Skip to main content
Confirm the environment meets these requirements before deploying the integration.

​
Validated software

  • CryptoHub 7.2.0.7b. This build provides the Disk Protection service and Windows TDP endpoint used by this procedure.
  • Windows Server 2022. The TDP agent and MariaDB service-account behavior were validated on this operating system.
  • MariaDB 11.4.12. Adjust executable paths when using another supported MariaDB 11.4 build.
Linux FTDP is outside the supported scope of this guide. MariaDB InnoDB cannot initialize its data directory on the validated FESF build because redo-log file preallocation is unavailable. Use the Windows TDP procedure until a supported Linux path is available.

​
Required access

  • CryptoHub administrator identities under dual control: required to deploy the service, configure path rules, and create the endpoint.
  • Local administrator access on the MariaDB host: required to install TDP, import trust, change the Windows service command, and restart Windows.
  • A MariaDB administrative account: required to create and restore the logical backup and run the verification queries.
The validated service uses Local authentication. Kerberos and Active Directory authentication are outside this guide’s validated scope.

​
Network and trust

  • Allow outbound TCP 443 from the MariaDB host to the CryptoHub REST interface. The TDP agent uses this connection to retrieve policy and keys.
  • Configure the endpoint with a CryptoHub hostname covered by the REST certificate’s subject alternative name. Hostname validation fails when the configured address is absent from the certificate.
  • Exempt the CryptoHub hostname from TLS inspection. An intercepting proxy can replace the certificate chain and prevent the agent from authenticating the CryptoHub endpoint.
Do not disable certificate or hostname verification in production.

​
Data and identity preparation

  • Confirm the Windows service identity with sc.exe qc MariaDB. The standard MariaDB installer uses NT SERVICE\MariaDB; a customized service can use a different account.
  • Reserve C:\MariaDBData as the new protected data directory. The path rules and service configuration must reference the same directory.
  • Create a tested logical backup before changing the service. The restore causes MariaDB to rewrite the complete database tree while TDP policy is active.
  • Plan secure temporary storage for the logical dump. It contains clear database content and must be removed after successful restore and verification.
Do not migrate the existing data directory with File Explorer, Copy-Item, robocopy, or another file-copy tool. TDP does not retroactively encrypt copied files.