Sql-server – What are the best practices for backing up a secured SQL Server 2012

backupsql serversql-server-2012ssl

I want to state right off the bat that I'm not looking for information on how to backup a SQL Server. I've got that taken care of.

I'm looking for some form of documentation that will tell me the steps I need to take/things I need to keep in mind to properly back up a secured (with a 3rd party certificate) SQL Server 2012.

What, other than the actual database information, do I need to send to my backup solution so I can ensure minimal downtime in a worst case scenario (knock on wood)?

Best Answer

There's different things you can do with certificates: you can use them to encrypt endpoint communications (like mirroring or AlwaysOn Availability Groups), or you can use them to encrypt databases with Transparent Data Encryption (TDE).

If you're using them to encrypt endpoint communications, just back up the certificates once and keep them in a safe place. I wouldn't expect shops to routinely rotate those certificates.

If you're using them with Transparent Data Encryption, back up both the certificate and the key as described in Books Online:

http://technet.microsoft.com/en-us/library/bb934049.aspx

With TDE, though, you should routinely rotate the keys. Otherwise, when anybody steals the certificate and key, then they can decrypt all of the backups going forward. When you rotate the key, you'll want to immediately back that up again. You can't run backups while the database is re-encrypting with the new key, but back it up again as soon as the re-encryption process is done.