0

In an Azure Keyvault, I manually create a 2048 bit RSA key called "Encrypt". I then import a .pfx 2048 bit RSA key called "Import".

Back in MSSQL, I can use the "Encrypt" key using this:

CREATE ASYMMETRIC KEY TDE_KEY
    FROM PROVIDER AzureKeyVault_EKM_Prov WITH
    PROVIDER_KEY_NAME = 'Encrypt',
    CREATION_DISPOSITION = OPEN_EXISTING

Commands completed successfully.

But if I attempt to use the "Import" key, this happens:

CREATE ASYMMETRIC KEY TDE_KEY
    FROM PROVIDER AzureKeyVault_EKM_Prov WITH
    PROVIDER_KEY_NAME = 'Import',
    CREATION_DISPOSITION = OPEN_EXISTING

Key with name 'Import' does not exist in the provider or access is denied. Provider error code: 2057.  (Provider Error - No explanation is available, consult EKM Provider for details)

I know it at least can see the key, because it returns error 2057 instead of 3112 (key not found).

Unfortunately 2057 is not among the error numbers in the SQL Server Connector documentation: https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/sql-server-connector-maintenance-troubleshooting?view=sql-server-2017#AppendixC

Here is what the two keys looks like side by side in Powershell:

PS C:\> Get-AzKeyVaultKey -VaultName testvault

Vault/HSM Name : testvault
Name           : Encrypt
Key Type       : RSA
Key Size       : 2048
Curve Name     :
Version        : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Id             : https://testvault.vault.azure.net:443/keys/Encrypt/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Enabled        : True
Expires        :
Not Before     :
Created        : 10/13/2022 8:54:16 PM
Updated        : 10/13/2022 8:54:16 PM
Recovery Level : Recoverable
Release Policy :
Tags           :

Vault/HSM Name : testvault
Name           : Import
Key Type       : RSA
Key Size       : 2048
Curve Name     :
Version        : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Id             : https://testvault.vault.azure.net:443/keys/Import/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Enabled        : True
Expires        :
Not Before     :
Created        : 10/14/2022 4:59:37 PM
Updated        : 10/14/2022 4:59:37 PM
Recovery Level : Recoverable
Release Policy :
Tags           :

One final note, I gave the account accessing the key full permissions to everything in the keyvault, just to be sure.

How can I get an imported key in an Azure Keyvault to work with TDE?

0

1 Answer 1

3

Unfortunately 2057 is not among the error numbers in the SQL Server Connector documentation [...]

It does seem to be missing from the official Docs, I'll propose some changes to get these items documented. It's extremely rare that any of the below would be hit (except for 2056, thanks antivirus software!).

In the interim, here are some of the non-published items. Note that there can be various reasons why these may be hit.

2054 - scp_err_GetThumbprintFromPublicKey
2055 - scp_err_GetPublicKeyBlob
2056 - scp_err_GetRegistryKeyPath
2057 - scp_err_ThumbprintExistedInRegistry
2059 - scp_err_ThumbprintMismatch
2060 - scp_err_GetKeyUriFromThumbprint

In your case it was 2057, which means the URI + thumbprint already exists in the registry. I haven't had a chance to test what different ways this could be accomplished, but my best guess was the same key imported under different names (I'm not saying this is always the case, just what makes sense) or someone did a no-no and cloned/imported registry settings they shouldn't have <shrug>.

The solution is to remove the offending registry keys under the AKV registry path, which did work in your case.

1
  • Deleting the appropriate registry folder worked. The registry key is in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQL Server Cryptographic Provider\Azure Key Vault\vaultname.vault.azure.net\xxxxxxxxxxxxxxxxxx <-- Each folder is a different key version. The names must match or it will not import. It doesn't seem to always drop the registry key when you drop the key from SQL.
    – Brain2000
    Oct 22, 2022 at 0:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.