# Verify Encryption **URL:** \ **Category:** Percona Server for MongoDB\ **Created:** [September 14, 2020, 6:30am UTC](https://forums.percona.com/t/verify-encryption/8030 "2020-09-14T06:30:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![samjunction](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@samjunction](https://forums.percona.com/u/samjunction)\ **Post date:** [September 14, 2020, 6:30am UTC](https://forums.percona.com/t/verify-encryption/8030/1 "2020-09-14T06:30:20Z")
I have implemented encryption using [Using Vault to Store the Master Key for Data at Rest Encryption on Percona Server for MongoDB - Percona Database Performance Blog](https://www.percona.com/blog/2020/04/21/using-vault-to-store-the-master-key-for-data-at-rest-encryption-on-percona-server-for-mongodb/.) How to verify whether data is actually encrypted or not. Data size of encrypted/un-encrypted database is exactly same. ---
**Author:** ![Akira\_Kurogane](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/akira_kurogane/32/1280_2.png) [@Akira\_Kurogane](https://forums.percona.com/u/Akira_Kurogane)\ **Post date:** [September 15, 2020, 10:09pm UTC](https://forums.percona.com/t/verify-encryption/8030/2 "2020-09-15T22:09:58Z")
Hi. The data size will be roughly the same. If it’s just that you need to see that the configuration is in effect check the output of the [https://docs.mongodb.com/manual/reference/method/db.serverCmdLineOpts/](https://docs.mongodb.com/manual/reference/method/db.serverCmdLineOpts/) mongo shell command. If the data-at-rest settings are present (_security.enableEncryption: true_ being the main one) it must be in effect - the mongod would have aborted on startup if it couldn’t follow those settings. And if you look in the [https://docs.mongodb.com/manual/reference/method/db.collection.stats/index.html](https://docs.mongodb.com/manual/reference/method/db.collection.stats/index.html) for any collection then in the “wiredTiger.creationString” field I believe you will see one of the WiredTiger table options is something about encryption (“_encryption=(keyid=identifier__)_”) If you don’t want to take it on faith that the configuration information is true, then there’s a strong practical test you can do. Comment out the the security.\* settings for encryption in the mongod.conf file and restart to observe that it cannot recover the data without the encryption keys. Disclaimer: I don’t know if this will cause damage or not. I am suggesting it now only because it sounds like you’re trying in a dev environment for the first time. Akira ---
**Author:** ![samjunction](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@samjunction](https://forums.percona.com/u/samjunction)\ **Post date:** [September 16, 2020, 6:27am UTC](https://forums.percona.com/t/verify-encryption/8030/3 "2020-09-16T06:27:30Z")
Thank you for the reply.  Any idea how to setup replication with encryption enabled. Right now I only have single instance running. ---
**Author:** ![Akira\_Kurogane](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/akira_kurogane/32/1280_2.png) [@Akira\_Kurogane](https://forums.percona.com/u/Akira_Kurogane)\ **Post date:** [September 17, 2020, 5:38am UTC](https://forums.percona.com/t/verify-encryption/8030/4 "2020-09-17T05:38:30Z")
For replication - there are no changes in the replication config required at all. Each node is own thing in this regard, passing the data unencrypted to each other in the replicaset, and to clients. To make sure the data can’t be read as it is transferred over the network you must enable mongodb’s _network encryption_, which is a different part of mongodb ([https://docs.mongodb.com/manual/core/security-transport-encryption/](https://docs.mongodb.com/manual/core/security-transport-encryption/)). It is supported in MongoDB community, it is not just for MongoDB Inc’s and Percona’s matching enterprise like the data-at-rest encryption. ---
**Author:** ![blinker](https://avatars.discourse-cdn.com/v4/letter/b/bb73d2/32.png) [@blinker](https://forums.percona.com/u/blinker)\ **Post date:** [November 7, 2022, 7:35am UTC](https://forums.percona.com/t/verify-encryption/8030/5 "2022-11-07T07:35:28Z")
just chiming in to say thanks and maybe add to those who run in Docker. I used what you described (db.serverCmdLineOpts(), db.collection.stats()) to verify that mongo was instructed to encrypt the DB. I run it in a docker container, so to do the practical test, I generated a new key file (originally ran the container with --encryptionKeyFile [FILE]), and replaced the old file with it. mongo refused to start, citing: > \_\_wt\_btree\_tree\_open, 639: unable to read root page from file:WiredTiger.wt: WT\_PANIC: WiredTiger library panic > > file:WiredTiger.wt, connection: [WT\_VERB\_DEFAULT][ERROR]: \_\_wt\_btree\_tree\_open, 645: WiredTiger has failed to open its metadata: WT\_PANIC: WiredTiger library panic > > file:WiredTiger.wt, connection: [WT\_VERB\_DEFAULT][ERROR]: \_\_wt\_btree\_tree\_open, 646: This may be due to the database files being encrypted, being from an older version or due to corruption on disk: WT\_PANIC: WiredTiger library panic > > file:WiredTiger.wt, connection: [WT\_VERB\_DEFAULT][ERROR]: \_\_wt\_btree\_tree\_open, 649: You should confirm that you have opened the database with the correct options including all encryption and compression options: WT\_PANIC: WiredTiger library panic so it’s doing what it’s suppose to.