Changes for page sql-tde

Last modified by Nikhil Singh on 2026/07/03 08:32
<
From version < 6.1 >
edited by Nikhil Singh
on 2025/02/26 14:02
To version < 11.1 >
edited by Nikhil Singh
on 2026/07/03 08:30
>
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -1,282 +1,305 @@
1 -= TDE(backup from smss to azure) =
1 += **1. Steps for Implementing Transparent Data Encryption (TDE) FROM SQL Server** =
2 2  
3 3  
4 -1 Create master key in master database (set master key)
4 +This document outlines the process of **encrypting SQL Server databases** using **Transparent Data Encryption (TDE)** and backing them up to **Azure Storage**. TDE ensures data at rest is encrypted, leveraging a **Master Key (MK)**, **TDE Certificate**, and **Database Encryption Key (DEK)** for encryption.
5 5  
6 -2 Create TDE certificate (encrypted by MK)
6 +The process also includes creating a **credential** for secure backup to **Azure Blob Storage**, providing a scalable and secure solution for storing encrypted databases in the cloud.
7 7  
8 -3 Backup the Certificate and private key, By encryption with a password ( did not do it in this case due to storage blog problems)
9 9  
10 -4 Choose DB to create the DEK ,Create database encryption key (DEK) with algorithm ( AES= 256) and encryption by certificate
9 +[[image:image-20250305152543-1.png]]
11 11  
12 -5 Set encryption on for the database
13 13  
14 --- 6 Create a new credential with the SAS token
15 -CREATE CREDENTIAL [https://zagpebslab.blob.core.windows.net/sql-backups]
16 -WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
17 -SECRET = 'sp=racwdli&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=kBFwlj5S5eqBEE32LM1EFebBY0W94uEFiwOXo3R0yt4%3D';
18 -Go--
12 +**~1. Create a Master Key in the master Database**
13 +The first step is to create a **Master Key** in the master database. This key will be used to encrypt other cryptographic objects, such as certificates and symmetric keys, within SQL Server.
19 19  
20 ---7 Perform the database backup with the provided parameters
21 -EXECUTE dba.dbo.DatabaseBackup
22 - @Databases = 'dba',                          -- Replace with your database name
23 - @URL = '[[https:~~/~~/zagpebslab.blob.core.windows.net/sql-backups'>>https://zagpebslab.blob.core.windows.net/sql-backups']], -- Azure Blob Storage URL
24 - @BackupType = 'Full',                        -- Full backup
25 - @CopyOnly = 'Y', -- Copy-only backup to avoid breaking backup chain
26 - @Compress = 'Y',                             -- Compress the backup
27 - @Verify = 'N'; -- No verification of backup
28 -GO--
29 29  
16 +**2. Create a TDE Certificate (Encrypted by the Master Key)**
17 +Next, generate a **TDE certificate** that will be used to encrypt the **Database Encryption Key (DEK)**. This certificate is encrypted by the **Master Key** created in step 1, providing an additional layer of security.
30 30  
31 -The backup was unable to be done from smss to azure ( the MI does not support encrypted DBs to be backed up from smss to azure)
32 32  
33 -We have unencrypted a database and backed it up from ssms to azure blob successfully
20 +**3. Choose the Database to Create the Database Encryption Key (DEK)**
21 +For the selected database, create the **Database Encryption Key (DEK)**. The DEK will be encrypted by the **TDE certificate** and will use the **AES-256 encryption algorithm** to ensure data is securely encrypted at rest.
34 34  
35 35  
36 -Conclusion: Can be done with and unencrypted DB but not with an Encrypted one>
24 +**4. Enable Encryption for the Database**
25 +Once the **DEK** has been created, enable **TDE** for the database. This ensures that all data written to the database is automatically encrypted at rest, providing full protection for sensitive information.
37 37  
38 38  
28 +**5. Create a Credential with a SAS Token**
29 +Finally, create a **credential** that allows SQL Server to access Azure Blob Storage. This credential is created using a **Shared Access Signature (SAS) token**, which ensures secure and authenticated access to the storage account for backup purposes.
39 39  
31 +{{code language="sql"}}
32 +drop credential [https://zagpebslab.blob.core.windows.net/sql-backups]
33 +CREATE CREDENTIAL [https://zagpebslab.blob.core.windows.net/sql-backups]
34 +WITH IDENTITY='SHARED ACCESS SIGNATURE'
35 +, SECRET = 'sp=racwdli&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=kBFwlj5S5eqBEE32LM1EFebBY0W94uEFiwOXo3R0yt4%3D'
36 +GO
37 +
38 +{{/code}}
40 40  
41 41  
42 -= **Using TDE directly from azure portal** =
41 +**~ 6. Use a Stored Procedure to Back Up to Azure Storage Account**
43 43  
43 +{{code language="sql"}}
44 +EXECUTE dba.dbo.DatabaseBackup
45 +@Databases = 'dba',
46 +@URL = 'https://zagpebslab.blob.core.windows.net/sql-backups',
47 +@BackupType = 'Full',
48 +@CopyOnly = 'Y',
49 +@Compress = 'Y',
50 +@Verify = 'N'
51 +{{/code}}
44 44  
53 +=== ===
45 45  
55 +=== Conclusion: Backup to Azure Storage Account with TDE Encrypted Databases ===
46 46  
57 +The attempt to back up an **encrypted database** (with Transparent Data Encryption - TDE) from **SQL Server Management Studio (SSMS)** to an Azure Storage Account was unsuccessful. This issue arises because **Azure does not permit TDE-encrypted databases to be backed up directly to Azure Storage using SSMS**.
47 47  
59 +However, after decrypting the database, we were able to successfully back it up to the Azure Storage Account via SSMS. This confirms that **backups can be performed on an unencrypted database**, but **not on an encrypted database**.
48 48  
49 49  
50 50  
51 51  
52 52  
65 += **2. Enabling Transparent Data Encryption (TDE) Using Azure Key Vault** =
53 53  
54 54  
68 +**Introduction:** This document outlines the process of enabling **Transparent Data Encryption (TDE)** on an **Azure SQL Managed Instance (SQL MI)** using a **Customer-Managed Key (CMK)** stored in **Azure Key Vault**. The encryption is managed using an asymmetric key from **Azure Key Vault**, ensuring that all data within the SQL Managed Instance is encrypted using a strong encryption algorithm.
55 55  
56 56  
71 +===== **1. Generate a Key in Azure Key Vault** =====
57 57  
58 58  
74 +**- Navigate to Azure Key Vault:**
59 59  
76 +* Go to the **Azure Portal** and select **Key Vault** (DemoRudiTest).
60 60  
78 +**- Generate a New Key:**
61 61  
80 +* Go to the **Keys** section and click **Generate** to create a new key.
62 62  
82 +**- Configure Key Settings:**
63 63  
84 +* **Name the Key**: Choose a name for your key, e.g., mysqlmikey.
85 +* **Key Type**: Select **RSA** as the key type.
86 +* **RSA Key Size**: Choose an **RSA key size** of **2048-bit**. (optional)
64 64  
65 -1 CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'YourStrongPasswordHere!';
66 -GO
88 + Note:
67 67  
68 -CREATE CERTIFICATE TDE_Certificate
69 -WITH SUBJECT = 'TDE Certificate';
70 -GO
90 +* switching from 2048-bit RSA to 4096-bit RSA for TDE will affect performance, but the actual impact might be minor, especially on modern hardware and typical workloads.
91 +* **It will likely affect CPU usage** more than disk I/O, and the impact might be more noticeable during key management operations (key generation, encryption, etc.).
92 +* If your database is not under heavy load and your hardware can handle the extra processing, the trade-off for better security may be worth it.
71 71  
72 -2 USE master;
73 -GO
94 +**- Create the Key:**
74 74  
75 -SELECT
76 - cert.name AS Certificate_Name,
77 - cert.subject AS Certificate_Subject,
78 - cert.issuer_name AS Issuer_Name,
79 - cert.pvt_key_encryption_type AS Private_Key_Encryption_Type
80 -FROM
81 - sys.certificates cert
82 -WHERE
83 - cert.name LIKE 'TDE%';
96 +* Click **Create** to generate the key.
84 84  
98 +===== **2. Enable TDE on the SQL Managed Instance** =====
85 85  
86 -3 BACKUP CERTIFICATE TDE_Certificate
87 -TO FILE = https://zagpebslab.blob.core.windows.net/sql-backups?sp=racwl&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=eQKxB%2F0bg5cX71PmhUTlGHLCnIwSbe5CLOWVVkaDR1g%3D\TDE_Certificate.cer'
88 -WITH PRIVATE KEY (
89 - FILE = https://zagpebslab.blob.core.windows.net/sql-backups?sp=racwl&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=eQKxB%2F0bg5cX71PmhUTlGHLCnIwSbe5CLOWVVkaDR1g%3D\TDE_PrivateKey.pvk',
90 - ENCRYPTION BY PASSWORD = 'AnotherStrongPasswordHere!'
91 -);
92 -GO
100 +===== =====
93 93  
102 +**- Navigate to Your Managed Instance:**
94 94  
95 -USE Normal;
96 -GO
104 +* Go to your **SQL Managed Instance** (sqlmi-ebs-lab).
97 97  
98 --- 6. Create a Database Encryption Key (DEK) and encrypt it with the TDE certificate
99 -CREATE DATABASE ENCRYPTION KEY
100 -WITH ALGORITHM = AES_256
101 -ENCRYPTION BY SERVER CERTIFICATE TDE_Certificate;
102 -GO--
106 +**- Enable Transparent Data Encryption (TDE):**
103 103  
104 -USE [dba]
105 -GO
108 +* Under **Security**, select **Transparent Data Encryption**.
106 106  
107 -CREATE DATABASE ENCRYPTION KEY
108 -WITH ALGORITHM = AES_256
109 -ENCRYPTION BY SERVER CERTIFICATE TDE_Certificate;
110 -GO
110 +**- Configure TDE with a Customer-Managed Key (CMK):**
111 111  
112 +* Select **Customer-managed key** as the encryption type.
113 +* Choose the key you created earlier from **Azure Key Vault** (mysqlmikey).
112 112  
113 -USE [dba1]
114 -GO
115 +**- Set the Key as Default TDE Protector:**
115 115  
116 -CREATE DATABASE ENCRYPTION KEY
117 -WITH ALGORITHM = AES_256
118 -ENCRYPTION BY SERVER CERTIFICATE TDE_Certificate;
119 -GO
117 +* Make the key the **default TDE protector** for your instance.
120 120  
119 +**- Save Configuration:**
121 121  
122 -USE [dba2]
123 -GO
121 +* Click **Save** to apply the changes.
124 124  
125 -CREATE DATABASE ENCRYPTION KEY
126 -WITH ALGORITHM = AES_256
127 -ENCRYPTION BY SERVER CERTIFICATE TDE_Certificate;
128 -GO
123 +=== **Conclusion** ===
129 129  
125 +After following these steps, **TDE** has been successfully enabled on your **SQL Managed Instance** using an **asymmetric key** stored in **Azure Key Vault**. All databases within the instance are now encrypted using the same encryption key (identified by the same encryption thumbprint). You can now securely back up these encrypted databases from **SSMS** to **Azure Storage**.
130 130  
131 -USE [dba3]
132 -GO
127 +This process ensures that your data is protected both at rest and during backup, offering enhanced security for your managed databases in the cloud.
133 133  
134 -CREATE DATABASE ENCRYPTION KEY
135 -WITH ALGORITHM = AES_256
136 -ENCRYPTION BY SERVER CERTIFICATE TDE_Certificate;
137 -GO
138 138  
139 -USE [xwiki]
140 -GO
141 141  
142 -CREATE DATABASE ENCRYPTION KEY
143 -WITH ALGORITHM = AES_256
144 -ENCRYPTION BY SERVER CERTIFICATE TDE_Certificate;
145 -GO
131 +=== **1. Backup Specific Databases Using SQL Server Agent Jobs** ===
146 146  
133 +This document describes the process of creating an automated **SQL Server Agent Job** to back up only the **DBA databases** in a SQL Server instance. The backups will occur **daily at 3:00 AM** and will be stored in an **Azure Storage Account** for secure and reliable cloud storage.
147 147  
148 --- 7. Enable Transparent Data Encryption (TDE) on the database
149 -ALTER DATABASE dba
150 -SET ENCRYPTION ON;
151 -GO--
135 +----
152 152  
137 +==== **1. Create the Backup Script** ====
153 153  
154 -select name, database_id, state_desc
155 -from sys.databases
156 156  
140 +====== **- Declaring Variables** ======
157 157  
158 -SELECT
159 - database_id,
160 - key_algorithm,
161 - key_length,
162 - encryption_state_desc
163 - encryptor_type
142 +{{code language="sql"}}
143 +DECLARE @DatabaseName NVARCHAR(128)
144 +DECLARE @BackupContainerURL NVARCHAR(512)
145 +{{/code}}
164 164  
165 -FROM
166 - sys.dm_database_encryption_keys;
147 +DECLARE @DatabaseName NVARCHAR(128) DECLARE @BackupContainerURL NVARCHAR(512)
167 167  
149 +* **@DatabaseName**: A variable to hold the name of the database during each iteration of the loop.
150 +* **@BackupContainerURL**: A variable to store the URL of the Azure Blob Storage container where the database backups will be stored.
168 168  
169 - Select * from sys.dm_database_encryption_keys
152 +----
170 170  
154 +====== **2. Setting the Azure Blob Storage URL** ======
171 171  
172 - BACKUP DATABASE [dba2]
173 -TO URL = '[[https:~~/~~/zagpebslab.blob.core.windows.net/sql-backups?sp=racwl&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=eQKxB%2F0bg5cX71PmhUTlGHLCnIwSbe5CLOWVVkaDR1g%3D'>>https://zagpebslab.blob.core.windows.net/sql-backups?sp=racwl&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=eQKxB%2F0bg5cX71PmhUTlGHLCnIwSbe5CLOWVVkaDR1g%3D']]
174 -With copy_only
175 -GO
156 +{{code language="sql"}}
157 +SET @BackupContainerURL = 'https://<your_storage_account>.blob.core.windows.net/sql-backups/'
158 +{{/code}}
176 176  
177 177  
178 -BACKUP DATABASE [dba2]
179 -TO URL = '[[https:~~/~~/zagpebslab.blob.core.windows.net/sql-backups?sp=racwl&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=eQKxB%2F0bg5cX71PmhUTlGHLCnIwSbe5CLOWVVkaDR1g%3D'>>https://zagpebslab.blob.core.windows.net/sql-backups?sp=racwl&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=eQKxB%2F0bg5cX71PmhUTlGHLCnIwSbe5CLOWVVkaDR1g%3D']],
180 -
181 - COPY_ONLY, -- Ensures the backup does not affect the regular backup chain
182 - COMPRESSION,  -- Optional: Compresses the backup to save storage space
183 - STATS = 10 -- Optional: Provides backup progress status
184 -GO--
161 +----
185 185  
163 +====== **3. Declaring the Cursor** ======
186 186  
187 187  
188 --- Step 1: Drop the existing credential (if needed)
189 -DROP CREDENTIAL [https://zagpebslab.blob.core.windows.net/sql-backups];
190 -GO--
166 +{{code language="sql"}}
167 +DECLARE db_cursor CURSOR FOR
168 +SELECT name
169 +FROM sys.databases
170 +WHERE name LIKE 'dba%' -- Only pick databases that start with 'dba'
171 +{{/code}}
191 191  
192 --- Step 2: Create a new credential with the SAS token
193 -CREATE CREDENTIAL [https://zagpebslab.blob.core.windows.net/sql-backups]
194 -WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
195 -SECRET = 'sp=racwdli&st=2025-02-25T13:28:42Z&se=2026-02-25T21:28:42Z&spr=https&sv=2022-11-02&sr=c&sig=kBFwlj5S5eqBEE32LM1EFebBY0W94uEFiwOXo3R0yt4%3D';
196 -GO--
173 +* **Cursor Declaration**:
174 +** The cursor db_cursor is declared to loop through the list of databases in the sys.databases system view.
175 +** The **WHERE name LIKE 'dba%'** clause ensures that only databases with names starting with dba will be processed. For example, databases like dbaTest, dbaProd, etc., will be included in the loop.
176 +** **sys.databases**: A system catalog view that contains information about each database in the SQL Server instance.
197 197  
198 --- Step 3: Perform the database backup with the provided parameters
199 -EXECUTE dba.dbo.DatabaseBackup
200 - @Databases = 'dba',                          -- Replace with your database name
201 - @URL = '[[https:~~/~~/zagpebslab.blob.core.windows.net/sql-backups'>>https://zagpebslab.blob.core.windows.net/sql-backups']], -- Azure Blob Storage URL
202 - @BackupType = 'Full',                        -- Full backup
203 - @CopyOnly = 'Y', -- Copy-only backup to avoid breaking backup chain
204 - @Compress = 'Y',                             -- Compress the backup
205 - @Verify = 'N'; -- No verification of backup
206 -GO--
178 +----
207 207  
180 +====== **4. Opening the Cursor** ======
208 208  
182 +{{code language="sql"}}
183 +OPEN db_cursor
184 +FETCH NEXT FROM db_cursor INTO @DatabaseName
185 +{{/code}}
209 209  
187 +OPEN db_cursor FETCH NEXT FROM db_cursor INTO @DatabaseName
210 210  
189 +* **OPEN db_cursor**: This opens the cursor for reading the results.
190 +* **FETCH NEXT**: The FETCH NEXT statement retrieves the first database name that meets the LIKE 'dba%' condition and stores it in the @DatabaseName variable. This will be used in the next step where the backup procedure is executed.
211 211  
212 -select name, database_id, state_desc
213 -from sys.databases
192 +----
214 214  
194 +====== **5. Looping Through Databases** ======
215 215  
216 -SELECT
217 - database_id,
218 - key_algorithm,
219 - key_length,
220 - encryption_state_desc
221 - encryptor_type
196 +{{code language="sql"}}
197 +-- Loop through each database and execute the stored procedure
198 +WHILE @@FETCH_STATUS = 0
199 +BEGIN
200 + -- Print current database for logging/debugging
201 + PRINT 'Backing up database: ' + @DatabaseName
222 222  
223 -FROM
224 - select * from sys.dm_database_encryption_keys;
203 + -- Execute the DatabaseBackup stored procedure for each database
204 + EXECUTE dba.dbo.DatabaseBackup
205 + @Databases = @DatabaseName, -- Specify the current database
206 + @URL = @BackupContainerURL, -- Azure Blob Storage URL
207 + @BackupType = 'Full', -- Full backup type
208 + @CopyOnly = 'Y', -- Use copy-only backup (this doesn’t affect the transaction log chain)
209 + @Compress = 'Y', -- Enable compression
210 + @Verify = 'N'; -- Skip verification after backup
225 225  
212 +{{/code}}
226 226  
227 - select name, is_encrypted from sys.databases
228 228  
215 +* **WHILE @@FETCH_STATUS = 0**: The loop will continue as long as the FETCH command successfully retrieves a database name. @@FETCH_STATUS is a system function that returns 0 if the fetch operation is successful.
216 +* **PRINT**: This line prints the name of the database that is currently being backed up. It helps with logging or debugging purposes, as you can track which database is being processed at any given time.
217 +* (((
218 +**EXECUTE dba.dbo.DatabaseBackup**:
229 229  
230 - SELECT
231 - cert.name AS Certificate_Name,
232 - cert.subject AS Certificate_Subject,
233 - cert.issuer_name AS Issuer_Name,
234 - cert.pvt_key_encryption_type AS Private_Key_Encryption_Type
235 -FROM
236 - sys.certificates cert
237 -WHERE
238 - cert.name LIKE 'TDE%';
220 +* This calls a stored procedure named dba.dbo.DatabaseBackup for each database.
221 +* The parameters passed to the stored procedure:
222 +** **@Databases = @DatabaseName**: Specifies which database to back up (the current database being processed).
223 +** **@URL = @BackupContainerURL**: Specifies the destination Azure Blob Storage URL.
224 +** **@BackupType = 'Full'**: Specifies the backup type, which is a **Full** backup (this means all data in the database is backed up).
225 +** **@CopyOnly = 'Y'**: Specifies that this is a **copy-only backup**. This ensures that the backup does not affect the transaction log chain and does not interfere with regular backups.
226 +** **@Compress = 'Y'**: Enables compression of the backup, reducing the size of the backup file.
227 +** **@Verify = 'N'**: Specifies that the backup verification step should be skipped. (Verification can be added if needed for additional safety.)
228 +)))
239 239  
240 - ALTER DATABASE dba1
241 -SET ENCRYPTION off;
242 -GO
230 +----
243 243  
232 +====== **6. Fetch the Next Database** ======
244 244  
245 -Use dba1;
246 -DROP DATABASE ENCRYPTION KEY;
234 +{{code language="sql"}}
235 + -- Fetch the next database in the cursor
236 + FETCH NEXT FROM db_cursor INTO @DatabaseName
247 247  
238 +{{/code}}
248 248  
249 -USE [dba1]
250 -GO
240 +~-~- Fetch the next database in the cursor FETCH NEXT FROM db_cursor INTO @DatabaseName
251 251  
252 -CREATE DATABASE ENCRYPTION KEY
253 -WITH ALGORITHM = AES_256
254 -ENCRYPTION BY SERVER CERTIFICATE TDE_Certificate;
255 -GO
242 +* **FETCH NEXT**: After executing the backup for the current database, this statement retrieves the next database from the cursor and stores it in the @DatabaseName variable. The loop will continue until all matching databases have been processed.
256 256  
244 +----
257 257  
246 +====== **7. Closing and Deallocating the Cursor** ======
258 258  
259 -ALTER DATABASE dba1
260 -SET ENCRYPTION ON
248 +{{code language="sql"}}
249 +-- Close and deallocate the cursor to clean up resources
250 +CLOSE db_cursor
251 +DEALLOCATE db_cursor
252 +
261 261  
254 +{{/code}}
262 262  
256 +* **CLOSE db_cursor**: This closes the cursor once the loop finishes processing all databases.
257 +* **DEALLOCATE db_cursor**: This deallocates the cursor, freeing up any resources used by the cursor. It’s a good practice to always deallocate cursors to avoid resource leaks.
263 263  
259 +====== ======
264 264  
261 +====== **8. Full Script** ======
265 265  
266 266  
264 +{{code language="sql"}}
265 +DECLARE @DatabaseName NVARCHAR(128)
266 +DECLARE @BackupContainerURL NVARCHAR(512)
267 267  
268 +SET @BackupContainerURL = 'https://zagpebslab.blob.core.windows.net/sql-backups'
268 268  
270 +DECLARE db_cursor CURSOR FOR
271 +SELECT name
272 +FROM sys.databases
273 +WHERE name LIKE 'dba%'
269 269  
275 +OPEN db_cursor
276 +FETCH NEXT FROM db_cursor INTO @DatabaseName
270 270  
278 +WHILE @@FETCH_STATUS = 0
279 +BEGIN
271 271  
281 +PRINT 'Backing up database: ' + @DatabaseName
272 272  
283 +EXECUTE dba.dbo.DatabaseBackup
284 + @Databases = @DatabaseName,
285 + @URL = @BackupContainerURL,
286 + @BackupType = 'Full',
287 + @CopyOnly = 'Y',
288 + @Compress = 'Y',
289 + @Verify = 'N';
273 273  
291 +FETCH NEXT FROM db_cursor INTO @DatabaseName
292 +END
274 274  
294 +CLOSE db_cursor
295 +DEALLOCATE db_cursor
275 275  
297 +{{/code}}
276 276  
277 277  
278 278  
279 279  
302 +=== ===
280 280  
281 281  
282 282  
... ... @@ -291,40 +291,4 @@
291 291  
292 292  
293 293  
294 -{{code language="sql"}}
295 -USE master;
296 -GO
297 -CREATE MASTER KEY ENCRYPTION BY PASSWORD = '******';
298 -GO
299 -
300 -CREATE CERTIFICATE EBSphere_TDE_SQL2019_Cert WITH SUBJECT = 'Database_Encryption';
301 -GO
302 -
303 -BACKUP CERTIFICATE EBSphere_TDE_SQL2019_Cert TO FILE = 'D:\temp\EBSphere_TDE_SQL2019_Cert'
304 -WITH PRIVATE KEY (file = 'D:\temp\EBSphere_TDE_SQL2019_Cert_Key.pvk',
305 -ENCRYPTION BY PASSWORD='*****')
306 -
307 -USE Everest_TDE_Master;
308 -GO
309 -CREATE DATABASE ENCRYPTION KEY
310 -WITH ALGORITHM = AES_256
311 -ENCRYPTION BY SERVER CERTIFICATE EBSphere_TDE_SQL2019_Cert;
312 -GO
313 -ALTER DATABASE Everest_TDE_Master
314 -SET ENCRYPTION ON;
315 -GO
316 -
317 -USE Everest_TDE_Master_Documents;
318 -GO
319 -CREATE DATABASE ENCRYPTION KEY
320 -WITH ALGORITHM = AES_256
321 -ENCRYPTION BY SERVER CERTIFICATE EBSphere_TDE_SQL2019_Cert;
322 -GO
323 -ALTER DATABASE Everest_TDE_Master_Documents
324 -SET ENCRYPTION ON;
325 -GO
326 -{{/code}}
327 -
328 -
329 -
330 330  
image-20250305152543-1.png
Author
... ... @@ -1,0 +1,1 @@
1 +XWiki.rudim
Size
... ... @@ -1,0 +1,1 @@
1 +19.6 KB
Content
XWiki.XWikiComments[0]
Author
... ... @@ -1,0 +1,1 @@
1 +XWiki.rudim
Comment
... ... @@ -1,0 +1,1 @@
1 +put the sql code in code tags to start with otherwise its very hard to read
Date
... ... @@ -1,0 +1,1 @@
1 +2025-02-26 16:00:04.223

Applications

Navigation

Need help?

If you need help with XWiki you can contact: