Skip to main content
The MariaDB integration uses CryptoHub Transparent Data Protection (TDP) to encrypt the complete MariaDB data directory on a Windows server. MariaDB continues to read and write its normal database files while the TDP agent applies encryption according to centrally managed CryptoHub policy.
This guide documents the validated Windows path: CryptoHub 7.2.0.7b, Windows Server 2022, and MariaDB 11.4.12. Do not place a MariaDB InnoDB data directory on a Linux FTDP/FESF mount. The validated FESF build does not provide the file-preallocation behavior that InnoDB requires to initialize its redo log.

​
How the integration works

The TDP agent runs on the MariaDB host and mediates file access under the protected directory. CryptoHub path rules determine both the directory and the Windows identity authorized to read its files in clear text. Encryption keys remain managed by CryptoHub.

MariaDB Transparent Data Protection architecture

The validated flow is:
  1. Deploy the MariaDB service in CryptoHub.
  2. Add path rules for a new data directory and authorize the exact MariaDB service identity.
  3. Create a Windows endpoint and install its TDP bundle.
  4. Restore a logical backup into the protected directory so MariaDB rewrites every file while policy is active.
  5. Verify every regular file, then prove database access after a service restart and Windows reboot.
Two properties are critical:
  • TDP encrypts files when they are written. Existing files do not become encrypted when a rule is added.
  • Rules are identity-scoped. Files written by an unauthorized account can remain clear even beside encrypted MariaDB-owned files.
For these reasons, protecting an existing deployment is a migration, not an in-place switch. Whole-tree verification is required.

​
Why use TDP

TDP protects system tables, redo logs, application databases, and other files within the MariaDB data directory without adding a cryptographic provider to MariaDB. It keeps policy and key management in CryptoHub while preserving normal MariaDB backup, restore, and query workflows. This integration provides file-level encryption at rest. It does not replace application-level controls for individual columns or fields.