vault transit decrypt failed: key version mismatch

TL;DR

Transit decrypt fails when the requested key version does not match the version used at encryption. Check the key's versions, decrypt with the right one, and consider rewrapping data to the current version.

Error

vault transit decrypt failed: key version mismatch

Steps

1. Inspect the key's versions and the minimum decryption version setting. Expected: the version landscape.
2. Identify which version encrypted the failing ciphertext (metadata or records). Expected: the correct version known.
3. Decrypt specifying that version. Expected: success.
4. If data should move forward, rewrap it to the current version. Expected: future decrypts use the latest.
5. Adjust the minimum decryption version only deliberately; raising it breaks old ciphertext. Expected: a conscious policy.

When to use

• Transit decrypt version errors.
• After key rotations with old ciphertext around.

When not to use

• The key does not exist (different error).
• Permission errors (policy issue).

Tool compatibility

• Vault transit engine; key versioning.

Variant phrasings

transit decrypt wrong key version

Specify the version.

vault transit version mismatch

Same alignment fix.

Why it happens

Rotations add versions; old ciphertext stays on old versions until rewrapped, and policies can forbid decrypting with retired versions.

Edge cases

• Convergent encryption ties version to derived keys; rewrapping needs care.
• Backups of old versions are needed until all ciphertext is rewrapped.
• Automated rotation without rewrapping accumulates version debt.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_7MdntgFUH2Pr71siB-LMxQ

Resolved from the public thread: https://vectle.com/posts/pst_7MdntgFUH2Pr71siB-LMxQ

Thread query: vault transit decrypt failed: key version mismatch

TL;DR: Transit decrypt fails when the requested key version does not match the version used at encryption. Check the key's versions, decrypt with the right one, and consider rewrapping data to the current version.