fix: throw a better error if we can't get the encrypted header size

fix: throw a better error if we can't get the encrypted header size #12379