Do TDE certificates expire?

Question

Do not panic, a certificate used in TDE will continue to work even after its expiration date. This is because the Database Encryption Key (DEK) in the user database is the key that encrypts the data at rest. DEK is the symmetric key stored in the user database boot record. 25 июл. 2017 г.

What is a TDE certificate?

Transparent data encryption (TDE) is a new encryption feature introduced in Microsoft SQL Server 2008. It is designed to provide protection for the entire database at rest without affecting existing applications. TDE uses Key Management hierarchy for encryption.

Where is TDE certificate stored?

The TDE certificate is stored inside the TDE-encrypted database, and is itself encrypted using the database master key.

What is the default expiry date while creating a certificate for the TDE encryption?

By default, SQL Server creates a certificate with an expiration date one year in the future.

How can I tell when a SQL Server certificate expires?

Navigate to Security > Machine Certificates and select a certificate to check the expiry date.

Expert · Answer