I used version openssl-1.0.2 (same on router) because it will throw error on newer openssl versions.
Disable Backup encryption option:
/userfs/bin/tcapi set WebCurSet_Entry EncryptFile off
/userfs/bin/tcapi commit WebCurSet_Entry
Now that should let you download and upload the romfile freely with no more encryption.
If the tcapi commit gives you a forbidden message. Just do:
echo authenticated > /tmp/Authentication