Domain Certificate Authority Generated Certificate and SQL Server - Keyset does not exist

Question

I do not have much experience with certificates or certificate terminology, so I may be incorrect in how I title things.

I am trying to use a domain issued certificate as the certificate used in the creation of a Column Master Key (CMK) to setup Always Encrypted (AE) columns.

When I try to add the certificate I receive the error "Keyset does not exist".

Here is the program location:

I did find information about the certificate needs to be, referenced here, and it says:

To be a valid column master key, a certificate must:

• To be an X.509 certificate.
• be stored in one of the two certificate store locations: local machine or current user. (To create a certificate in the local machine certificate store location, you must be an administrator on the target machine.)
• contain a private key (the recommended length of the keys in the certificate is 2048 bits or greater).
• be created for key exchange.

Now, I don't quite know how to verify that information, but I believe we have set the certificate up correctly.

I have gotten AE to work with a self-signed certificate in SQL Server, but we wanted to use the Domain Certificate Authority. Any suggestions?

Answer 1

For my particular issue I needed to give the user access to read the Cert.

So, with the administrator of SQL Server you have to:

1. Open CertLM and find the certificate that you are going to use for Always Encrypted
2. Right click the Certificate
3. Press All Tasks > Manage Private Keys
4. Press the Add... button if the username is not there
5. Find your User or Group in AD
6. Give that User or Group read access.