Creating a database with TDE#

Create a new EDB Postgres Advanced Server cluster with TDE enabled.

  • Set the environment variables to export the wrap and unwrap commands for encryption.

  • Initialize a server with encryption enabled.

  • Start the database server.

  • Verify TDE is enabled.

Worked example#

This example uses EDB Postgres Advanced Server 15 running on a Linux platform. It uses openssl to define the passphrase to wrap and unwrap the generated data encryption key.

  1. Set the data encryption key (wrap) and decryption (unwrap) environment variables:

export PGDATAKEYWRAPCMD=openssl enc -e -aes-128-cbc -pass pass:ok -out %p
export PGDATAKEYUNWRAPCMD=openssl enc -d -aes-128-cbc -pass pass:ok -in %p

Note

  • If you are on Windows you don't need the single quotes around the variable value. - Ensure you replace ok with the passphrase you want to use to wrap the data encryption key. !!!

  1. Initialize the cluster using initdb with encryption enabled. This command sets the data_encryption_key_unwrap_command parameter in the postgresql.conf file.

/usr/edb/as15/bin/initdb --data-encryption -D /var/lib/edb/as15/data

  1. Start the cluster:

/usr/edb/as15/bin/pg_ctl -D /var/lib/edb/as15/data start

  1. Run grep on postgresql.conf to verify the setting of data_encryption_key_unwrap_command :

grep data_encryption_key_unwrap_command /var/lib/edb/as15/data/postgresql.conf
__OUTPUT__
data_encryption_key_unwrap_command = openssl enc -d -aes-128-cbc -pass pass:ok -in %p

  1. Verifying TDE is enabled .