToArray|324_0[TSource](IEnumerable1 source) at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep) at Duplicati.Server.Database.Connection.GetSettings(Int64 id) at Duplicati.Server.Database.ServerSettings.ReloadSettings() at Duplicati.Server.Database.ServerSettings..ctor(Connection con) at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter) at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption)
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String _args)
— End of inner exception stack trace —
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String _args)
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper.<>c__DisplayClass5_0.<.ctor>b__0(Object _)
— End of inner exception stack trace —
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper..ctor(IApplicationSettings applicationSettings, String args)
at Duplicati.GUI.TrayIcon.Program.RunMain(String _args)
at Duplicati.GUI.TrayIcon.Program.Main(String _args)

Loading it from the terminal with the --disable-db-encryption option generates this:

The database appears to be encrypted, but no key was specified. Opening the database will likely fail. Use the environment variable SETTINGS_ENCRYPTION_KEY to specify the key.
Crash!
Duplicati.Library.Interface.UserInformationException: Server crashed on startup
—> System.Exception: A serious error occurred in Duplicati: Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key.
at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key)
at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key)
at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.b__0(IDataReader rd)
at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext() at System.Linq.Enumerable.<ToArray>g__EnumerableToArray|324_0[TSource](IEnumerable1 source)
at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep)
at Duplicati.Server.Database.Connection.GetSettings(Int64 id)
at Duplicati.Server.Database.ServerSettings.ReloadSettings()
at Duplicati.Server.Database.ServerSettings..ctor(Connection con)
at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter)
at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption) at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args) ---> Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key. at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key) at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key) at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.<GetSettings>b__0(IDataReader rd) at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext()
at System.Linq.Enumerable.g__EnumerableToArray|324_0[TSource](IEnumerable1 source) at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep) at Duplicati.Server.Database.Connection.GetSettings(Int64 id) at Duplicati.Server.Database.ServerSettings.ReloadSettings() at Duplicati.Server.Database.ServerSettings..ctor(Connection con) at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter) at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption)
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String _args)
— End of inner exception stack trace —
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String _args)
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper.<>c__DisplayClass5_0.<.ctor>b__0(Object _)
— End of inner exception stack trace —
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper..ctor(IApplicationSettings applicationSettings, String args)
at Duplicati.GUI.TrayIcon.Program.RunMain(String _args)
at Duplicati.GUI.TrayIcon.Program.Main(String _args)

Loading from the GUI in a similar manner:

Duplicati.Library.Interface.UserInformationException: Server crashed on startup
—> System.Exception: A serious error occurred in Duplicati: Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key.
at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key)
at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key)
at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.b__0(IDataReader rd)
at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext() at System.Linq.Enumerable.<ToArray>g__EnumerableToArray|324_0[TSource](IEnumerable1 source)
at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep)
at Duplicati.Server.Database.Connection.GetSettings(Int64 id)
at Duplicati.Server.Database.ServerSettings.ReloadSettings()
at Duplicati.Server.Database.ServerSettings..ctor(Connection con)
at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter)
at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption) at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String[] _args) ---> Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: Encryption key used to encrypt target settings does not match current key. at Duplicati.Library.Encryption.EncryptedFieldHelper.Decrypt(String value, KeyInstance key) at Duplicati.Server.Database.Connection.DecryptSensitiveFields(String fieldValue, KeyInstance key) at Duplicati.Server.Database.Connection.<>c__DisplayClass43_0.<GetSettings>b__0(IDataReader rd) at Duplicati.Server.Database.Connection.Read[T](IDbCommand cmd, Func2 f)+MoveNext()
at System.Linq.Enumerable.g__EnumerableToArray|324_0[TSource](IEnumerable1 source) at Duplicati.Server.Database.Connection.ReadFromDb[T](Func2 f, Action1 prep) at Duplicati.Server.Database.Connection.GetSettings(Int64 id) at Duplicati.Server.Database.ServerSettings.ReloadSettings() at Duplicati.Server.Database.ServerSettings..ctor(Connection con) at Duplicati.Server.Database.Connection..ctor(IDbConnection connection, Boolean disableFieldEncryption, KeyInstance key, String dataFolder, Action startOrStopUsageReporter) at Duplicati.Server.Program.GetDatabaseConnection(IApplicationSettings applicationSettings, Dictionary2 commandlineOptions, Boolean silentConsole, Boolean changeDbEncryption)
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String _args)
— End of inner exception stack trace —
at Duplicati.Server.Program.Main(IApplicationSettings applicationSettings, String _args)
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper.<>c__DisplayClass5_0.<.ctor>b__0(Object _)
— End of inner exception stack trace —
at Duplicati.GUI.TrayIcon.HostedInstanceKeeper..ctor(IApplicationSettings applicationSettings, String args)
at Duplicati.GUI.TrayIcon.Program.RunMain(String _args)
at Duplicati.GUI.TrayIcon.Program.Main(String _args)

coral6691 · September 25, 2026, 10:11am

If anybody gets stuck in the same situation, this may work for you too:

backup the new database (should be v12 in Duplicati 2.4.0.0)
replace it with the v11 version, i.e. overwrite Duplicati-server.sqlite with the old database (should be named something like "backup Duplicati-server 20260914104202.sqlite))
download the 2.3 version you had before and install
run it with duplicati --disable-db-encryption
assuming it works fine, quit and reinstall 2.4

If you want to keep the Seahorse key, start 2.4 with duplicati --settings-encryption-key='SEAHORSE_KEY', replacing SEAHORSE_KEY with the actual key. It should start fine from CLI or GUI after this.

Please don’t ask me “what if this or that” as I’m not a Duplicati expert. Try using an AI to help you (as I did, even if it’s still taken me nearly a whole day).

Good luck.