TDE - Impact on TempDB and other Unencrypted DBs in that Instance

Question

TDE - Impact on TempDB and other Unencrypted DBs in that Instance

SQL!$@w$0ME

SSChampion

Points: 12349
More actions
March 3, 2016 at 8:37 pm

#316490

Once TDE is enabled on a DB tempdb automatically gets encrypted.
Once the TempDB database is encrypted, any reference and use of this database by other databases, regardless of whether they have TDE enabled or not, will require encryption and decryption.
https://www.simple-talk.com/sql/database-administration/transparent-data-encryption/
Does the above statements mean that all DBs in this SQL server instance need to be TDE enabled?
Please provide some thoughts on this.
Many thanks!

Viewing 6 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply

TheSQLGuru SSC Guru Points: 134017 More actions · Answer 1

No. It means precisely what it says. Nothing more and nothing less. Any data going into/out of tempdb, regardless of the source of that data, gets the encryption overhead. There is no effect on any other database that is not TDE encrypted.

That's my take anyway.

Best,
Kevin G. Boles
SQL Server Consultant
SQL MVP 2007-2012
TheSQLGuru on googles mail service

SQL!$@w$0ME SSChampion Points: 12349 More actions · Answer 2

Thanks Kevin.

Can we use one server certificate(master db) to encrypt multiple dbs in the instance. Or should we create multiple certificates for each TDE db. If so any impact on this? Any best practices to follow here.

TheSQLGuru SSC Guru Points: 134017 More actions · Answer 3

The few clients I have had use this feature went the simple route. I don't know a best practice here.

Best,
Kevin G. Boles
SQL Server Consultant
SQL MVP 2007-2012
TheSQLGuru on googles mail service

Perry Whittle SSC Guru Points: 234065 More actions · Answer 4

SQL!$@w$0ME (3/3/2016)
Thanks Kevin.
Can we use one server certificate(master db) to encrypt multiple dbs in the instance. Or should we create multiple certificates for each TDE db. If so any impact on this? Any best practices to follow here.

Yes, you could use the same server certificate, but you would generally use a new cert for each TDE protected database. Otherwise if someone gets the cert for one they have it for them all

-----------------------------------------------------------------------------------------------------------

"Ya can't make an omelette without breaking just a few eggs" 😉

SQL!$@w$0ME SSChampion Points: 12349 More actions · Answer 5

Thanks Perry!

I need to enable TDE for one of the dbs in a DEV server. Is there any impact to the users during this process of encryption. Should I take an outage/downtime for this process?

Many thanks!