I've done this in the past, and now I need to do it again. activate TDE.
I remember that I didn't need to restore the master key on the secondary server to restore the database.
And now, as I have bad memory, I'm doing dozens of tests again with sintax, backup and restore and etc to be sure we will not mess with anything after enabling TDE in the database.
after creating the
MASTER KEY, then
CERTIFICATE, then the
DATABASE ENCRYPTION KEY , I just backup the
CERTIFICATE as below:
USE MASTER GO BACKUP CERTIFICATE CERTIFICATE_I_HATE_TDE TO FILE ='C:\tde_backups\CERTIFICATE_I_HATE_TDE.CER' WITH PRIVATE KEY ( FILE ='C:\tde_backups\CERTIFICATE_I_HATE_TDE_PRIVATE_KEY.PVK', ENCRYPTION BY PASSWORD='123superHardPassword')
then, I enable the encryption with
ALTER DATABASE SET ENCRYPTION ON.
After this I backup the database, and to restore in the other server, I create a certificate
FROM FILE pointing the old certificate (that was CTRL+C / CTR+V to the new server).
After this I'm able to restore the database, without restoring the
MASTER KEY or the
SERVICE MASTER KEY.
I'm asking this because I'm reading this redgate link and it says to backup the master key, but where would I use it?
and another question. whats the difference between creating the master key and certificate in the
MASTER database, and creating the master key and certificate in the database itself ( the one i'm going to use TDE)?
Edit: Deleted by mistake.