Creating a database with TDE

Create a new EDB Postgres Advanced Server cluster with TDE enabled.

• Set the environment variables to export the wrap and unwrap commands for encryption.
• Initialize a server with encryption enabled.
• Start the database server.
• Verify TDE is enabled.

Worked example

This example uses EDB Postgres Advanced Server 16 running on a Linux platform. It uses OpenSSL to define the passphrase to wrap and unwrap the generated data encryption key.

A similar workflow applies to other versions of EDB Postgres Advanced Server. The location of the bin and data directories differs depending on your operating system and the Postgres version.

1. Set the data encryption key (wrap) and decryption (unwrap) environment variables:

   → WrapCopy

   export PGDATAKEYWRAPCMD='openssl enc -e -aes-128-cbc -pbkdf2 -pass pass:<password> -out "%p"'
   export PGDATAKEYUNWRAPCMD='openssl enc -d -aes-128-cbc -pbkdf2 -pass pass:<password> -in "%p"'

   Note

   • If you're on Windows, you don't need the single quotes around the variable value.

2. Initialize the cluster using initdb with encryption enabled. This command sets the data_encryption_key_unwrap_command parameter in the postgresql.conf file.

   → WrapCopy

   /usr/edb/as16/bin/initdb --data-encryption -D /var/lib/edb/as16/data 

3. Start the cluster:

   → WrapCopy

   /usr/edb/as16/bin/pg_ctl -D /var/lib/edb/as16/data start

4. Run grep on postgresql.conf to verify the setting of data_encryption_key_unwrap_command:

   → WrapCopy

   grep data_encryption_key_unwrap_command /var/lib/edb/as16/data/postgresql.conf

   Output

   data_encryption_key_unwrap_command = 'openssl enc -d -aes-128-cbc -pass pass:<password> -in "%p"'

5. Verify that data encryption is enabled.