Backup-SqlTdeCertificate

The certificate that encrypts a database is the only thing that can read those files back. If the server is lost and the certificate was never copied somewhere safe, the encrypted data is gone with it. This command makes that safe copy — the certificate together with its private key — to files you choose, with the private key locked by a password you supply.

Because a certificate copied without its private key is useless for recovery, this command always backs up both; there is no certificate-only option. The password is required and is never written to a log or returned in the result, so you have to store it somewhere safe and separate. Without that password the private-key backup cannot be restored.

Runs BACKUP CERTIFICATE ... TO FILE ... WITH PRIVATE KEY (FILE = ..., ENCRYPTION BY PASSWORD = ...) for the named certificate. Both -CertificatePath and -PrivateKeyPath are mandatory — there is no cert-only form — and -Password (a SecureString) is mandatory. The paths are on the SQL Server’s file system, resolved by the SQL engine. The password is decrypted only to build the statement and is never logged, echoed, or placed in the result; the result reports the two file paths and a reminder to store the password separately. Runs under ShouldProcess (-WhatIf previews). If the certificate does not exist, the result is Failed. Never throws; returns a SqlCert.Result. Data keys: CertificateName, CertificatePath, PrivateKeyPath.

Recipe 01 — Escrow a certificate and its private key

$pw = Read-Host -AsSecureString 'Backup password'
Backup-SqlTdeCertificate -SqlInstance sql01 -Name 'TDE_Cert_2026' `
    -CertificatePath 'E:\escrow\tde.cer' -PrivateKeyPath 'E:\escrow\tde.pvk' -Password $pw

Store the password somewhere safe and separate from the files — it is the only thing that can decrypt the private key.

Recipe 02 — Back up every certificate that has no private-key backup yet

$risky = (Test-SqlTdeConfiguration -SqlInstance sql01).Data.TdeCertificates |
    Where-Object { -not $_.PrivateKeyBackedUp }
$pw = Read-Host -AsSecureString 'Backup password'
$risky | ForEach-Object {
    Backup-SqlTdeCertificate -SqlInstance sql01 -Name $_.Name `
        -CertificatePath "E:\escrow\$($_.Name).cer" -PrivateKeyPath "E:\escrow\$($_.Name).pvk" -Password $pw
}

Uses the read-only preflight to find every TDE certificate whose private key was never escrowed, and backs each one up.

Watchpoint — the password is never stored for you. It is not logged, echoed, or returned. Keep it somewhere safe and separate from the backup files; without it the private-key backup cannot be restored, and neither can the databases the certificate protects.

An encrypted database can only be read by the certificate that encrypted it. Backing up that certificate means writing two things to disk: the certificate itself, and its private key — the secret half that actually does the unlocking. The private key is written in an encrypted form, locked by a password you choose.

This command always writes both halves, because the certificate on its own cannot recover anything. It asks for a password to lock the private-key file, and it never keeps that password for you. That is deliberate: the password is what protects the key, so you store it yourself, apart from the files, where it will still be available if the server is not.

• The private-key backup is mandatory — there is no certificate-only form — so an escrow that would be useless for recovery cannot be produced by mistake.
• -Password is a SecureString, decrypted only to build the statement and never logged, echoed, or returned; the result reports the file paths and a reminder to store the password separately, never the password itself.
• The recorded private-key backup date is what Test-SqlTdeConfiguration and Test-SqlBackupEncryptionReadiness read back to confirm a certificate is escrowed, so the backup leaves an independently checkable record.
• Supports -WhatIf for a no-change preview.