数据库加密&证书创建

USE master;
GO   
--drop master key
CREATE MASTER KEY ENCRYPTION BY PASSWORD = ‘123456‘;  
GO

BACKUP MASTER KEY TO FILE = ‘D:\SQL1_master.key‘ ENCRYPTION BY   
PASSWORD = ‘123456‘;  
GO    
CREATE CERTIFICATE TDECert WITH SUBJECT = ‘TDE Certificate‘;  
GO

BACKUP CERTIFICATE TDECert TO FILE = ‘D:\SQL1_master.cer‘   
WITH PRIVATE KEY (   
FILE  = ‘D:\SQL1_TDECert.pvk‘,   
ENCRYPTION BY PASSWORD = ‘123456‘   
    );  

USE TEST;   
GO   
CREATE DATABASE ENCRYPTION KEY   
WITH ALGORITHM = AES_128   
ENCRYPTION BY SERVER CERTIFICATE TDECert;

GO
ALTER DATABASE TEST SET ENCRYPTION ON


--如果需要还原加密后的数据库文件到另外一台服务器，需要首先还原证书到目标服务器：
--目标服务器的master key 可以跟原服务器的不一样
USE master;   
CREATE CERTIFICATE TDECert FROM FILE = ‘D:\SQL1_master.cer‘   
      WITH PRIVATE KEY (   
        FILE  = ‘D:\SQL1_TDECert.pvk‘,   
        DECRYPTION BY PASSWORD = ‘123456‘   
    );