Keep both pfSense AutoConfigBackup recovery secrets outside the firewall

The device key identifies backups, while the encryption password is needed to read their contents.

Source facts

Netgate states that anyone possessing an AutoConfigBackup device key can manipulate backups associated with it. The separate encryption password is used locally and is not transmitted as a login credential. Losing that password prevents recovery of backup contents. Changing it affects new backups and leaves older entries dependent on the previous password.

Source: Netgate — AutoConfigBackup Configuration.

Applicability

This concerns AutoConfigBackup settings in pfSense.

DSE recommendation

DSE recommends storing the device key and encryption password in an approved restricted recovery vault accessible during a firewall outage. Record password changes with the backup periods they protect. Keep enough historical secret material to recover retained backups instead of overwriting the only saved password during rotation. Limit who can retrieve the device key because its authority extends beyond merely viewing metadata. Assign a recovery owner and alternate who can follow the documented process without the original appliance. Keep a credential-to-backup-period index in the recovery vault without placing the values in ordinary documentation. Ask the alternate recovery owner to select the correct historical password using that index. A successful current-backup exercise should not substitute for testing one retained older generation.

Verification

Use an approved recovery exercise to retrieve a designated backup and decrypt it using the vaulted credentials. Repeat for an older retained entry after a password change. Record successful decryption without copying either secret into tickets, screenshots, or diagnostic logs.

Official reference

Netgate — AutoConfigBackup Configuration. Reviewed October 20, 2026.