Integrate the Microsoft SQL Server with the Entrust CSP Vault

PS C:\Users\Administrator> cd ~/Downloads
PS C:\Users\Administrator\Downloads> mkdir tde

    Directory: C:\Users\Administrator\Downloads


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         8/12/2026   9:44 AM                tde

PS C:\Users\Administrator\Downloads> cd tde
PS C:\Users\Administrator\Downloads\tde> mv ..\mssql.zip .
PS C:\Users\Administrator\Downloads\tde> Expand-Archive -Path .\mssql.zip -DestinationPath .
PS C:\Users\Administrator\Downloads\tde> ls


    Directory: C:\Users\Administrator\Downloads\tde


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          5/9/2026   1:43 PM          72820 encryptclust.ps1
-a----         8/12/2026   1:29 PM           2748 entrust.conf
-a----         8/12/2026   9:34 AM          56468 mssql.zip
-a----          5/9/2026   1:43 PM          53361 open_db_key.ps1
-a----          5/9/2026   1:43 PM          45073 setup.ps1

#
# kind of a cluster or setup name for your MSSQL failover cluster
# it should be unique in a vault
# script uses this to generate the name of keyset and cvmset
# Make sure these same parameters are used from all the nodes in your MSSQL cluster and DR nodes
#
dbset_name = mssql

#
#
#
# -----> DO NOT USE " or ' to quote the string <-----
# -----> Lines starting with # are comments, but you cannot comment out only part of a line <-----
#
#
#
# KeyControl parameters
# ---------------------
#
kcv_ip_or_fqdn = xx.xxx.xxx.115
#
# If KeyControl mapping has been setup on the KC cluster, it can be provided here
#
kc_mapping = CSPNodeMapping
#

#
# If KeyControl is configured with HSM then it can be enabled using "yes" as value
# if not specified here then the default value is yes if KC has hsm enabled
#
enable_hsm = no
#

#
# Vault parameters
# ---------------------
#
vaultid = 1a6c49fb-45c1-4b97-8e2c-2f3e4c1137bd
user_name = xxxx.xxxx@yourcompany.com
#
# Uncomment the password parameter, if you want to set it here
# if you do not provide password for vault admin then setup script will prompt you
#
# password = password123
#
user_group = Cloud Admin Group

#
# Microsoft SqlServer parameters
# ------------------------------
# The script uses "Windows Authentication", so the credentials of the admin running the script will be used
# In order to use "SQL server authentication", you can set sysadmin_user and sysadmin_password parameters
#
# if sysadmin_user is set then script will call SQL query under the context of this user
#
# For Example
# ------------
# db_server_name = MSSQLSERVER1\MSSQLSERVER1
# sysadmin_user = QA\Administrator
# sysadmin_password = Password123
#
db_server_name = MSSQLCSPW25\MSSQLCSP
#
# Optional parameters, uncomment if you want to set them
# used for --- SQL server authentication
#
# sysadmin_user = <sysadmin_user>
# sysadmin_password = <sysadmin_password>
#

#
# these are the default encryption parameters
# tde_algorithm:   tde master key algorithm
# encryption_algo: algorithm used for data encryption
#
tde_algorithm = RSA_2048
encryption_algo = AES_256


#
# Installation directory
# Please do not change as scripts can not handle non default value yet
#
installation_directory = C:\Program Files\hcs

#
# TDE config file
# this is where the script stores the Access token
# same file path is used on all cluster nodes
#
# By default the script stores the TDE config file here
# ${installation_directory}\tde_configs\${dbset_name}.txt
#
# for example C:\Program Files\hcs\tde_configs\mssql.txt
#
# Uncomment the following line, if you want to store it in custom path
#
# tde_config_file = C:\Users\Administrator.QA\sqltde.txt
# keyset_name = custom_keyset_name
# cvmset_name = custom_cvmset_name
#

PS> .\encryptclust.ps1 -database <my_test_db> -config .\entrust.conf

PS C:\Users\Administrator\Downloads\tde>.\encryptclust.ps1 -database TestDatabase -config .\entrust.conf -nocheckcert

Logging debug trace and output to: C:\Users\Administrator\Downloads\tde\trace\encryptclust_3.log

Checking Active node: my node name is mssqlcspw25, configured server is MSSQLCSPW25\MSSQLCSP
Continuing execution with -nocheckcert flag set, ignoring certificate errors
                   \............... Pass
Checking if database TestDatabase is present on server MSSQLCSPW25\MSSQLCSP
Changed database context to 'TestDatabase'.
                   \............... Pass


##############################################################################
  Encrypting database 'TestDatabase' with TDE master key
##############################################################################

Database TestDatabase is not part of any Availability Group

Using this suffix for all keys, credentials and TDE logins -- 08122026_113419

Database TestDatabase is not encrypted, setting up fresh encryption


Creating key, login and credential in node     MSSQLCSPW25\MSSQLCSP
-------------------------------------------------------------------------
Enabling EKM provider support in MSSql server
                   \............... Done

Creating cryptographic provider entrust_ekm_provider
                   \............... Done

Check credential entrust_sa_ekm_cred for Admin user
Creating credential entrust_sa_ekm_cred for Admin user
                   \............... Done

Adding credential entrust_sa_ekm_cred to XXXX\Administrator login
                   \............... Done

Create TDE master key tmk_TestDatabase_08122026_113419
Changed database context to 'master'.
                   \............... Done

Remove entrust_sa_ekm_cred from Admin login
Changed database context to 'master'.
                   \............... Done

Creating credential tmk_cred_TestDatabase_08122026_113419
                   \............... Done

Creating login tmk_login_TestDatabase_08122026_113419
                   \............... Done

Adding credential tmk_cred_TestDatabase_08122026_113419 to login tmk_login_TestDatabase_08122026_113419
                   \............... Done

Creating database encryption key on node     MSSQLCSPW25\MSSQLCSP
-------------------------------------------------------------------------
Encrypting database TestDatabase with tmk_TestDatabase_08122026_113419
Changed database context to 'TestDatabase'.
                   \............... Done

Generating temporary report file C:\Program Files\hcs\tde_reports\TestDatabase_08122026_113419.report
It will be pushed to KeyControl and removed from local system.
                   \............... Done

Encryption of TestDatabase complete

PS> .\encryptclust.ps1 -database <my_test_db> -config .\entrust.conf -rotate