Skip to content

Commit

Permalink
Edits to TDE: improvements and fixes for DOCS-1147 #6342
Browse files Browse the repository at this point in the history
  • Loading branch information
ebgitelman committed Dec 18, 2024
1 parent 5a2fcb0 commit 0df472a
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions product_docs/docs/tde/15/secure_key/disabling_key.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@ description: Learn how to omit using a wrapping key.
deepToc: true
---

If you don't want key wrapping, for example, for testing purposes, you can use either one of the following options to disable key wrapping:
If you don't want key wrapping, for example, for testing purposes, you can use either of the following options to disable key wrapping:

- You can set the wrap and unwrap commands to the special value `-` when initializing the cluster with `initdb`. For example, with the flags `--key-wrap-command=-` and `--key-unwrap-command=-`.
- You can set the wrap and unwrap commands to the special value `-` when initializing the cluster with `initdb`. For example, you can use the flags `--key-wrap-command=-` and `--key-unwrap-command=-`.

- Or you can disable key wrapping when initializing the cluster with `initdb` by adding the flag `--no-key-wrap`.
- You can disable key wrapping when initializing the cluster with `initdb` by adding the flag `--no-key-wrap`.

With either one of the configurations, TDE generates encryption key files, but leaves them unprotected.
With either of the configurations, TDE generates encryption key files but leaves them unprotected.

For `intidb --data-encryption` to run successfully, you have to either specify a wrapping/unwrapping command, set a fallback environment variable with wrapping/unwrapping commands, or disable key wrapping with the one of the previous mechanisms. Otherwise, the creation of an encrypted database cluster will fail.
For `intidb --data-encryption` to run successfully, you have to either specify a wrapping/unwrapping command, set a fallback environment variable with wrapping/unwrapping commands, or disable key wrapping with the one of the previous mechanisms. Otherwise, the creating an encrypted database cluster will fail.

!!!note
If you want to enable key wrapping on TDE-enabled database clusters where key wrapping was previously disabled, see [Enabling a mechanism to protect the data encryption key](../enabling/enabling_key_wrapper).
Expand Down

0 comments on commit 0df472a

Please sign in to comment.