Subscribe to this blog
Briefcase
Print
Does the certificate matter for TDE? Apparently not as I found a number of people discussing the fact that the expiration date for certificates is not checked for TDE restores. So if your certificate expires, you can still restore the TDE backup.
However the documentation doesn’t mention this, and I think it ought to be clarified, so I submitted this Connect item. Feel free to vote if you agree:
Whether the expiration date should matter is another debate. I think it should, but I need to really think about the pros and cons of this.
Filed under: Blog Tagged: Backup/Recovery, encryption, security, sql server, syndicated
Posted by K. Brian Kelley on 30 June 2011
The expiration date should matter. We're told all the time to distrust certificates that are expired. However, practically, the way it's implemented in SQL Server 2008 for TDE, it doesn't work well to force a certificate re-issue. You'd have to decrypt and re-encrypt the entire DB. That's why I was surprised that they tied TDE to a certificate like this.