Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Restore-SqlTdeCertificate

Re-creates a TDE certificate on a rebuilt or disaster-recovery instance from the escrowed certificate file, private-key file, and backup password. Requires...

Domain: Transparent Data Encryption · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

When you rebuild a server, or stand up a disaster-recovery server, you have to put the certificate back so the encrypted backups can be read there. This command does that from the two files and the password that Backup-SqlTdeCertificate produced. It is the step that proves an escrow was worth keeping — a backup that has never been restored is untested.

The target server needs a database master key already in place, because the master key is what protects the restored private key. If that master key is missing, this command stops and tells you, rather than trying to create one. Creating the master key on a recovery server is a separate, deliberate step you take first.

Runs CREATE CERTIFICATE ... FROM FILE ... WITH PRIVATE KEY (FILE = ..., DECRYPTION BY PASSWORD = ...) from the escrow files. Restoring the private key requires a database master key (DMK) in master; if the DMK is absent the result is Pending with guidance. Unlike New-SqlTdeCertificate, restore does not create the DMK for you — a scope choice so the recovery path never carries a second password. Idempotent — a certificate of that name already present yields Skipped. -Password (a SecureString, the same one used at backup) is decrypted only to build the statement and is never logged, echoed, or returned. Runs under ShouldProcess (-WhatIf previews). Never throws; returns a SqlCert.Result. Data keys: CertificateName, CertificatePath, PrivateKeyPath.

Recipe 01 — Re-create the certificate on a DR instance

$pw = Read-Host -AsSecureString 'Backup password'
Restore-SqlTdeCertificate -SqlInstance dr-sql -Name 'TDE_Cert_2026' `
    -CertificatePath 'E:\escrow\tde.cer' -PrivateKeyPath 'E:\escrow\tde.pvk' -Password $pw

After this, a TDE-encrypted database backup taken on the original server can be restored and brought online here.

Recipe 02 — Confirm the master key exists, then preview the restore

Test-SqlTdeConfiguration -SqlInstance dr-sql    # confirm a database master key exists first
$pw = Read-Host -AsSecureString 'Backup password'
Restore-SqlTdeCertificate -SqlInstance dr-sql -Name 'TDE_Cert_2026' `
    -CertificatePath 'E:\escrow\tde.cer' -PrivateKeyPath 'E:\escrow\tde.pvk' -Password $pw -WhatIf

A restore needs a database master key; the preflight confirms one exists before -WhatIf previews the restore.

Watchpoint — a missing master key returns Pending, not Failed. Without a database master key on the target, the result is Pending with instructions to create the master key (with CREATE MASTER KEY, or via New-SqlTdeCertificate -MasterKeyPassword) and then re-run the restore. The password must be the same one used when the certificate was escrowed.

To read an encrypted backup on a fresh server, that server has to hold the same certificate the backup was encrypted with. This command puts the certificate back, using the two files and the password from the earlier backup.

One thing has to be in place first: a database master key on the target server, because it protects the private key you are restoring. This command deliberately does not create that master key for you — if it is missing, it stops and says so. That keeps the recovery path from needing two separate passwords at once, and it makes creating the master key a step you decide on rather than one that happens quietly.

Question Answer
Outbound calls? It connects only to the SQL instance you name, through the optional dbatools or SqlServer provider, and reads the two escrow files at the paths you supply on the SQL Server’s file system. No other outbound call.
What it changes Creates a certificate in master from the escrow files. It does not create the database master key.
Privileges A login able to create certificates in master; the SQL service account must be able to read the two file paths.
Reversibility A restored certificate that is not yet protecting data can be dropped.
Dependency Why Required?
Windows + PowerShell 5.1 or 7 Runs the command. Yes
dbatools or SqlServer module Reaches the SQL instance to run the T-SQL. Yes (either one)
A database master key in master on the target The restored private key is protected by it; if absent the result is Pending. Yes
The escrow certificate + private-key files, and the backup password The certificate is re-created from them. Yes
  • The database master key precondition is explicit — a missing master key returns Pending with guidance rather than a failure that is hard to read, and restore does not create the master key itself.
  • -Password is a SecureString, decrypted only to build the statement and never logged, echoed, or returned.
  • Idempotent and -WhatIf-previewable — restoring onto a server that already has the certificate yields Skipped, and a dry run changes nothing.
  • Running a restore is what turns an escrow from a stored file into a proven recovery path.