I do not have much experience with certificates or certificate terminology, so I may be incorrect in how I title things.

I am trying to use a domain issued certificate as the certificate used in the creation of a Column Master Key (CMK) to setup Always Encrypted (AE) columns.

When I try to add the certificate I receive the error "Keyset does not exist".

Here is the program location:

Error Message "Keyset Does Not Exist" Path

I did find information about the certificate needs to be, referenced here, and it says:

To be a valid column master key, a certificate must:

  • To be an X.509 certificate.
  • be stored in one of the two certificate store locations: local machine or current user. (To create a certificate in the local machine certificate store location, you must be an administrator on the target machine.)
  • contain a private key (the recommended length of the keys in the certificate is 2048 bits or greater).
  • be created for key exchange.

Now, I don't quite know how to verify that information, but I believe we have set the certificate up correctly.

I have gotten AE to work with a self-signed certificate in SQL Server, but we wanted to use the Domain Certificate Authority. Any suggestions?

  • 1
    What process are you performing to do this? Can you provide the scripts you're using? Jul 12, 2019 at 14:45

1 Answer 1


For my particular issue I needed to give the user access to read the Cert.

So, with the administrator of SQL Server you have to:

  1. Open CertLM and find the certificate that you are going to use for Always Encrypted
  2. Right click the Certificate
  3. Press All Tasks > Manage Private Keys
  4. Press the Add... button if the username is not there
  5. Find your User or Group in AD
  6. Give that User or Group read access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.