You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Add decryption procedure to DROP COLUMN ENCRYPTION KEY article with step-by-step workflow
- Document certificate renaming limitation in ALTER CERTIFICATE article with TDE workaround
- Apply Microsoft Writing Style Guide compliance (active voice, contractions)
- Update Related content sections and metadata
@@ -52,9 +52,8 @@ ALTER CERTIFICATE certificate_name
52
52
[ DECRYPTION BY PASSWORD = 'current_password' ]
53
53
[ [ , ] ENCRYPTION BY PASSWORD = 'new_password' ]
54
54
}
55
-
```
56
-
57
-
55
+
```
56
+
58
57
```syntaxsql
59
58
-- Syntax for Parallel Data Warehouse
60
59
@@ -65,57 +64,108 @@ ALTER CERTIFICATE certificate_name
65
64
FILE = '<path_to_private_key>',
66
65
DECRYPTION BY PASSWORD = '<key password>' )
67
66
}
68
-
```
67
+
```
69
68
70
69
## Arguments
71
-
*certificate_name*
72
-
Is the unique name by which the certificate is known in the database.
70
+
71
+
*certificate_name*
72
+
The unique name by which the certificate is known in the database.
73
73
74
74
REMOVE PRIVATE KEY
75
-
Specifies that the private key should no longer be maintained inside the database.
75
+
Specifies that the private key will no longer be maintained inside the database.
76
76
77
77
WITH PRIVATE KEY
78
78
Specifies that the private key of the certificate is loaded into SQL Server.
79
79
80
-
FILE ='*path_to_private_key*'
81
-
Specifies the complete path, including file name, to the private key. This parameter can be a local path or a UNC path to a network location. This file will be accessed within the security context of the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] service account. When you use this option, make sure the service account has access to the specified file.
82
-
83
-
If only a file name is specified, the file is saved in the default user data folder for the instance. This folder might (or might not) be the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] DATA folder. For SQL Server Express LocalDB, the default user data folder for the instance is the path specified by the `%USERPROFILE%` environment variable for the account that created the instance.
84
-
85
-
BINARY ='*private_key_bits*'
80
+
FILE ='*path_to_private_key*'
81
+
Specifies the complete path, including file name, to the private key. This parameter can be a local path or a UNC path to a network location. The file is accessed within the security context of the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] service account. When you use this option, make sure the service account has access to the specified file.
82
+
83
+
If you specify only a file name, the file is saved in the default user data folder for the instance. This folder might or might not be the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] DATA folder. For SQL Server Express LocalDB, the default user data folder for the instance is the path specified by the `%USERPROFILE%` environment variable for the account that created the instance.
84
+
85
+
BINARY ='*private_key_bits*'
86
86
**Applies to**: [!INCLUDE[ssSQL11](../../includes/sssql11-md.md)] and later.
87
87
88
-
Private key bits specified as binary constant. These bits can be in encrypted form. If encrypted, the user must provide a decryption password. Password policy checks are not performed on this password. The private key bits should be in a PVK file format.
89
-
90
-
DECRYPTION BY PASSWORD ='*current_password*'
91
-
Specifies the password that is required to decrypt the private key.
92
-
93
-
ENCRYPTION BY PASSWORD ='*new_password*'
94
-
Specifies the password used to encrypt the private key of the certificate in the database. *new_password* must meet the Windows password policy requirements of the computer that is running the instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. For more information, see [Password Policy](../../relational-databases/security/password-policy.md).
95
-
96
-
ACTIVE FOR BEGIN_DIALOG **=** { ON | OFF }
97
-
Makes the certificate available to the initiator of a [!INCLUDE[ssSB](../../includes/sssb-md.md)] dialog conversation.
98
-
99
-
## Remarks
100
-
The private key must correspond to the public key specified by *certificate_name*.
101
-
102
-
The DECRYPTION BY PASSWORD clause can be omitted if the password in the file is protected with a null password.
103
-
104
-
When the private key of a certificate that already exists in the database is imported, the private key will be automatically protected by the database master key. To protect the private key with a password, use the ENCRYPTION BY PASSWORD clause.
105
-
106
-
The REMOVE PRIVATE KEY option will delete the private key of the certificate from the database. You can remove the private key when the certificate will be used to verify signatures or in [!INCLUDE[ssSB](../../includes/sssb-md.md)] scenarios that do not require a private key. Do not remove the private key of a certificate that protects a symmetric key. The private key will need to be restored in order to sign any additional modules or strings that should be verified with the certificate, or to decrypt a value that has been encrypted with the certificate.
107
-
108
-
You do not have to specify a decryption password when the private key is encrypted by using the database master key.
109
-
110
-
To change the password used for encrypting the private key, do not specify either the FILE or BINARY clauses.
88
+
Private key bits specified as binary constant. These bits can be in encrypted form. If encrypted, you must provide a decryption password. SQL Server doesn't perform password policy checks on this password. The private key bits should be in a PVK file format.
111
89
90
+
DECRYPTION BY PASSWORD ='*current_password*'
91
+
Specifies the password that is required to decrypt the private key.
92
+
93
+
ENCRYPTION BY PASSWORD ='*new_password*'
94
+
Specifies the password used to encrypt the private key of the certificate in the database. *new_password* must meet the Windows password policy requirements of the computer that is running the instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. For more information, see [Password Policy](../../relational-databases/security/password-policy.md).
95
+
96
+
ACTIVE FOR BEGIN_DIALOG **=** { ON | OFF }
97
+
Makes the certificate available to the initiator of a [!INCLUDE[ssSB](../../includes/sssb-md.md)] dialog conversation.
98
+
99
+
## Remarks
100
+
101
+
The private key must correspond to the public key specified by *certificate_name*.
102
+
103
+
You can omit the DECRYPTION BY PASSWORD clause if the password in the file is protected with a null password.
104
+
105
+
When you import the private key of a certificate that already exists in the database, the private key is automatically protected by the database master key. To protect the private key with a password, use the ENCRYPTION BY PASSWORD clause.
106
+
107
+
The REMOVE PRIVATE KEY option deletes the private key of the certificate from the database. You can remove the private key when you use the certificate to verify signatures or in [!INCLUDE[ssSB](../../includes/sssb-md.md)] scenarios that don't require a private key. Don't remove the private key of a certificate that protects a symmetric key. You need to restore the private key to sign any additional modules or strings that should be verified with the certificate, or to decrypt a value that was encrypted with the certificate.
108
+
109
+
You don't have to specify a decryption password when the private key is encrypted by using the database master key.
110
+
111
+
To change the password used for encrypting the private key, don't specify either the FILE or BINARY clauses.
112
+
112
113
> [!IMPORTANT]
113
-
> Always make an archival copy of a private key before removing it from a database. For more information, see [BACKUP CERTIFICATE (Transact-SQL)](../../t-sql/statements/backup-certificate-transact-sql.md) and [CERTPRIVATEKEY (Transact-SQL)](../../t-sql/functions/certprivatekey-transact-sql.md).
114
-
115
-
The WITH PRIVATE KEY option is not available in a contained database.
116
-
117
-
## Permissions
118
-
Requires ALTER permission on the certificate.
114
+
> Always make an archival copy of a private key before removing it from a database. For more information, see [BACKUP CERTIFICATE (Transact-SQL)](../../t-sql/statements/backup-certificate-transact-sql.md) and [CERTPRIVATEKEY (Transact-SQL)](../../t-sql/functions/certprivatekey-transact-sql.md).
115
+
116
+
The WITH PRIVATE KEY option isn't available in a contained database.
117
+
118
+
## Limitations
119
+
120
+
Certificate names can't be changed after creation. ALTER CERTIFICATE doesn't support renaming certificates. If you need to use a different certificate name, you must create a new certificate and migrate dependencies.
121
+
122
+
### Workaround for TDE certificates
123
+
124
+
If you need to replace a Transparent Data Encryption (TDE) certificate with a different name:
125
+
126
+
1.**Back up the current certificate and private key**:
127
+
128
+
```sql
129
+
BACKUP CERTIFICATE OldTDECert
130
+
TO FILE ='C:\Backup\OldTDECert.cer'
131
+
WITH PRIVATE KEY (
132
+
FILE ='C:\Backup\OldTDECert.pvk',
133
+
ENCRYPTION BY PASSWORD ='<password>'
134
+
);
135
+
```
136
+
137
+
1.**Create the new certificate with the correct name**:
138
+
139
+
```sql
140
+
CREATE CERTIFICATE NewTDECert
141
+
WITH SUBJECT ='TDE Certificate - Correct Name';
142
+
```
143
+
144
+
1.**For each TDE-encrypted database, change the encryption key**:
145
+
146
+
```sql
147
+
USE EncryptedDB;
148
+
GO
149
+
150
+
ALTERDATABASE ENCRYPTION KEY
151
+
ENCRYPTION BY SERVER CERTIFICATE NewTDECert;
152
+
```
153
+
154
+
1.**After all databases are migrated, drop the old certificate**:
155
+
156
+
```sql
157
+
USE master;
158
+
GO
159
+
160
+
DROP CERTIFICATE OldTDECert;
161
+
```
162
+
163
+
> [!IMPORTANT]
164
+
> Always back up certificates and private keys before making TDE changes. Store backups in a secure location separate from the database server.
165
+
166
+
## Permissions
167
+
168
+
Requires ALTER permission on the certificate.
119
169
120
170
## Examples
121
171
@@ -152,16 +202,15 @@ ALTER CERTIFICATE Shipping15
152
202
WITH PRIVATE KEY (DECRYPTION BY PASSWORD ='95hk000eEnvjkjy#F%');
description: DROP COLUMN ENCRYPTION KEY (Transact-SQL)
4
4
author: jaszymas
5
5
ms.author: jaszymas
6
-
ms.date: "10/15/2019"
6
+
ms.date: "01/30/2026"
7
7
ms.service: sql
8
8
ms.subservice: t-sql
9
9
ms.topic: reference
@@ -30,35 +30,55 @@ dev_langs:
30
30
31
31
```syntaxsql
32
32
DROP COLUMN ENCRYPTION KEY key_name [;]
33
-
```
33
+
```
34
34
35
35
## Arguments
36
-
*key_name*
37
-
Is the name by which the column encryption key to be dropped from the database.
36
+
37
+
*key_name*
38
+
The name of the column encryption key to drop from the database.
38
39
39
40
## Remarks
40
-
A column encryption key cannot be dropped if it is used to encrypt any column in the database. All columns using the column encryption key must first be dropped.
41
-
42
-
## Permissions
43
-
Requires **ALTER ANY COLUMN ENCRYPTION KEY** permission on the database.
44
-
45
-
## Examples
46
-
47
-
### A. Dropping a column encryption key
48
-
The following example drops a column encryption key called `MyCEK`.
49
-
41
+
42
+
A column encryption key can't be dropped if it's used to encrypt any column in the database. All columns using the column encryption key must first be decrypted or dropped.
43
+
44
+
To remove encryption from a column:
45
+
46
+
1.**Decrypt the column** - Use `ALTER TABLE` to modify the encrypted column, removing the encryption specification:
47
+
48
+
```sql
49
+
ALTERTABLEdbo.Employees
50
+
ALTER COLUMN SSN NVARCHAR(11);
51
+
```
52
+
53
+
2.**Drop the column encryption key** - After all columns using the key are decrypted, you can drop the key:
54
+
55
+
```sql
56
+
DROP COLUMN ENCRYPTION KEY MyCEK;
57
+
```
58
+
59
+
Alternatively, if you no longer need the column data, you can drop the column entirely using `ALTER TABLE DROP COLUMN` before dropping the encryption key.
60
+
61
+
## Permissions
62
+
63
+
Requires **ALTER ANY COLUMN ENCRYPTION KEY** permission on the database.
64
+
65
+
## Examples
66
+
67
+
### A. Dropping a column encryption key
68
+
69
+
The following example drops a column encryption key called `MyCEK`.
0 commit comments