Rotating Microsoft SQL Server Keys

Rotating Keys using the webGUI: 

  1. Log in to the CSP Vault for Databases webGUI using an account with Cloud Admin privileges.

  2. In the top menu bar, select CloudKeys.

  3. Click the CloudKeys tab and then select the key that you want to rotate.

  4. In the Details section, in the Rotation Schedule row, click Rotate Now.

Rotating Keys using Microsoft SQL Server: 

Copy 
USE master; 
CREATE ASYMMETRIC KEY TDE_KEY_v2 -- Give the NEW KEK version a name in SQL Server
FROM PROVIDER EKM_Prov 
WITH PROVIDER_KEY_NAME = '<Cloud Key>', -- master_key1 created in KeyControl
CREATION_DISPOSITION = OPEN_EXISTING; 
GO 

CREATE CREDENTIAL tde_ekm_cred_v2 
WITH IDENTITY = 'tde_connect1', 
SECRET = 'xdZ5TCNRLcldfeCr8SDZyu+TJF1kH5MGMZgaj2vZeUgP3Nf2xBh/lWicDzhvaWZCN3w3A5gVlkgG05AnfdlIYafP6HE+zSqsGX Ay4Fx7deZYqTbOcz3HOYmu99IE81fATfG58C1qukmzY9UW3z04p3TaAM2xho30SIhm2hs1iupsXADGBuSVYSxi5C8aH26jrXZFl 6hIiInwK8F3GF3MQSWksRmgruAOSBLfnh+iasM1vqkZ/BHZ/3vRcsZZTrC3DycHXGrZqwcVxZaPsQlok2vC0cRw6m7afBCJI76y 854kIGEflOCvQugGxxyEBpPOOuLrCEQo0y5jr9x2dYgWIr4X24qTnW9+BVMlMqGh2oOmqBqqNFBVUBEUjSIjHZuE/4xo/lH6akn Ru0PHP2JDhvDGpouRfCaJ7/5q1dygiEl1OcSoANemqu44GUaVyAS1esIM182T6rNbbmRgRJsyqznrdTLx02oUPbtbUXRUdh7hgY GPBB+uvid2YYT+NOsXM2nR0XdkxJ59x2RbFErjTGuf6mj756qE2RBzV9eeIEjMQgiajfTUNWz/NTk+Ca5z6Rdznig8VTCLR0Q3i HxF6zb5jSYkLeo0pbeUuuSLtlPX7kkrzFt07j2dj8q3V2lkcvYLOMdgtzzW/ILGjS0jEyZBbyROxK+48WSQ244EVhs=' 
FOR CRYPTOGRAPHIC PROVIDER EKM_Prov ; 
GO 

CREATE LOGIN TDE_Login_v2 
FROM ASYMMETRIC KEY TDE_KEY_v2 ; 
GO 

ALTER LOGIN TDE_Login_v2 
ADD CREDENTIAL tde_ekm_cred_v2 
GO 

use testdb 
GO 

ALTER DATABASE ENCRYPTION KEY 
ENCRYPTION BY SERVER ASYMMETRIC KEY TDE_KEY_v2; 
GO

Check the thumbprint of the TDE key used to encrypt the database key: 

Check the “encryptor thumbprint” to know the version of key used to encrypt the database key.

Copy 
use master 
GO
SELECT DB_NAME(database_id) AS DatabaseName,encryption_state,percent_complete,encryptor_thumbprint, encryptor_type 
FROM sys.dm_database_encryption_keys 
GO