Appendix B: Migrate from software-based TDE to TDE with EKM

Transparent Data Encryption (TDE) in SQL Server utilizes a database encryption key (DEK), a symmetric key that encrypts the data. By default, this DEK is protected by a server certificate (the “software-stored” key) in the master database. However, SQL Server also supports protecting the DEK with an external HSM-managed asymmetric key via Extensible Key Management (EKM). In other words, the DEK can be wrapped by either a certificate or an EKM-backed key. It is indeed possible to switch an existing software-based TDE-enabled database to TDE with EKM. The process simply re-wraps (rotates) the DEK under the new key. Rotating the TDE protector is an online operation that only decrypts and re-encrypts the DEK, not the entire database. This means the data stays encrypted with the same symmetric key, preserving continuity.

Migration Steps

Let’s assume your current database is called legacyDB, and it’s encrypted with a DEK protected by a software certificate (which is SQL Server’s default when TDE is initially enabled). Our goal: rewrap that DEK under EkmAsym without re-encrypting the data.

Before proceeding with the steps below, ensure you have completed the steps outlined in

Here’s the migration procedure:

Verify Current Encryption State

Sql

SELECT db.name,
       dek.encryption_state,
       dek.encryptor_type
FROM sys.dm_database_encryption_keys dek
JOIN sys.databases db ON dek.database_id = db.database_id
WHERE db.name = 'legacyDB';

Look for:

encryption_state = 3 → means “encrypted”
encryptor_type = CERTIFICATE → this confirms it’s using the software certificate

Back Up the Current CertificateIt is highly recommended to backup the current certificate in case you need to decrypt older backups:

Sql

USE master;
GO
BACKUP CERTIFICATE YourCurrentTDECert
    TO FILE = 'C:\Backup\YourCurrentTDECert.cer'
    WITH PRIVATE KEY (
        FILE = 'C:\Backup\YourCurrentTDECert_PrivateKey.pvk',
        ENCRYPTION BY PASSWORD = 'someStrongPassword123!');
GO

Replace YourCurrentTDECert with the actual certificate name from:

Sql

SELECT name FROM sys.certificates WHERE pvt_key_encryption_type_desc = 'BY_MASTER_KEY';

Rewrap the DEK with the EkmAsym key created on the KMES through EKM in the Enable TDE in Microsoft SQL Server by using EKM section.

Sql

USE legacyDB;
GO
ALTER DATABASE ENCRYPTION KEY
    ENCRYPTION BY SERVER ASYMMETRIC KEY EkmAsym;
GO

This rewraps the existing DEK under EkmAsym. SQL Server does not generate a new DEK - it just updates the protector.You can verify the switch by running this command again:

Sql

SELECT db.name,
       dek.encryption_state,
       dek.encryptor_type
FROM sys.dm_database_encryption_keys dek
JOIN sys.databases db ON dek.database_id = db.database_id
WHERE db.name = 'EmployeeDB';

Expected result:

encryption_state = 3 → means “encrypted”
encryptor_type = ASYMMETRIC KEY → this confirms it’s using the EKM-stored key

​Migration Steps

Migration Steps