Get DuoKey SQL EKM running and encrypt your first database
This quick start guide walks you through encrypting your first SQL Server database with DuoKey EKM. By the end, you'll have:
SQL EKM app configured in DuoKey platform
Cryptographic provider installed on SQL Server
SQL Server configured with DuoKey authentication
Test database encrypted with TDE
Navigate to the DuoKey cloud platform and sign in with your credentials.
Go to Apps → Create New APP → Select DuoKey for SQL → Click Install Now
Download the setup file and securely note:
Extract the downloaded setup ZIP file to a temporary location.
Right-click setup.exe → Run as Administrator
Confirm these DLL files exist in C:\Windows\System32:
DuoKeyCryptoProvider.dlllibcurl.dllzlib1.dllfmt.dll-- Verify DLL is accessible by SQL Server
EXEC xp_fileexist 'C:\Windows\System32\DuoKeyCryptoProvider.dll';
GOOpen SQL Server Management Studio (SSMS), connect to your instance, and execute the following configuration script. Replace all placeholders with your actual values.
-- =============================================
-- DuoKey SQL EKM Configuration Script
-- Replace <placeholders> with your values
-- =============================================
-- Step 1: Enable EKM
sp_configure 'show advanced', 1;
GO
RECONFIGURE;
GO
sp_configure 'EKM provider enabled', 1;
GO
RECONFIGURE;
GO
-- Step 2: Create Cryptographic Provider
CREATE CRYPTOGRAPHIC PROVIDER DuoKeyProvider
FROM FILE = 'C:\Windows\System32\DuoKeyCryptoProvider.dll';
GO
-- Step 3: Create Credentials
-- Format: client_secret<!COCKPITPW!>password<!COCKPITPW!>CockpitIntrospectPwd
CREATE CREDENTIAL DuoKeyCredential
WITH IDENTITY = '<your_client_id>',
SECRET = '<your_client_secret><!COCKPITPW!><your_password><!COCKPITPW!>CockpitIntrospectPwd'
FOR CRYPTOGRAPHIC PROVIDER DuoKeyProvider;
GO
-- Step 4: Map Credential to Login
ALTER LOGIN [sa]
ADD CREDENTIAL DuoKeyCredential;
GO
-- Step 5: Create Asymmetric Key
USE master;
GO
CREATE ASYMMETRIC KEY SQL_EKM_Key
FROM PROVIDER DuoKeyProvider
WITH ALGORITHM = RSA_2048,
PROVIDER_KEY_NAME = 'SQL_EKM_Key',
CREATION_DISPOSITION = CREATE_NEW;
GO
-- Step 6: Create Key Credentials
CREATE CREDENTIAL SQL_EKM_Key_Cred
WITH IDENTITY = '<your_client_id>',
SECRET = '<your_client_secret><!COCKPITPW!><your_password><!COCKPITPW!>CockpitIntrospectPwd'
FOR CRYPTOGRAPHIC PROVIDER DuoKeyProvider;
GO
-- Step 7: Create Key Login
CREATE LOGIN SQL_EKM_Key_Login
FROM ASYMMETRIC KEY SQL_EKM_Key;
GO
ALTER LOGIN SQL_EKM_Key_Login
ADD CREDENTIAL SQL_EKM_Key_Cred;
GO
PRINT 'Configuration complete. Enable Encrypt operation in DuoKey Cockpit.';
GOBefore proceeding to Phase 4, you must enable the Encrypt operation in DuoKey:
SQL_EKM_KeyNow let's create a test database and encrypt it using TDE with DuoKey EKM.
-- Create test database
CREATE DATABASE TestEncryptedDB;
GO
-- Create Database Encryption Key
USE TestEncryptedDB;
GO
CREATE DATABASE ENCRYPTION KEY
WITH ALGORITHM = AES_256
ENCRYPTION BY SERVER ASYMMETRIC KEY SQL_EKM_Key;
GO
-- Enable encryption
ALTER DATABASE TestEncryptedDB
SET ENCRYPTION ON;
GO
-- Verify encryption status
SELECT
DB_NAME(database_id) AS [Database],
CASE encryption_state
WHEN 0 THEN 'No encryption key'
WHEN 1 THEN 'Unencrypted'
WHEN 2 THEN 'Encryption in progress'
WHEN 3 THEN 'Encrypted'
WHEN 4 THEN 'Key change in progress'
WHEN 5 THEN 'Decryption in progress'
END AS [Status],
percent_complete AS [Progress %]
FROM sys.dm_database_encryption_keys
WHERE DB_NAME(database_id) = 'TestEncryptedDB';
GO3 means the database is fully encrypted. State 2 means encryption is still in progress - wait for it to complete before proceeding.Run these queries to verify your complete setup is working correctly:
-- 1. EKM Provider Status
SELECT name, guid, version
FROM sys.cryptographic_providers;
GO
-- 2. Credentials Created
SELECT name, credential_identity, create_date
FROM sys.credentials
WHERE name LIKE '%DuoKey%' OR name LIKE '%EKM%';
GO
-- 3. Asymmetric Keys
SELECT name, algorithm_desc, key_length, thumbprint
FROM sys.asymmetric_keys;
GO
-- 4. Encrypted Databases
SELECT
d.name AS DatabaseName,
d.is_encrypted,
dek.encryption_state
FROM sys.databases d
LEFT JOIN sys.dm_database_encryption_keys dek
ON d.database_id = dek.database_id
WHERE d.is_encrypted = 1;
GO| Issue | Cause | Solution |
|---|---|---|
| EKM not enabled | SQL Server edition or config | Verify edition; run sp_configure commands |
| Cannot create provider | DLL not found | Verify DuoKeyCryptoProvider.dll in System32 |
| Credential format error | Invalid SECRET format | Check <!COCKPITPW!> delimiters |
| Key creation fails | Encrypt not enabled | Enable Encrypt operation in DuoKey Cockpit |
| Connection timeout | Network issue | Verify HTTPS 443 access to DuoKey platform |
Congratulations! You've successfully set up DuoKey SQL EKM and encrypted your first database. Here's what to explore next: