diff --git a/cmd/object-attributes-ssec_test.go b/cmd/object-attributes-ssec_test.go
index 0e617a39f..77deca059 100644
--- a/cmd/object-attributes-ssec_test.go
+++ b/cmd/object-attributes-ssec_test.go
@@ -77,6 +77,11 @@ func testAPIGetObjectAttributesAuthenticatesSSECKey(_ ObjectLayer, instanceType,
 		if rec := objectAttributesSSECRequest(t, apiRouter, credentials, bucketName, object, nil); rec.Code != http.StatusBadRequest {
 			t.Fatalf("%s/%s: missing key returned %d, want %d: %s", instanceType, test.name, rec.Code, http.StatusBadRequest, rec.Body.String())
 		}
+		if rec := objectAttributesSSECRequest(t, apiRouter, credentials, bucketName, object, map[string]string{
+			xhttp.MinIOSourceReplicationRequest: "true",
+		}); rec.Code != http.StatusOK {
+			t.Fatalf("%s/%s: replication request returned %d: %s", instanceType, test.name, rec.Code, rec.Body.String())
+		}
 	}
 }
 
diff --git a/cmd/object-handlers.go b/cmd/object-handlers.go
index b7cd2d58d..bf073f0c5 100644
--- a/cmd/object-handlers.go
+++ b/cmd/object-handlers.go
@@ -619,7 +619,7 @@ func (api objectAPIHandlers) getObjectAttributesHandler(ctx context.Context, obj
 	if checkPreconditions(ctx, w, r, objInfo, opts) {
 		return
 	}
-	if crypto.SSEC.IsEncrypted(objInfo.UserDefined) {
+	if crypto.SSEC.IsEncrypted(objInfo.UserDefined) && r.Header.Get(xhttp.MinIOSourceReplicationRequest) != "true" {
 		if _, err = crypto.SSEC.UnsealObjectKey(r.Header, objInfo.UserDefined, bucket, object); err != nil {
 			writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
 			return