--- schema_version: "1" id: 396de1860bf4b79d8fd40796425e1cd4603ceb51a81b42618e4b2aeb1ad2e22d title: Validate Your Own Encryption Key collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_validate_byok.md canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_validate_byok.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 86c190abbc05fb09e17fd109ecc4d7acc5f9cf4ea8b5f21d0471bcfcba05e53e description: You can perform this process outside of Marketing Cloud Engagement to troubleshoot key wrapping procedures to ensure you used the correct algorithms. products: - Marketing - Marketing Cloud Engagement release: "264" --- # Validate Your Own Encryption Key You can perform this process outside of Marketing Cloud Engagement to troubleshoot key wrapping procedures to ensure you used the correct algorithms. Install a [patched version of OpenSSL](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_byok_openssl.htm&language=en_US) that enables AES Key Wrap Pad and a copy of xxd to perform these steps. 1. In your command-line interface, generate a private wrapping key and extract the public key information. The salesforce\_rsa\_pub2 file contains the RSA public wrapping key. Use this key instead of the public key normally obtained from Engagement. Command: ``` openssl genrsa -out wrappingkeyprivate.pem 4096 openssl rsa -in wrappingkeyprivate.pem -outform PEM -pubout -out salesforce_rsa_pub2 ``` 2. [Generate a new key, key wrapping, and Base64 encoding](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_create_byok.htm&release=264.0.0&type=5 "You can create an encryption key in Marketing Cloud Engagement, using multiple keys for the creation and wrapping process. You provide the wrapped version of the Intermediate Key and Private Key. Use Base64 encoding for the wrapped keys before you import them."). Use the salesforce\_rsa\_pub2 wrapping key from Step 1. 3. Base64 decode the intermediate key to obtain the oaep\_wrapped\_intermediate\_aes\_key2 wrapped intermediate key. Command: ``` openssl base64 -d -in oaep_wrapped_intermediate_aes_key.b64 -out oaep_wrapped_intermediate_aes_key2 ``` 4. Unwrap the intermediate key and produce the aeskey2.bin unwrapped intermediate key. If the file size isn’t 32 bytes, ensure that you generated a 256-bit AES key in Step 2. Command: ``` openssl pkeyutl -in oaep_wrapped_intermediate_aes_key2 -decrypt -inkey wrappingkeyprivate.pem -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 > aeskey2.bin ``` ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_note.png) Note A failed command can indicate a problem with the intermediate key wrapping process in Step 2. Use SHA-256 for the hash function and the mask generation function when wrapping the RSA OAEP. 5. Convert the intermediate key binary file into the aeskey2.hex file. Command: ``` xxd -plain -c 100 aeskey2.bin > aeskey2.hex SET /P AES_KEY= string. Command: ``` openssl enc -d -id-aes256-wrap-pad -nosalt -in aes_wrapped_user_rsa_key2 -K %AES_KEY% -iv A65959A6 > customer_key2.der ``` ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_note.png) Note If this command fails, ensure you used AES Key Wrap with Padding format in Step 2. 8. Validate the private key. Command: ``` openssl rsa -inform DER -in customer_key2.der -check ``` ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_note.png) Note If the command displays the private key value, your validation is successful. Otherwise, review the generation and wrapping process in Step 2 for errors.