0

I have already (by accident) regenerated the master key in the master database of a (development)server that hosts multiple databases encrypted with Transparent Data Encryption (TDE). Now, I am curious about the effects of this action on the existing certificates and the databases encrypted with those certificates. Specifically, I would like to know:

  1. What impact does regenerating the master key have on the encryption status of the existing databases that were previously encrypted with TDE?
  2. After regenerating the master key, what happens to the certificates used for TDE encryption? Do they need to be reconfigured or regenerated? Do I need to take a new backup of the certificates/private key, or will the existing files still function when restoring to other servers?
  3. Are there any necessary precautions or steps to take after regenerating the master key to ensure the integrity and accessibility of the encrypted databases?

I want to ensure that regenerating the master key has not caused any unintended consequences, such as rendering my encrypted databases inaccessible or compromising their security (as of now I can query them normally). Any insights or advice on this matter would be greatly appreciated.

Thank you!

Improve this question

1 Answer 1

Reset to default
0

What impact does regenerating the master key have on the encryption status of the existing databases that were previously encrypted with TDE?

Nothing directly. Whatever the status was before the regeneration is the same status afterwards. If the master key could be opened, it'll still be that way and if it couldn't, it'll be able to be opened but any secrets won't, so nothing net changed except the ability to potentially fix it.

After regenerating the master key, what happens to the certificates used for TDE encryption?

Nothing. Changing the master key doesn't change the certificate.

Are there any necessary precautions or steps to take after regenerating the master key to ensure the integrity and accessibility of the encrypted databases?

Obviously things should be backed up. As stated above, nothing essentially changes state.

I'd suggest reading on the subject which will probably answer most of this.

Improve this answer
2
  • Thanks. When you say "things should be backed up", what do you mean then? The new key, or also the certificates (even though they are not changed)?
    – GHauan
    Commented May 25, 2023 at 7:14
  • The new key, and while you didn't state that you changed any other items like passwords you should make sure anything such as that is also backed up somewhere and if needed, changed if using AGs and db_control_key.
    – Sean Gallardy
    Commented May 25, 2023 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.