Skip to content

Adds a section on unsupported keys to troubleshoot-tde.md #10106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: live
Choose a base branch
from
Open

Adds a section on unsupported keys to troubleshoot-tde.md #10106

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions docs/relational-databases/security/encryption/troubleshoot-tde.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,22 @@ Confirm that the server has permissions to the key vault and the correct permiss
- If the server identity is present, ensure that it has the following key permissions: Get, WrapKey, and UnwrapKey.
- If the server identity isn't present, add it by using the **Add New** button.

### Wrong key format

**Error message**

_500 InternalServerError - An unexpected error occured while processing the request._

**Detection**

To identify the unsupported key in the key vault:

- Use the Azure portal, go to the **Key vault** service menu > **Objects** > **Keys**, and check the key type and length.

**Mitigation**

Make sure that the key uses a [supported key length](/azure/azure-sql/database/transparent-data-encryption-byok-overview#requirements-for-configuring-tde-protector).

## Getting TDE status from the Activity log

To allow for monitoring of the database status due to Azure Key Vault key access issues, the following events will be logged to the [Activity Log](/azure/service-health/alerts-activity-log-service-notifications) for the resource ID based on the Azure Resource Manager URL.
Expand Down