USE master

GO

--Create master key

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'm@5te7P@55w0rd'
GO

--Create certificate used for database encryption

CREATE CERTIFICATE ServerCert WITH SUBJECT = 'TDE Server Cert'
GO

USE NuggetDemoDB
GO

--Create database encryption key (DEK) and protect using certificate

CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_128
ENCRYPTION BY SERVER CERTIFICATE ServerCert
GO

--Encrypt database
ALTER DATABASE NuggetDemoDB
SET ENCRYPTION ON
GO

--Dynamic Management View to see encryption state

SELECT * FROM sys.dm_database_encryption_keys

USE master
GO

--Backup certificate stored in master database

BACKUP CERTIFICATE ServerCert TO FILE = 'TDE Server Cert'
WITH PRIVATE KEY (
FILE = 'PrivateKeyFile',
ENCRYPTION BY PASSWORD = '\o/_P@55w0rd_\o/'
)
GO

--Recreate certificate
CREATE CERTIFICATE TestSQLServerCert FROM FILE = 'TDE Server Cert'
WITH PRIVATE KEY (
FILE = 'PrivateKeyFile',
DECRYPTION BY PASSWORD = '\o/_P@55w0rd_\o/'
)
GO