Sql-server – How to create Always Encrypted Certificate for specific time period

Since Mirroring operates by shipping over a live transaction log to the secondary servers, you'll need to start a new mirroring session.

Your secondary database has been out of sync for a week and unless you've managed to maintain a transaction log on the primary that spans that entire time (hint: you haven't), you'll need to start with a fresh backup on the secondary to establish a mirror session again.

This is also faster than theoretically letting a week's worth of logs get re-applied to the secondary anyways.

As for the primary database's availability, yes it will be available during any sync (whether resuming after a pause or setting up a new mirror), because it's always sending transaction logs to the secondary but that does not interfere with it's own availability.

Certs from trusted CAs (like VeriSign) are used when you need a certificate that must be able to prove its issuer, purpose, validity, etc... Certs for data encryption like Always Encrypted typically do not require such proof since your certs typically don't float beyond your org. I don't know of any use case where you would benefit from using a 3rd party CA cert in an AE deployment. Even when you have strict management/rotation policies, I can't think of any common policy that you can't implement using a corporate issued cert or even a self-signed cert (though the latter will have a bit more manual work).