Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [transparent-data-encryption]

Transparent Data Encryption, a feature used to provide protection for data at rest.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

How to enable keyring_file on replication server MySQL?

I recently activated the keyring_file plugin on my master server (5.7.44-enterprise-commercial-advanced-log), so the replication server presented errors when trying to execute alter table xxxxxx ...
alexandredelcol's user avatar
0 votes
1 answer
118 views

How to set up component_keyring_file in MySql 8.3

I am trying to set up tablespace encryption in MySQL 8.3 and I can activate the keyring-file plugin. The plugin, however, throws a deprecation notice suggesting migration to component_keyring_file. I ...
Simas Joneliunas's user avatar
0 votes
1 answer
1k views

Restoring a SQL DB that had TDE turned on, cannot find certificate

I have SQLServer 2022 Developer on my machine. A customer has send me a SQLS 2019 backup file. When I attempt to restore it into a fresh DB, I get: Cannot find server certificate with thumbprint '...
Maury Markowitz's user avatar
0 votes
0 answers
51 views

what to do before restoring a database that is involved in TDE (transparent data encryption)?

I use the following script from John Eisbrener to get the chain of backups, in order to restore them: WITH BackupHist AS ( SELECT s.server_name , d.name AS ...
Marcello Miorelli's user avatar
0 votes
1 answer
41 views

SQL Server TDE with Keyvault - how often does it need to contact keyvault?

I have set up two SQL server VMs in Azure with Availabilitiy groups and transparent data encryption with the key residing in keyvault. I thought that the SQL server would only have to reach out to ...
user avatar
1 vote
1 answer
102 views

Possibly unwanted effects of using gMSA on encryption keys (and certificates) in SQL Server

I am trying to find out what undesirable effects using a gMSA as a service account for MS SQL Server could have when using TDE certificates to encrypt databases. As far as I have understood, there ...
JLP1985's user avatar
  • 13
1 vote
1 answer
150 views

Download certificate from Key Vault w/ private key for use in SQL Server (TDE) via powershell

I need to download an x509 Certificate from Azure Key Vault and import it in SQL Server to use for TDE. Note: I'm not referring to EKM providers/ASYMMETRIC KEYs, where SQL accesses key vault to pull ...
StrayCatDBA's user avatar
  • 2,088
0 votes
0 answers
55 views

How to Restore RDS TDE enabled backup into another RDS SQL Server 2019?

I enabled TDE encryption on RDS SQL SERVER with default RDS CERTIFICATE. I took native backup of same RDS on S3 bucket and want to restore same backup file into another RDS SQL SERVER. Source - RDS ...
Md Mumtaz Alam's user avatar
0 votes
0 answers
248 views

Updating expiring secret for credential using Azure app registration and the SQL Server Connector breaks TDE

About 2 years ago we implemented TDE on several databases. We are using the SQL Server Connector for the Azure Key Vault and have a credential in SQL Server that authenticates using the application ...
user avatar
0 votes
1 answer
243 views

Transparent Data Encryption doesn't appear to start encrypting the DB

I have enabled TDE on a big DB of mine (mdf file:9.6GB, log file:12.6GB). I have followed the steps from this video (amongst other sources): https://www.youtube.com/watch?v=6EhCeLbAS_o It has been ...
user2173353's user avatar
1 vote
1 answer
260 views

SQL Server Encryption at rest for some rows of a database (SQL 2019 Std)

I'm looking for a solution to encrypt a portion of a database at rest. The database contains data from different companies that should be encrypted with separate keys. So far, I've considered that TDE ...
mCasamento's user avatar
-1 votes
1 answer
51 views

TDE setup with EMK in SQL SERVER 2019

We are implementing TDE in MS SQL SEREVR 2019 with EKM provider. We are using asymmetric key to encrypt the data at rest. Asymmetric key will be hosted in HSM appliances. I have one questions ...
sam patrick's user avatar
0 votes
1 answer
342 views

Impact of regenerating the master key with ALTER MASTER KEY REGENERATE WITH ENCRYPTION BY PASSWORD on existing TDE encrypt databases and certificates

I have already (by accident) regenerated the master key in the master database of a (development)server that hosts multiple databases encrypted with Transparent Data Encryption (TDE). Now, I am ...
GHauan's user avatar
  • 603
1 vote
0 answers
53 views

TDE - looking for help setting up encryption keys and certificates across multiple SQL servers

I'm looking for some direction on best practices for maintaining encryption keys and certificates across multiple MS SQL servers. I'm planning to create a separate master key with a separate password ...
Steve Pearson's user avatar
0 votes
0 answers
379 views

SQL Server 2019 Version 15.0.4261.1 Standard TDE

This is my first post. I did a search and didn't see anyone else having this problem. My understanding has been that TDE is available in the Standard version of SQL Server 2019. Whenever I attempt ...
Mark Wintch's user avatar
0 votes
1 answer
180 views

How to use Transparent Data Encryption in Oracle?

I'm struggling when trying to implement DTE in my local Oracle 19c environment (with pluggable database ("orclpdb")). What I'm trying to do: Create sys user (done) Create "admin" ...
Andrei Manolache's user avatar
1 vote
0 answers
112 views

TDE - Best Practices for Storing Master Database / TDE Database files and Backups

I have been doing some testing around TDE, in anticipation of enabling in my environments I have TDE enabled on a database which means I cannot restore or attach this database to another server ...
SE1986's user avatar
  • 1,970
3 votes
1 answer
857 views

Can I access a database while TDE is being enabled?

I have a question regarding Transparent Data Encryption (TDE) on a large database. While TDE is being enabled on the database, can I continue to access it? Specifically, can I perform SELECT, INSERT, ...
Fajela Tajkiya's user avatar
4 votes
1 answer
124 views

SQL Server data confidentiality in case of intrusion of machine host

I have to premit that i am a programmer, and i am trying to learn a bit about DBA even if i don't have the same background. I am trying to understand what security provide, and how to use, encryption ...
Skary's user avatar
  • 368
0 votes
1 answer
715 views

Oracle TDE - what mean rotate (rekey) encryption key? why and when?

Maybe I missed something. Reading about Oracle transparent data encryption (TDE), some references say about rekey (or rotate) the master key. But why should we do that? I mean, why to execute the ...
Astora's user avatar
  • 723
1 vote
2 answers
215 views

Cannot restore log of MS SQL database that was previously TDE encrypted (but is not currently encrypted)

I've run into an odd problem with MS SQL Server. I'm working on automating deployment of TDE and want to be able to make sure that I can still do all the things I expect to be able to do with an ...
Pxtl's user avatar
  • 151
0 votes
1 answer
184 views

MariaDB and File Key Management Encryption Plugin

I am trying to work with MariaDB and the file key management encryption plugin. From the documentation at https://mariadb.com/kb/en/file-key-management-encryption-plugin/ it seems like the key file ...
Paul Resnic's user avatar
0 votes
1 answer
209 views

How do I enable MSSQL Transparent Data Encryption (TDE) with Azure Keyvault (Bring Your Own Key - BYOK) after importing a .pfx certificate?

In an Azure Keyvault, I manually create a 2048 bit RSA key called "Encrypt". I then import a .pfx 2048 bit RSA key called "Import". Back in MSSQL, I can use the "Encrypt" ...
Brain2000's user avatar
  • 113
1 vote
1 answer
2k views

Understanding of database master key in SQL Server

Let's say I have a production server and I have a database master key ##MS_DatabaseMasterKey## (master_key1) on it. I created a certificate c1, which is encrypted by master_key1 by default. Then I ...
Fajela Tajkiya's user avatar
1 vote
1 answer
231 views

Migrate MSSQL TDE from certificate to EKM

We have a handful of MSSQL databases encrypted using Transparent Data Encryption (TDE) without an HSM. So the current chain is:  Service Master Key (SMK) ->   Master Key (DMK) ->  ...
Brain2000's user avatar
  • 113
2 votes
1 answer
906 views

RMAN decrypted backup of Oracle TDE encrypted table

I have a Database with Transparent Data Encryption enabled across tablespaces. We have a storage appliance we're using RMAN to backup to which has native encryption, deduplication and compression ...
whentimeslows's user avatar
1 vote
1 answer
1k views

Error states "file is not valid or does not exist; or you do not have permissions" for immediate reimport of files SQL Server just created

We all know that the error "file is not valid or does not exist; or you do not have permissions for it" nearly always means one of two things: There's a typo in the path or filename The ...
Robert N's user avatar
  • 133
2 votes
1 answer
86 views

What is the purpose of the Encrypt by Password Option in TDE syntax?

The information I have so far is that I can simply do the following to create a valid certificate to use for tde. What good or advantage is the Encrypt with Password = option if I can do it without ...
Lee M's user avatar
  • 388
1 vote
1 answer
707 views

How to Restore to AWS RDS SQL Server from TDE Enabled SQL DB(on-premises) backup file stored in S3

I have a on-premises TDE enabled SQL DB backup file available in S3 along with Cert and Pvt Key files. How to restore in AWS RDS SQL DB by utilizing the same master key password provided during source ...
swapna s's user avatar
0 votes
0 answers
177 views

Backup with Compression of large TDE databases

I'm looking for help with Backup Compression for TDE databases, I'm working out of SQL 2016 (SP3-CU1) and am aware that the MaxTransferSize must be specified as over 64K. A few these DBs are over ...
Rebekah W's user avatar
0 votes
0 answers
510 views

Migration SQL managed Instance DB to another tenant SQL MI

I am stuck with a SQL migration between 2 tenants. Any help will be really appreciated.  There is one SQL Server managed instance TDE enabled is sitting in one tenant and we have to move the same to a ...
Tushar's user avatar
  • 1
3 votes
1 answer
482 views

TDE Backups Won't Compress with NOINIT

We run weekly backups of a TDE-enabled database using a command in the following format: BACKUP DATABASE [DBName] TO DISK = N'C:\Temp\DBName.bak' WITH FORMAT, INIT, MEDIANAME = N'DBName ...
Tanner Jotblad's user avatar
0 votes
0 answers
90 views

Does Eperi Gateway for Databases still exist?

Is Eperi Gateway for Databases still offered and maintained? We are interested in implementing TDE (transparent data encryption) on our MariaDB servers in order to have encryption of data at rest. ...
Joe Murray's user avatar
0 votes
1 answer
613 views

ODA X8-2M crossrestore with TDE wallet fails with: DCS-10001:Internal error encountered: failed to open the tde password based wallet

We are trying to crossrestore a TDE encrypted Oracle Database 19.12 on a new ODA X8-2M. TDE wallet has been successfully backedup (odacli create-backup -in CDBET015 -c TDEWallet) and transferred to ...
r0tt's user avatar
  • 1,028
4 votes
1 answer
1k views

Can't restore a backup of database which has TDE enabled

I'm trying to restore the backup of database which has Transparent Data Encryption enabled. I have verified the certificate thumbprint in the backup file is the same as TDE certificate in [master] ...
Mar71ns's user avatar
  • 76
0 votes
1 answer
192 views

Stop Dataguard configuration to test standby database

I would like to know how it would be the correct way in which I should proceed to stop the Dataguard configuration in order to perform a series of tests on the standby database. It turns out that I ...
miguel ramires's user avatar
1 vote
1 answer
1k views

SQL Server 2016 Standard Edition TDE

I have Standard Edition of SQL Server 2016. Is it possible to enable TDE? I understand that it was an enterprise feature but it is now a feature for SQL 2019 Standard and therefore I wondered if there ...
Greg's user avatar
  • 11
0 votes
3 answers
400 views

SQL Server TDE - encryption_state 2 stuck at 100% complete

I have enabled TDE on two databases. One is around 700 GB and that completed over the night and has encryption_state=3 The other one is almost 2 TB. That one has encryption_state=2 and ...
CWiik's user avatar
  • 11
0 votes
2 answers
402 views

unknown variable 'file-key-management-filename'

New installation of Debian 10, with MariaDB 10.3.29. Trying to set up encryption-at-rest, but MariaDB won't start due to an error... [ERROR] /usr/sbin/mysqld: unknown variable 'file-key-management-...
Stephen's user avatar
0 votes
1 answer
2k views

Oracle TDE - opening/closing an encryption wallet

I have a quick question relating to Oracle TDE. Could somebody please explain why both of the following pairs of commands appear to work when opening/closing an ecryption wallet? Is the wallet ...
Franco's user avatar
  • 51
0 votes
1 answer
877 views

Oracle 11g TDE wallet autologin

I have setup Oracle TDE for my 11.2.0.4 database. I created the wallet. I created the autologin wallet and everything looked good. {ORACLE_HOME}/bin/orapki wallet create -wallet cwallet.sso -...
Franco's user avatar
  • 51
0 votes
1 answer
225 views

Oracle 11g Encryption

Can somebody please tell me how to encrypt an existing tablespace in 11g? The wallet has been setup and the sqlnet.ora points to it. SQL> select STATUS FROM V$ENCRYPTION_WALLET; STATUS -----------...
Franco's user avatar
  • 51
0 votes
1 answer
97 views

Is possible to restore BD SQL Server without key encryption from 2008 R2?

I have a database that has an encryption. The encryption key was lost. This database is on a SQL Server 2008 R2 server, and my mandate is to migrate this database on a more recent server. Is there a ...
user avatar
1 vote
0 answers
109 views

TDE error when attempting to encrypt a datafile

I'm encountering error ORA-28374: typed master key not found in wallet when attempting to run alter database datafile '+DATA/testdb/datafile/users.2514.1233355332' encrypt; against an 11g database ...
Franco's user avatar
  • 51
0 votes
1 answer
632 views

Is the BACPAC from a TDE encrypted DB also encrypted?

If you create a BACPAC of an encrypted database, will the data in the BACPAC be encrypted? We're currently using on-prem SQL Server and use TDE to encrypt our customer databases. We also have a ...
SqlNightOwl's user avatar
2 votes
2 answers
983 views

is it safe to compress backups for databases with TDE enabled?

I've been reading about this for a long time, and it seems it's not safe to compress a backup when the database has TDE enabled. is anyone experiencing errors during restore with compressed backups ...
Racer SQL's user avatar
  • 7,386
3 votes
3 answers
2k views

Should I backup Master key / Service master key if I'm using TDE?

I've done this in the past, and now I need to do it again. activate TDE. I remember that I didn't need to restore the master key on the secondary server to restore the database. And now, as I have bad ...
Racer SQL's user avatar
  • 7,386
4 votes
1 answer
559 views

Good practices about Data Encryption

I would like to know (better ideas/best practices...) what can I use to encrypt my data. I've used TDE in the past and I really don't like it. because if something happens with the certificate, and ...
Racer SQL's user avatar
  • 7,386
1 vote
1 answer
600 views

How to restore TDE encrypted DB on AWS (with certificate not stored in master)?

The way Amazon RDS enable TDE feature is to generate a certificate stored in master. However, I need to restore a database that is encrypted by another certificate. I have the cert file, private key ...
Lishengzhen Jane Deng's user avatar
2 votes
0 answers
2k views

SQL Server 2019 and Transparent Data Encryption - Intermittent (silent) Error Log Messages

I recently migrated a SQL Server 2017 TDE database to SQL Server 2019 CU4. I was browsing the Error Log and noticed intermittent messages about An error occurred while processing log encryption. The ...
Scott Hodgin - Retired's user avatar