I've been trying to work out an effective database backup encryption scheme lately.
I have a Postgres 9.4 server, I have most of the backup scheme fleshed out I think. Backups will be stored in a standard .sql file, gzipped and then ran through AES-CBC with OpenSSL.
The only part I'm having trouble with is keys. I don't want to use a single master key, I want some kind of key rotation or generation. Something where all backups (or at least most) have different keys, but also keys that I can easily find/generate and use if I ever need to. I've had a look on Google but can't find any clear solution.
I am willing to evaluate entirely different encryption solutions too, I'm not tied to AES-CBC/OpenSSL.
Any solution will be greatly appreciated.