Skip to main content

Object Storage - Encrypt your server-side objects with SSE-C or SSE-OMK

Stephanie R.
Updated

Learn how to encrypt Object Storage objects at rest using customer-managed keys (SSE-C) or OVHcloud-managed keys (SSE-OMK).

OVHcloud S3™-compatible* Object Storage supports two server-side encryption (SSE) methods to protect your objects at rest:

  • SSE-C (Server-Side Encryption with Customer Keys): You supply a 256-bit AES key with every request. You retain full control over keys, but you are responsible for storing and rotating them.
  • SSE-OMK (Server-Side Encryption with OVHcloud-Managed Keys): OVHcloud automatically generates and manages a unique encryption key per object. No key management required.
  • A third option, Client-Side Encryption (CSE), lets you encrypt data before sending it to Object Storage. This guide includes CSE in the comparison table below but does not cover its implementation in detail.

NOTE: Object Storage does not store your SSE-C encryption key. If you lose it, the encrypted object cannot be recovered — the only option is to delete it.

 

Choosing a method

  SSE-C SSE-OMK CSE
Who manages keys You (per request) OVHcloud You (client-side)
Key control Full None Full
Management overhead Medium None High
Transparent downloads No Yes No
Additional cost None None None

Use SSE-C when compliance or audit requirements mandate exclusive key ownership. Use SSE-OMK for transparent, zero-effort encryption.

 

Requirements

OVHcloud Control Panel Access

 

Instructions

SSE-C — Server-Side Encryption with Client Encryption Keys

When you upload an object with SSE-C, Object Storage applies AES-256 encryption using the key you provide. To retrieve the object later, you must supply the same key; Object Storage verifies it before decrypting.

Each request requires three headers

Name Description
--sse-customer-algorithm Encryption algorithm. Must be AES256.
--sse-customer-key Base64-encoded 256-bit (32-byte) encryption key.
--sse-customer-key-md5 Base64-encoded 128-bit MD5 digest of the raw key (integrity check per RFC 1321).

 

Generating an encryption key

secret=$(openssl rand 32)
encKey=$(echo -n "$secret" | base64)
md5Key=$(echo -n "$secret" | openssl dgst -md5 -binary | base64)

 

Uploading an object

aws s3api put-object \
  --body <file_path> \
  --bucket <bucket_name> \
  --key <object_key> \
  --sse-customer-algorithm AES256 \
  --sse-customer-key "$encKey" \
  --sse-customer-key-md5 "$md5Key"

 

Downloading an object

$ aws s3api get-object \
  --bucket <bucket_name> \
  --key <object_key> \
  --sse-customer-algorithm AES256 \
  --sse-customer-key "$encKey" \
  --sse-customer-key-md5 "$md5Key" \
  <destination_file_path>

Omitting the encryption headers returns a 400 Bad Request error.

 

Retrieving object metadata

$ aws s3api head-object \
  --bucket <bucket_name> \
  --key <object_key> \
  --sse-customer-algorithm AES256 \
  --sse-customer-key "$encKey" \
  --sse-customer-key-md5 "$md5Key"

Example output:

{
    "LastModified": "Tue, 19 Apr 2022 09:38:47 GMT",
    "ContentLength": 111,
    "ETag": "\"272913026300e7ae9b5e2d51f138e674\"",
    "VersionId": "1650376416551536",
    "ContentType": "binary/octet-stream",
    "Metadata": {},
    "StorageClass": "STANDARD"
}

Without encryption headers, you will get a 400 Bad Request error.

 

Deleting an encrypted object

Deletion does not require encryption headers:

$ aws s3 rm s3://<bucket_name>/<object_key>

 

Presigned URLs

Presigned URLs support SSE-C with the following requirements:

  • When generating the URL, include x-amz-server-side-encryption-customer-algorithm header in the signature calculation.
  • When using the URL, the client must supply all three SSE-C headers.

SSE-C presigned URLs can only be used programmatically; browser-based access is not supported, as SSE-C headers cannot be sent from a browser.

 

SSE-OMK — Server-Side Encryption with OVHcloud-Managed Keys

SSE-OMK encrypts objects automatically at rest. OVHcloud derives a unique key per object (combining a per-bucket master key with a random salt), so each object is protected individually with no management overhead on your part. Downloads are fully transparent; no encryption headers are needed.

 

Advantages

  • Simplified key management: OVHcloud handles key generation, storage, and rotation. No administrative overhead or key rotation schedules for your team.
  • Per-object isolation: Each object is encrypted with its own derived key, so a potential key compromise affects only that object, not your entire bucket.
  • Transparency access: Encrypted objects behave exaclty like unencrypted ones; no changes to your application or workflows.

 

Uploading an object

aws s3api put-object \
  --bucket <bucket_name> \
  --key <object_key> \
  --body <file_path> \
  --server-side-encryption AES256 \
  --endpoint-url https://s3.<region>.io.cloud.ovh.us

 

Downloading an object

No encryption headers are needed because decryption is handled automatically server-side:

aws s3api get-object \
  --bucket <bucket_name> \
  --key <object_key> \
  <destination_file_path> \
  --endpoint-url https://s3.<region>.io.cloud.ovh.us

Do not include SSE-C headers when downloading an SSE-OMK object; this will return a 400 Bad Request error.

 

Enabling SSE-OMK on a bucket

Once enabled, all subsequent uploads are encrypted automatically. Existing objects are unaffected; you will need to re-upload them to encrypt retroactively.

To enable SSE-OMK at bucket creation, see our Getting started with Object Storage guide.

aws s3api put-bucket-encryption \
  --bucket <bucket_name> \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}' \
  --endpoint-url https://s3.<region>.io.cloud.ovh.us

From the OVHcloud Control Panel, navigate to your bucket via the Public Cloud and Object Storage menus and click the name of your bucket.

In the Encryption panel, click ⚙️ Enable.

objectStorage_container_dashboard-disabled.PNG

In the pop-up window, click Confirm.

objectStorage_enableEncryption.png

 

Verifying bucket encryption

aws s3api get-bucket-encryption \
  --bucket <bucket_name> \
  --endpoint-url https://s3.<region>.io.cloud.ovh.us

Look in the Encryption panel of the bucket. There you will find the Enabled or Disabled indicator.
objectStorage_container_dashboard-enabled.PNG

 

Deleting an encrypted object

Deletion works the same as for unencrypted objects:

aws s3 rm s3://<bucket_name>/<object_key>

 

Considerations

  • Encryption overhead: SSE-OMK adds a negligible latency overhead for most workloads. To minimize it, use a bucket region geographically close to your application.
  • Key visibility: You cannot inspect, rotate, or audit the encryption keys directly. If your compliance framework requires key ownership or audit trails, use SEE-C instead.
  • In-depth defense: SSE-OMK protects data at rest, but does not replace access control. Pair it with strict IAM policies and access logging to monitor and restrict who can read your objects.

There are no additional fees for using SSE-C or SSE-OMK encryption.

 

CSE (Client-Side Encryption)

  • Ideal for organizations with very high security requirements, requiring encryption keys to remain under exclusive control.
  • Suitable for highly regulated industries, such as finance or healthcare.

SSE-C (Server-Side Encryption with Customer Keys)

  • Suited to organizations that need to audit or rotate their own keys but want to delegate the encryption workload to the server
  • Use when compliance mandates key ownership without the full complexity of client-side encryption.

SSE-OMK (Server-Side Encryption with OVHcloud-Managed Keys)

  • Best for teas that want robust encryption without the operational burden of key management.
  • Ideal when simplicity and speed of deployment are priorities and there are no key-ownership compliance requirements.

 

Troubleshooting

Symptom Likely cause Resolution
400 Bad Request on SSE-C download Missing or incorrect encryption headers Include all three --sse-customer-* headers with the same key used to upload
400 Bad Request on SSE-OMK download SSE-C headers included by mistake Remove all --sse-customer-* headers
Cannot retrieve SSE-C object Encryption key lost Recovery is impossible — delete the object
Latency increase Encryption/decryption overhead Use a region geographically close to your bucket to reduce latency

 

Go further

For more information and tutorials, please see our other Object Storage support guides or explore the guides for other OVHcloud products and services.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.

*S3 is a trademark filed by Amazon Technologies, Inc. OVHcloud's service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.

Related articles