What is the best way to replace a soon expiring certificate? Downtime should be avoided. Databases size is 100GB.
If the certificate expires TDE will continue to work so don't panic there but you should still replace it to keep with your security policy. Because the certificate is used to encrypt the Database Encryption Key (DEK) and not the data, it is quite easy to change the certificate.
Create or import a new certificate and then use it to encrypt the DEK.
ALTER DATABASE ENCRYPTION KEY REGENERATE WITH ALGORITHM = AES_256 --Your choice of algorithm may be different ENCRYPTION BY SERVER CERTIFICATE 'YourNewCertificate';
I made a mistake in my code above. It is not possible to alter the encryption algorithm and the certificate used in one statement. This was not required anyway so the following code is sufficient:
ALTER DATABASE ENCRYPTION KEY ENCRYPTION BY SERVER CERTIFICATE YourNewCertificate; GO
An expired certificate that is used in TDE should not cause you any problems. From this link:
A certificate that has exceeded its expiration date can still be used to encrypt and decrypt data with TDE.
We have expired TDE certificates on our servers, and haven't encountered any problems. If you copy that TDE certification to another server (so you can restore TDE databases), you'll still get the annoying 'The certificate has expired' message, but encryption/decryption will still work fine.