Configuring Microsoft SQL Server for EKM

This section explains how to configure Microsoft SQL Server for EKM.

Ensure you have configured the KeyControl Vault Database Connector. See Configuring KeyControl Vault Database Connector .

Configure EKM on the SQL Server

To configure Extensible Key Management (EKM) on the SQL Server.

1. Connect with the server.

   

2. Enable Extensible Key Management. Run the following Commands:

   Copy

   sp_configure 'show advanced', 1
   GO
   RECONFIGURE
   GO
   
   sp_configure 'EKM provider enabled', 1
   GO
   RECONFIGURE
   GO

3. Create Cryptographic Provider:

   Copy

   CREATE CRYPTOGRAPHIC PROVIDER EKM_Prov                                   
   FROM FILE = 'c:\program files\hcs\bin\htsqlekm_provider.dll';      
   GO

Configure Cryptographic Provider on SQL Server

To create the KeyControl Vault access token and configure the cryptographic provider on SQL Server.

1. On KeyControl WebGUI interface, navigate to CloudKeys > Keysets > database connectors.

2. Select the database connector and from the Action menu, select Generate Access Token.

   

   

   

3. Copy the access token to your SQL Server and use SQL commands to create “Credential" for your cryptographic provider.

4. Create a credential to be used by system administrators, using the Access Token (Identity and Secret) that you copied to your SQL Studio Server.

   Copy

   CREATE CREDENTIAL sa_ekm_tde_cred                
   WITH IDENTITY = '<Connector name>',
   SECRET = '<Secret Access Key>'
   FOR CRYPTOGRAPHIC PROVIDER EKM_Prov ;
   GO

5. Add the credential to privileged user with domain login in the format [DOMAIN\login].

   Copy

   ALTER LOGIN [DOMAIN\login]
   ADD CREDENTIAL "sa_ekm_tde_cred";         -- Credential created at step 3
   GO