Using TDE initialization options
================================

Initializing a TDE-enabled server requires two mandatory settings: one
enables TDE and the other protects the data encryption key.

To enable TDE
-------------

To create a TDE-enabled database server, you must use the :ref:`--data-encryption <--data-encryption>` 
, which creates a data encryption key to encrypt your server.

If you want to copy a key from an existing cluster when preparing a new
cluster as a target for pg_upgrade, additionally use the :ref:`Option: `--copy-key-from=<file>` <Option: `--copy-key-from=<file>`>`  .

To protect the data encryption key
----------------------------------

When creating a TDE-enabled database, TDE generates a data encryption
key that is transparent to the user.

An additional protection mechanism in the form or a wrapping and an
unwrapping command is required to wrap this key, which you must make
available to the database server.

See :ref:`Providing the wrapping and unwrapping commands to TDE <Providing the wrapping and unwrapping commands to TDE>`  for an overview of the available protection mechanism,
and examples of how to provide this configuration to ``initdb`` .

Options reference
-----------------

See :ref:`initdb TDE options <initdb TDE options>`  for an overview of all mandatory and elective options
and supported values.