1

The goal here is to: Assist client in configuring his Key Vault so that he would be able to enable TDE encryption and access it over the government portal url

Customer Verbatim: "I am running into an issue when trying to enable TDE for SQL Server 2016. I have attached a few files with show the problem. Basically the problem is when SQL tries to connect to the Azure Key Vault it is using the public suffix (azure.net) instead of the the govcloud suffix (usgovcloudapi.net). How do I force it to use the correct URL?" https://vant4gekeyvault.vault.usgovcloudapi.net/

I think the issue is this is a gov tenant and he's stuck using the commercial URL but we were unable to force the correct URL. I sent him instructions on how to Set-AzureRmEnvironment for AzureKeyVaultServiceEndpointResourceId as *.vault.usgovcloudapi.net, should be https://vault.usgovcloudapi.net. but that didn't seem to work. I may be way off on this assumption too, as I'm not really that great in KV. Any Ideas or a known fix?

Here is his error message: ---SQL Msg 33049, Level 16, State 2, Line 17 Key with name 'SqlTDEKey' does not exist in the provider or access is denied. Provider error code: 2058. (Provider Error - No explanation is available, consult EKM Provider for details)

---EVENT LOG The description for Event ID 2 from source SQL Server Connector for Microsoft Azure Key Vault cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Vault Name: EKM Operation Operation: SqlCryptGetKeyInfoByName Key Name: N/A Message: Error when accessing registry:5

tyfraz
  • 11
  • 3

1 Answers1

1

Read the message again, the account doesn't have permission to modify the registry. It's an issue introduced in the feb release of the connector. I ran into a similar issue, the provider tries to create a registry key but doesn't have permissions to do so, therefore it fails. Try the following steps taken from this blogpost [1]

Open regedit

  • Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
  • Create a new Key called “SQL Server Cryptographic Provider” (without quotes)
  • Right click the key, from the context menu select ‘permissions.
  • Give Full Control permissions to this key to the Windows service account that runs SQL Server

[1] https://www.visualstudiogeeks.com/devops/SqlServerKeyVaultConnectorProviderError2058RegistryConsultEKMProvider

Tarun Arora
  • 4,692
  • 4
  • 30
  • 40