The SAP HANA error "no root key matching hash" appears when you recover a backup into a database that doesn't have the encryption root key the backup was made with. The backup is fine. The fix is to import the source's root key backup on the target (hdbnsutil -recoverRootKeys), or to set a root key backup password, back up the keys and take a fresh backup.

Why it happens

When backup encryption is active, every data and log backup is encrypted with the database's backup root key. To read that backup, the database you're recovering into must hold the same root key. This error usually shows up when:

  • you recover into a different system (system copy, refresh of QAS from PRD)
  • the root keys were changed after the backup was taken
  • the system was reinstalled and got new root keys

The fix I used

I made the keys and the backup belong together again, then took fresh backups.

  1. Treat the old backups as unusable for this target. Note their backup IDs so nobody tries to use them for a restore later.
  2. Set a password for root key backups. Without it you can't export the keys:
ALTER SYSTEM SET ENCRYPTION ROOT KEYS BACKUP PASSWORD "<YourStrongPassword>";

Run it in SYSTEMDB, and in each tenant if you manage keys per tenant.

  1. Back up the root keys as <sid>adm and store the file somewhere safe, away from the database host:
hdbnsutil -backupRootKeys /hana/backup/rootkeys/<SID>_SYSTEMDB.rkb --dbid=1 --type=ALL
hdbnsutil -backupRootKeys /hana/backup/rootkeys/<SID>_<TENANT>.rkb --dbid=<tenant_db_id> --type=ALL

SYSTEMDB always has database ID 1. Look up the tenant's database ID in the SAP HANA cockpit, and check the exact options in the SAP HANA Security Guide section "Back Up Root Keys" for your revision.

  1. Take a new full data backup. It is now encrypted with keys you have a backup of, so you can always restore it.

Recovering into another system

On the target, import the source's root keys before starting the recovery, then recover as normal:

hdbnsutil -recoverRootKeys /path/<SID>_<TENANT>.rkb --dbid=<tenant_db_id> --type=ALL --password=<RootKeyBackupPassword>

In HANA Studio or the cockpit recovery wizard you can also point to the root key backup file when the wizard asks for it.

What to remember

  • A backup without its root key backup is useless after a reinstall. Back up the root keys every time you change them.
  • Keep the root key backup password in your password safe, not on the server.
  • Make "back up root keys" part of every system copy and refresh checklist.

Frequently asked questions

What does "no root key matching hash" mean in SAP HANA?

The backup was encrypted with a backup root key that the target database doesn't have. HANA compares the hash of the key in the backup with its own keys and finds no match, so it can't decrypt the backup.

Can I recover an encrypted HANA backup without the root key backup?

No. Without the matching root key the encrypted backup can't be read. That's why the root key backup file and its password must be stored safely, away from the database host.

How often should I back up HANA root keys?

Every time the root keys change, and before every system copy or refresh. Many teams also add a root key backup to their weekly backup checklist.

Reference: Step by step: "No root key matching hash" when recovering HANA