Configure replicas based on existing encrypted DB

Question

I am researching SQL Server Always On. I have put together a configuration that uses an existing DB which is encrypted. It is NOT a TDE DB. I cannot find any examples of how to configure this setup and I'm having an issue where my secondary replica cannot
be constructed properly because I cannot restore the DB Master Key on the replica. I get a cannot perform operation on a read only DB. I've tried to find information about how to configure a Always On setup with an encrypted DB but could not find anything.
MS has a page where they refer to encrypted DB in a Availability Group - but don't talk about it at all. They refer to working with a decrypted DB (which I don't have). 
http://technet.microsoft.com/en-us/library/hh510178.aspx
I was thinking that I could fail-over to the secondary but it fails. Not sure why but I'm thinking it may be because the two DB's are not exact. 
What do I need to do explicitly to get this to work?
Peter

Answer 1

Peter,
I'm not sure if that specific to azure, but the DMK is an object in the database. You don't have to restore it.
"Please create a master key in the database or open the master key in the session before performing this operation."
I see this, but you posted this:
No - not using the SMK. Just using a DMK and certificate
which are contradictory. If you were only using the DMK then you shouldn't have this problem. So either you're using the SMK to automatically decrypt the DMK and so on or azure doesn't support this.
I can easily do this (granted, not using azure) with and without the SMK (if I restore the SMK previously as I stated before).
Repro:
CREATE DATABASE EncryptedDB
GO
USE EncryptedDB
GO
CREATE TABLE EncryptedData
ID INT IDENTITY(1,1) NOT NULL,
EncryptedValue VARBINARY(8000) NOT NULL
GO
IF NOT EXISTS( SELECT 1 FROM sys.symmetric_keys WHERE name = '##MS_DatabaseMasterKey##')
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'My$trongP@$$'
GO
CREATE CERTIFICATE CertToEncryptSymKey
WITH SUBJECT = 'Certificate To Encrypt The Symmetric Key.'
GO
CREATE SYMMETRIC KEY SymEncKey
WITH ALGORITHM = AES_256
ENCRYPTION BY CERTIFICATE CertToEncryptSymKey
GO
OPEN SYMMETRIC KEY SymEncKey DECRYPTION BY CERTIFICATE CertToEncryptSymKey
INSERT INTO EncryptedData(EncryptedValue) VALUES (ENCRYPTBYKEY(KEY_GUID('SymEncKey'), N'Super Secret!', 0, ''))
CLOSE SYMMETRIC KEY SymEncKEy
-- restore database, etc on another instance, setup into AOAG
SELECT * FROM EncryptedData
SELECT * FROM sys.symmetric_keys
OPEN MASTER KEY DECRYPTION BY PASSWORD = 'My$trongP@$$'
OPEN SYMMETRIC KEY SymEncKey DECRYPTION BY CERTIFICATE CertToEncryptSymKey
SELECT *, CAST(DECRYPTBYKEY(EncryptedValue, 0, null) AS NVARCHAR(4000)) FROM EncryptedData
CLOSE SYMMETRIC KEY SymEncKey
CLOSE MASTER KEY
Sean Gallardy | Blog |
Twitter