Skip to content

Commit

Permalink
Merge pull request #6361 from EnterpriseDB/docs/edits_to_tde_6342
Browse files Browse the repository at this point in the history
Edits to TDE: improvements and fixes for DOCS-1147 #6342
  • Loading branch information
gvasquezvargas authored Dec 20, 2024
2 parents 11c96f4 + bea2198 commit 4b13db9
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions product_docs/docs/tde/15/secure_key/disabling_key.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@ description: Learn how to omit using a wrapping key.
deepToc: true
---

If you don't want key wrapping, for example, for testing purposes, you can use either one of the following options to disable key wrapping:
If you don't want key wrapping, for example, for testing purposes, you can use either of the following options to disable key wrapping:

- You can set the wrap and unwrap commands to the special value `-` when initializing the cluster with `initdb`. For example, with the flags `--key-wrap-command=-` and `--key-unwrap-command=-`.
- You can set the wrap and unwrap commands to the special value `-` when initializing the cluster with `initdb`. For example, you can use the flags `--key-wrap-command=-` and `--key-unwrap-command=-`.

- Or you can disable key wrapping when initializing the cluster with `initdb` by adding the flag `--no-key-wrap`.
- You can disable key wrapping when initializing the cluster with `initdb` by adding the flag `--no-key-wrap`.

With either one of the configurations, TDE generates encryption key files, but leaves them unprotected.
With either of the configurations, TDE generates encryption key files but leaves them unprotected.

For `intidb --data-encryption` to run successfully, you have to either specify a wrapping/unwrapping command, set a fallback environment variable with wrapping/unwrapping commands, or disable key wrapping with the one of the previous mechanisms. Otherwise, the creation of an encrypted database cluster will fail.
For `intidb --data-encryption` to run successfully, you have to either specify a wrapping/unwrapping command, set a fallback environment variable with wrapping/unwrapping commands, or disable key wrapping with one of the previous mechanisms. Otherwise, creating an encrypted database cluster will fail.

!!!note
If you want to enable key wrapping on TDE-enabled database clusters where key wrapping was previously disabled, see [Enabling a mechanism to protect the data encryption key](../enabling/enabling_key_wrapper).
Expand Down

0 comments on commit 4b13db9

Please sign in to comment.