Use the procedure below to set up a CSP Vault for Databases production environment for Microsoft SQL Server. 

Prerequisites

Before you begin, make sure you have created a CSP Vault for Databases. For more information about creating a vault, see: Creating a Vault.

To set up a CSP Vault production environment

  1. Log in to the Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. (optional) Create a CSP cluster node mapping. For more information, see: Creating a Cluster Node Mapping for CSP Vault for Databases.

    A CSP cluster node mapping helps Entrust client on the database node to failover in case one of the CSP node fails.

  3. Download the TDE script bundle. For more information, see: Downloading the TDE Script Bundle for Microsoft SQL Server.

    The prefix specified when downloading the TDE scripts is stored in entrust.conf as the DBSet name. The DBSet name does not represent an actual object. It serves as the base name for generating the associated CVMSet and KeySet names. For example, if the DBSet name is sqlserver, the scripts create the KeySet sqlserver_keyset and the CVMSet sqlserver_cvmset.  You can change the DBSet name in entrust.conf after downloading the TDE scripts.

  4. Copy the TDE script bundle to the first Microsoft SQL server node.

    The bundle is a ZIP file named <name>.zip, where <name> is the name you specified when downloading the bundle in To set up a CSP Vault production environment. For example, mssql_toi.zip.

    The steps below use mssql_toi.zip as an example.

  5. Open your Microsoft SQL server.
  6. Navigate to the folder where the TDE scripts are stored.
  7. Unblock the TDE script bundle by running the following PowerShell command:
    Unblock-File -Path "<path-to-your-file>"

  8. Extract the TDE script bundle by running the following command: 
    Unzip -Path "<path-to-your-file>" -DestinationPath "<destination-path>"
    For example:
    Unzip -Path .\mssql.zip -DestinationPath C:\Users\Administrator\mssql

    The bundle contains the following files:

    • check-connection.exe

    • encryptclust.ps1

    • entrust.conf

    • entrust_dbmstudio.ps1

    • htsql ekm_provider.dll

    • open_db_key.ps1

    • precheck.ps1

    • setup.ps1

  9. Set up the first Microsoft SQL server node. In PowerShell, run:
    .\setup.ps1 -node first -config .\entrust.conf
  10. At the prompt, enter the password for the CSP Vault for Databases.
  11. At the prompt, enter the password for the vault administrator of the CSP Vault for Databases.
  12. At the prompt, log in to the CSP Vault for Databases as the vault administrator. The setup script creates the KeySet and the CVMset in your CSP Vault for Databases.
  13. At the prompt, verify that the Microsoft SQL server node can communicate with CSP Vault for Databases:
    PS> hcl status and PS> check-connection <Access Token File Path>
    For more information about checking Microsoft SQL server connections, see Checking your Microsoft SQL Server Connections.