How to restore encrypted backups

1. Make sure you created the certificate with the correct expiry date. Take note that renewing the certificate, if it expires or extending the certificate’s expiration date, changes the thumbprint of the certificate. This makes it invalid for the backups already created using it before the changes and you won't be able to restore those backups.
2. Back up the certificate and keys and save it to a different location aside from the server where it was created. Take note that without the certificates, your backups will not be usable. It is best to keep it in an off-site location for your Disaster Recovery or Key Management providers.
3. For Availability groups, make sure your certificates are all on the node. You normally run your backups on one of the nodes but these backups are for all your AG replicas. Make sure the certificate is available on all the nodes so you are always ready to restore it on any of the nodes.

Msg 33111, Level 16, State 3, Line 20 Cannot find server certificate with thumbprint '0x9D8F11B623D5C7B94E64D1889ECCAD61C52A025D'. Msg 3013, Level 16, State 1, Line 20 RESTORE DATABASE is terminating abnormally.RESTORE DATABASE is terminating abnormally.

Backing up the backup certificate

1. Log in to the source server in SSMS.
2. First verify the certificate name by listing the certificates on the server.

select name,thumbprint from sys.certificates

3. You’ll see the thumbprint for the certificate that matches the one from your error is the one you need. You can also check this from the backup file itself. Restore the header only of the file and you can find the column Encryptor_thumbprint for the information.

restore headeronly from disk=N'C:\SQLServer\yoyo_encrypted_backup.bak'

4. Once you have the certificate name, back up the certificate.

Backup Certificate Backup_Certificate to file='C:\sqlserver\Backup_Certificate.cer' with Private key (File='c:\sqlserver\Backup_Certificate.pky',Encryption by password='ScottTiger')

Restoring the backup certificate

1. Check if the master key exists on the new server.

select name,is_master_key_encrypted_by_server from sys.databases

2. If master database shows up, 1 on is_master_key_encrypted, skip the next steps and proceed to step 4.

3. If the master database shows up 0 on is_master_key_encrypted, this means the master key still does not exist on this server. To create one run the command below.

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'MasterPassword'

4. Once the master key is created, we can restore the backup certificate on this server. You can either copy over the certificate and private key that you created in the previous section to the server, or make sure its location is accessible to the destination server.

CREATE CERTIFICATE [Backup_Certificate] AUTHORIZATION [dbo] FROM FILE = 'C:\sqlserver\Backup_Certificate.cer' WITH PRIVATE KEY (DECRYPTION BY PASSWORD = 'ScottTiger' , FILE = ''c:\sqlserver\Backup_Certificate.pky)  

5. Once this is completed you are now ready to restore encrypted backups. You can restore it as you would any backups through the GUI, TSQL, powershell or sqlcmd whatever you are most comfortable with.