Use the procedures below to set up a CSP Vault for Database test environment for Microsoft SQL Server. 

Prerequisites

Before you begin, make sure you have created a different instance of the same CSP Vault for Database. For more information about creating a vault, see: Creating a Vault.

To set up a CSP Vault test environment

  1. Log in to the Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. (optional) Create a CSP cluster node mapping. For more information, see: Creating a Cluster Node Mapping for CSP Vault for Databases.

    A CSP cluster node mapping helps Entrust client on the database node to failover in case one of the CSP node fails.

  3. Download the TDE script bundle. For more information, see: Downloading the TDE Script Bundle for Microsoft SQL Server.

    The prefix specified when downloading the TDE scripts is stored in entrust.conf as the DBSet name. The DBSet name does not represent an actual object. It serves as the base name for generating the associated CVMSet and KeySet names. For example, if the DBSet name is sqlserver, the scripts create the KeySet sqlserver_keyset and the CVMSet sqlserver_cvmset.  You can change the DBSet name in entrust.conf after downloading the TDE scripts.

    The CVMSet and KeySet names must be the same in the production and test environments. When setting up the connection between the test database server and test CSP Vault for Databases, use the same DBSet name in entrust.conf as in the production environment.

To set up a CSP Vault test environment

  1. Copy the TDE script bundle to the second Microsoft SQL server node.

    The bundle is a ZIP file named <name>.zip, where <name> is the name you specified when downloading the bundle in To set up a CSP Vault test environment. For example, mssql_toi(1).zip.

    The steps below use mssql_toi(1) as an example.

  2. Open Git bash.
  3. Run the following command to download the TDE script bundle from the CSP Vault test environment:
    scp Downloads/mssql_toi\(1\).zip mssql@<ip-address>:mssql_toi.zip
  4. Open your second Microsoft SQL server node.
  5. Unzip the TDE script bundle:
    unzip mssql_toi.zip
  6. Navigate to the TDE script bundle folder:
    cd mssql_toi/
  7. Verify the KeyControl Vault (KCV)-related configuration settings in the entrust.conf file:
    grep kcv entrust.conf

    Note that the terminal displays the first Microsoft SQL server node because that is the first node in the test environment.

  8. Set up the second Microsoft SQL server node as root:
    sudo ./setup.sh first ./entrust.conf

    The test environment is independent of the production environment. Perform this step as a first-node setup to create the CVM Set and KeySet in the test environment.

  9. At the prompt, enter your password for the Microsoft SQL server node.
  10. At the prompt, enter the password for the CSP Vault for Database.
  11. At the prompt, log in to the Microsoft SQL server node as the vault administrator. The system creates the KeySet and the CVMset.
  12. At the prompt, verify that the Microsoft SQL server node can communicate with CSP Vault for Database:
    /opt/hcs/bin/check_connection /opt/mssql/entrust/mssql_toi.conf

    You now have two independent CSP Vault for Database and Microsoft SQL server environments: a production environment and a test environment.