{"id":4495,"date":"2026-06-05T09:00:00","date_gmt":"2026-06-05T06:00:00","guid":{"rendered":"https:\/\/www.ozgurguler.net\/blog\/?p=4495"},"modified":"2026-06-09T17:18:49","modified_gmt":"2026-06-09T14:18:49","slug":"sql-server-tde-hatasi-cannot-find-server-asymmetric-key-thumbprint-cozum-ve-kurtarma-rehberi","status":"publish","type":"post","link":"https:\/\/www.ozgurguler.net\/blog\/sql-server-tde-hatasi-cannot-find-server-asymmetric-key-thumbprint-cozum-ve-kurtarma-rehberi\/","title":{"rendered":"SQL Server TDE Hatas\u0131: Cannot find server asymmetric key thumbprint &#8211; \u00c7\u00f6z\u00fcm ve Kurtarma Rehberi"},"content":{"rendered":"<p><strong>SQL Server TDE Hatas\u0131: &#8220;Cannot find server asymmetric key&#8221; &#8211; \u00c7\u00f6z\u00fcm, G\u00fcvenlik A\u00e7\u0131\u011f\u0131 ve Otomatik \u0130zleme<\/strong><\/p>\n<p><strong>SQL Server&#8217;da TDE restore hatas\u0131 &#8216;Cannot find server asymmetric key&#8217; ile kar\u015f\u0131la\u015ft\u0131n\u0131z m\u0131? Certificate backup alma, restore etme ve format sonras\u0131 kurtarma y\u00f6ntemleri. Ayr\u0131ca TDE&#8217;nin bilinmeyen g\u00fcvenlik a\u00e7\u0131\u011f\u0131: Sysadmin verilerinizi nas\u0131l \u00e7alabilir?<\/strong><\/p>\n<p>Veritaban\u0131nda TDE (Transparent Data Encryption) Kullan\u0131lm\u0131\u015fsa G\u00f6r\u00fclen Hata<\/p>\n<p>**Hata Mesaj\u0131:**<\/p>\n<p>Cannot find server asymmetric key with thumbprint &#8216;0x7b8626f7e9b646cb8702530018600bf3&#8217;<\/p>\n<p><strong>### Bu hata ne anlama geliyor?<\/strong><\/p>\n<p>Restore etmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131z veritaban\u0131, eski SQL Server instance&#8217;\u0131nda bulunan bir **Certificate** veya **Asymmetric Key**&#8217;e ba\u011fl\u0131. Yeni sunucuda bu g\u00fcvenlik nesnesi bulunmad\u0131\u011f\u0131 i\u00e7in SQL Server veritaban\u0131n\u0131 a\u00e7am\u0131yor.<\/p>\n<p>&#8212;<\/p>\n<p><strong>## \u00d6ncelikle TDE Kullan\u0131l\u0131p Kullan\u0131lmad\u0131\u011f\u0131n\u0131 Kontrol Edin<\/strong><\/p>\n<p><strong>**Eski sunucuda thumbprint ile sorgulama:**<\/strong><\/p>\n<p>SELECT name, thumbprint<br \/>\nFROM sys.certificates<br \/>\nWHERE thumbprint = 0x7b8626f7e9b646cb8702530018600bf3;<\/p>\n<p><strong>Eski sunucuda genel kontrol:<\/strong><br \/>\nSELECT<br \/>\ndb.name AS DatabaseName,<br \/>\ndek.encryption_state,<br \/>\ndek.percent_complete,<br \/>\ndek.key_algorithm,<br \/>\ndek.key_length<br \/>\nFROM sys.databases db<br \/>\nLEFT JOIN sys.dm_database_encryption_keys dek<br \/>\nON db.database_id = dek.database_id;<\/p>\n<p><strong>\u2705 E\u011fer veritaban\u0131n\u0131z listeleniyorsa \u2192 TDE aktif demektir.<\/strong><\/p>\n<p><strong>TDE Restore \u0130\u015flemi \u0130\u00e7in Gerekli Ad\u0131mlar<\/strong><br \/>\n<strong>Eski sunucudan a\u015fa\u011f\u0131daki nesneleri alman\u0131z gerekir:<\/strong><\/p>\n<p>Database Master Key (DMK) &#8211; master sistem veritaban\u0131nda olu\u015fturulur ve certificate&#8217;\u0131 korur<\/p>\n<p>Certificate<\/p>\n<p>Certificate Private Key<\/p>\n<p>master veritaban\u0131nda zaten bir DMK olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek \u00f6nemlidir:<\/p>\n<p>SELECT * FROM sys.symmetric_keys WHERE name = &#8216;##MS_DatabaseMasterKey##&#8217;;<\/p>\n<p><strong>1. Ad\u0131m: Eski sunucuda Certificate&#8217;\u0131 Backup Al\u0131n<\/strong><br \/>\nBACKUP CERTIFICATE MyTDECert<br \/>\nTO FILE = &#8216;D:\\Backup\\MyTDECert.cer&#8217;<br \/>\nWITH PRIVATE KEY<br \/>\n(<br \/>\nFILE = &#8216;D:\\Backup\\MyTDECert.pvk&#8217;,<br \/>\nENCRYPTION BY PASSWORD = &#8216;StrongPassword123!&#8217;<br \/>\n);<\/p>\n<p>Not: INIT se\u00e7ene\u011fi ile mevcut dosyan\u0131n \u00fczerine yazabilirsiniz (iyi al\u0131\u015fkanl\u0131k).<\/p>\n<p><strong>2. Ad\u0131m: Yeni sunucuda Certificate&#8217;\u0131 Restore Edin<\/strong><\/p>\n<p>&#8212; Master veritaban\u0131nda \u00e7al\u0131\u015ft\u0131r\u0131n<br \/>\nUSE master;<br \/>\nGO<\/p>\n<p>&#8212; Database Master Key olu\u015fturun (daha \u00f6nce yoksa)<br \/>\nCREATE MASTER KEY ENCRYPTION BY PASSWORD = &#8216;MasterKeyPassword123!&#8217;;<br \/>\nGO<\/p>\n<p>&#8212; Certificate&#8217;\u0131 geri y\u00fckleyin<br \/>\nCREATE CERTIFICATE MyTDECert<br \/>\nFROM FILE = &#8216;D:\\Backup\\MyTDECert.cer&#8217;<br \/>\nWITH PRIVATE KEY<br \/>\n(<br \/>\nFILE = &#8216;D:\\Backup\\MyTDECert.pvk&#8217;,<br \/>\nDECRYPTION BY PASSWORD = &#8216;StrongPassword123!&#8217;<br \/>\n);<br \/>\nGO<\/p>\n<p>Not: Certificate ismi (MyTDECert) eski sunucudakiyle ayn\u0131 olabilir ama zorunlu de\u011fildir. \u00d6nemli olan thumbprint&#8217;in e\u015fle\u015fmesidir.<\/p>\n<p><strong>3. Ad\u0131m: Art\u0131k veritaban\u0131n\u0131 restore edebilirsiniz<\/strong><\/p>\n<p>RESTORE DATABASE MyDatabase<br \/>\nFROM DISK = &#8216;D:\\Backup\\MyDatabase.bak&#8217;<br \/>\nWITH MOVE &#8216;MyDatabase_Data&#8217; TO &#8216;E:\\Data\\MyDatabase.mdf&#8217;,<br \/>\nMOVE &#8216;MyDatabase_Log&#8217; TO &#8216;F:\\Log\\MyDatabase.ldf&#8217;,<br \/>\nREPLACE;<\/p>\n<p><strong>Restore Sonras\u0131 Kontrol<\/strong><br \/>\nUSE YourDatabaseName;<br \/>\nGO<br \/>\nSELECT<br \/>\ndb.name AS DatabaseName,<br \/>\ndek.encryption_state,<br \/>\ndek.percent_complete,<br \/>\ndek.key_algorithm,<br \/>\ndek.key_length,<br \/>\nCASE dek.encryption_state<br \/>\nWHEN 0 THEN &#8216;No encryption&#8217;<br \/>\nWHEN 1 THEN &#8216;Unencrypted&#8217;<br \/>\nWHEN 2 THEN &#8216;Encryption in progress&#8217;<br \/>\nWHEN 3 THEN &#8216;Encrypted&#8217;<br \/>\nWHEN 4 THEN &#8216;Key change in progress&#8217;<br \/>\nWHEN 5 THEN &#8216;Decryption in progress&#8217;<br \/>\nWHEN 6 THEN &#8216;Protection change in progress&#8217;<br \/>\nEND AS EncryptionStateDescription<br \/>\nFROM sys.dm_database_encryption_keys dek<br \/>\nINNER JOIN sys.databases db ON dek.database_id = db.database_id<br \/>\nWHERE db.name = &#8216;YourDatabaseName&#8217;;<\/p>\n<p><strong>Beklenen Sonu\u00e7:<\/strong><\/p>\n<p>encryption_state = 3 (Encrypted)<\/p>\n<p>key_algorithm ve key_length eski sunucudakiyle ayn\u0131 olmal\u0131<\/p>\n<p><strong>\u2757 Format Sonras\u0131 Yaln\u0131zca .bak Dosyas\u0131 Kald\u0131ysa<\/strong><br \/>\nE\u011fer format att\u0131ktan sonra yaln\u0131zca .bak dosyan\u0131z kald\u0131ysa ve TDE Certificate ile Private Key yede\u011fi yoksa, bu veritaban\u0131n\u0131 yeni bir sunucuda a\u00e7man\u0131z teknik olarak imkans\u0131zd\u0131r.<\/p>\n<p><strong>\u26a0\ufe0f Neden Kurtaram\u0131yorsunuz?<\/strong><br \/>\nTDE&#8217;nin \u00e7al\u0131\u015fma mant\u0131\u011f\u0131, veriyi \u015fifrelemek i\u00e7in kullan\u0131lan &#8220;anahtar&#8221; ile veritaban\u0131 dosyas\u0131n\u0131 (.bak veya .mdf) birbirinden ay\u0131rmakt\u0131r.<\/p>\n<p>Database Encryption Key (DEK): Veritaban\u0131 i\u00e7inde saklan\u0131r, ancak Certificate ile \u015fifrelenmi\u015ftir<\/p>\n<p>Certificate &amp; Private Key: Veritaban\u0131n\u0131 a\u00e7an as\u0131l anahtard\u0131r. Bu sertifika master veritaban\u0131nda saklan\u0131r ve format att\u0131\u011f\u0131n\u0131z i\u00e7in silinmi\u015ftir<\/p>\n<p>Elinizde sadece .bak dosyas\u0131 varsa, bu \u015fifreli bir kutudur; ancak kutuyu a\u00e7acak fiziksel anahtar\u0131n\u0131z (Certificate) yoktur.<\/p>\n<p>Not: Diskten .mdf\/.ldf dosyalar\u0131 kurtar\u0131lsa bile, ayn\u0131 certificate olmadan bu dosyalar da attach edilemez. TDE \u015fifrelemesi, dosya d\u00fczeyinde de ge\u00e7erlidir.<\/p>\n<p><strong>\ud83d\udee0\ufe0f Kurtulmak \u0130\u00e7in Tek \u00c7\u00f6z\u00fcm (E\u011fer M\u00fcmk\u00fcnse)<\/strong><br \/>\nBu noktada tek umudunuz, format atmadan \u00f6nce ald\u0131\u011f\u0131n\u0131z<br \/>\nCertificate ve Private Key yedeklerini (MyTDECert.cer ve MyTDECert.pvk dosyalar\u0131) bulmakt\u0131r.<\/p>\n<p>| Durum\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| Sonu\u00e7<br \/>\n|&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;|&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;-<br \/>\n| Dosyalar var ise\u00a0 \u00a0| Yeni sunucuda Certificate geri y\u00fcklenir, restore ba\u015far\u0131l\u0131 olur<br \/>\n| Dosyalar yok ise\u00a0 | Veri kayb\u0131 kesindir. Kurtarma imkans\u0131zd\u0131r.<\/p>\n<p><strong>\ud83d\udea8 Bilmeniz Gereken Kritik G\u00fcvenlik Riski: Sysadmin Verilerinizi \u00c7alabilir<\/strong><br \/>\nBu makaleyi yazma sebeplerimden biri de, TDE hakk\u0131nda yayg\u0131n bir yan\u0131lg\u0131y\u0131 d\u00fczeltmek.<\/p>\n<p>Bir\u00e7ok ki\u015fi (ben de dahil) TDE&#8217;nin verileri yetkisiz eri\u015fime kar\u015f\u0131 tamamen korudu\u011funu d\u00fc\u015f\u00fcn\u00fcyor. Ancak durum tam olarak \u00f6yle de\u011fil.<\/p>\n<p>E\u011fer bir sald\u0131rgan SQL Server&#8217;da sysadmin yetkisi elde ederse veya sunucuya fiziksel eri\u015fimi olursa, TDE&#8217;yi a\u015fmak \u00e7ok kolayd\u0131r.<\/p>\n<p><strong>Nas\u0131l m\u0131? Sadece \u015fu ad\u0131mlar\u0131 izler:<\/strong><\/p>\n<p>Ad\u0131m Yapt\u0131\u011f\u0131 \u0130\u015flem<br \/>\n1 Sertifikay\u0131 Yedekler: BACKUP CERTIFICATE &#8230;<br \/>\nkomutuyla TDE sertifikas\u0131n\u0131 ve \u00f6zel anahtar\u0131n\u0131 kendi belirledi\u011fi \u015fifreyle dosyaya yedekler<br \/>\n2 Veritaban\u0131n\u0131 Yedekler: \u015eifreli veritaban\u0131n\u0131n bir yede\u011fini al\u0131r<br \/>\n3 Kendi Sunucusunda A\u00e7ar: Kendi SQL Server&#8217;\u0131nda sertifikay\u0131 geri y\u00fckleyerek<br \/>\n(CREATE CERTIFICATE &#8230;) veritaban\u0131n\u0131 a\u00e7ar ve t\u00fcm verileri d\u00fcz metin olarak okur<\/p>\n<p><strong>Peki Bu Ne Anlama Geliyor?<\/strong><\/p>\n<p>TDE, &#8220;veritaban\u0131 dosyalar\u0131n\u0131 elinde bulunduran ancak sunucuya eri\u015fimi olmayan&#8221; ki\u015filere kar\u015f\u0131 etkilidir (\u00f6rne\u011fin, bir SAN y\u00f6neticisi veya fiziksel diski \u00e7alan h\u0131rs\u0131z)<\/p>\n<p>sysadmin gibi y\u00fcksek yetkili bir kullan\u0131c\u0131ya veya yetkilerini ele ge\u00e7iren bir sald\u0131rgana kar\u015f\u0131 TDE tek ba\u015f\u0131na bir koruma sa\u011flamaz<\/p>\n<p>Bu nedenle, TDE&#8217;yi bir &#8220;derinlemesine savunma&#8221; stratejisinin sadece bir katman\u0131 olarak g\u00f6rmeli,<br \/>\nAlways Encrypted gibi veriyi kullan\u0131m s\u0131ras\u0131nda da koruyan y\u00f6ntemlerle veya s\u0131k\u0131 eri\u015fim denetimleriyle desteklemelisiniz.<\/p>\n<p><strong>\ud83d\udce2 Proaktif \u00c7\u00f6z\u00fcm: TDE Aktif Oldu\u011funda Sizi Uyaracak SQL Job<\/strong><br \/>\nYukar\u0131da anlatt\u0131\u011f\u0131m\u0131z senaryoya bir daha d\u00fc\u015fmemek i\u00e7in,<br \/>\nTDE&#8217;nin hangi veritabanlar\u0131nda aktif oldu\u011funu otomatik olarak izleyen bir SQL Agent Job&#8217;u kurabilirsiniz.<\/p>\n<p>Bu job:<\/p>\n<p>Her sabah \u00e7al\u0131\u015f\u0131r<\/p>\n<p>TDE a\u00e7\u0131k olan veritabanlar\u0131n\u0131 kontrol eder<\/p>\n<p>E\u011fer TDE aktif veritaban\u0131 varsa size e-posta g\u00f6nderir<\/p>\n<p>\ud83d\udee0\ufe0f Haz\u0131r SQL Job Script&#8217;i<\/p>\n<p>&#8212; 1. \u00d6nce bir operat\u00f6r olu\u015fturun (e-posta adresinizle)<br \/>\nUSE msdb;<br \/>\nGO<\/p>\n<p>EXEC msdb.dbo.sp_add_operator<br \/>\n@name = N&#8217;TDE Uyari&#8217;,<br \/>\n@enabled = 1,<br \/>\n@email_address = N&#8217;dba@sirketiniz.com&#8217;; &#8212; Kendi e-posta adresinizle de\u011fi\u015ftirin<br \/>\nGO<\/p>\n<p>&#8212; 2. Job&#8217;u olu\u015fturun<br \/>\nEXEC dbo.sp_add_job<br \/>\n@job_name = N&#8217;TDE &#8211; Aktif Veritabanlarini Kontrol Et&#8217;,<br \/>\n@enabled = 1,<br \/>\n@description = N&#8217;TDE \u015fifrelemesi aktif olan veritabanlar\u0131n\u0131 listeler ve uyar\u0131 g\u00f6nderir&#8217;,<br \/>\n@owner_login_name = N&#8217;sa&#8217;;<br \/>\nGO<\/p>\n<p>&#8212; 3. Job&#8217;a ad\u0131m ekleyin<br \/>\nEXEC dbo.sp_add_jobstep<br \/>\n@job_name = N&#8217;TDE &#8211; Aktif Veritabanlarini Kontrol Et&#8217;,<br \/>\n@step_name = N&#8217;TDE Kontrol Sorgusu&#8217;,<br \/>\n@subsystem = N&#8217;TSQL&#8217;,<br \/>\n@command = N&#8217;<br \/>\n&#8212; TDE aktif veritabanlar\u0131n\u0131 bul<br \/>\nDECLARE @Subject NVARCHAR(255);<br \/>\nDECLARE @Body NVARCHAR(MAX);<\/p>\n<p>SET @Subject = &#8221;TDE RAPORU &#8211; &#8221; + @@SERVERNAME + &#8221; &#8211; &#8221; + CONVERT(NVARCHAR(10), GETDATE(), 104);<\/p>\n<p>SET @Body = &#8221;A\u015fa\u011f\u0131daki veritabanlar\u0131nda TDE aktiftir:&#8221;<br \/>\n+ CHAR(13) + CHAR(10) + CHAR(13) + CHAR(10)<br \/>\n+ &#8221;&lt;table border=&#8221;1&#8243; cellpadding=&#8221;5&#8243;&gt;&#8221;<br \/>\n+ &#8221;&lt;tr&gt;&lt;th&gt;Veritaban\u0131 Ad\u0131&lt;\/th&gt;&lt;th&gt;\u015eifreleme Durumu&lt;\/th&gt;&lt;th&gt;Anahtar Algoritmas\u0131&lt;\/th&gt;&lt;th&gt;Anahtar Uzunlu\u011fu&lt;\/th&gt;&lt;\/td&gt;&#8221;;<\/p>\n<p>SELECT @Body = @Body +<br \/>\n&#8221;&lt;tr&gt;&#8221;<br \/>\n+ &#8221;&lt;td&gt;&#8221; + db.name + &#8221;&lt;\/td&gt;&#8221;<br \/>\n+ &#8221;&lt;td&gt;&#8221; +<br \/>\nCASE dek.encryption_state<br \/>\nWHEN 0 THEN &#8221;\u015eifreleme yok&#8221;<br \/>\nWHEN 1 THEN &#8221;\u015eifrelenmemi\u015f&#8221;<br \/>\nWHEN 2 THEN &#8221;\u015eifreleme devam ediyor&#8221;<br \/>\nWHEN 3 THEN &#8221;\u015eifrelenmi\u015f&#8221;<br \/>\nWHEN 4 THEN &#8221;Anahtar de\u011fi\u015fimi devam ediyor&#8221;<br \/>\nWHEN 5 THEN &#8221;\u015eifre \u00e7\u00f6zme devam ediyor&#8221;<br \/>\nWHEN 6 THEN &#8221;Koruma de\u011fi\u015fimi devam ediyor&#8221;<br \/>\nEND<br \/>\n+ &#8221;&lt;\/td&gt;&#8221;<br \/>\n+ &#8221;&lt;td&gt;&#8221; + ISNULL(dek.key_algorithm, &#8221;-&#8221;) + &#8221;&lt;\/td&gt;&#8221;<br \/>\n+ &#8221;&lt;td&gt;&#8221; + ISNULL(CAST(dek.key_length AS NVARCHAR), &#8221;-&#8221;) + &#8221;&lt;\/td&gt;&#8221;<br \/>\n+ &#8221;&lt;\/tr&gt;&#8221;<br \/>\nFROM sys.databases db<br \/>\nLEFT JOIN sys.dm_database_encryption_keys dek<br \/>\nON db.database_id = dek.database_id<br \/>\nWHERE dek.encryption_state = 3;<\/p>\n<p>SET @Body = @Body + &#8221;&lt;\/table&gt;&#8221;;<\/p>\n<p>IF EXISTS (SELECT 1 FROM sys.databases db<br \/>\nLEFT JOIN sys.dm_database_encryption_keys dek<br \/>\nON db.database_id = dek.database_id<br \/>\nWHERE dek.encryption_state = 3)<br \/>\nBEGIN<br \/>\nEXEC msdb.dbo.sp_send_dbmail<br \/>\n@profile_name = &#8221;MailProfiliniz&#8221;,<br \/>\n@recipients = &#8221;dba@sirketiniz.com&#8221;,<br \/>\n@subject = @Subject,<br \/>\n@body = @Body,<br \/>\n@body_format = &#8221;HTML&#8221;;<br \/>\nEND<br \/>\n&#8216;,<br \/>\n@database_name = N&#8217;master&#8217;;<br \/>\nGO<\/p>\n<p>&#8212; 4. Job&#8217;a zamanlama ekleyin (Her g\u00fcn sabah 08:00&#8217;de)<br \/>\nEXEC dbo.sp_add_schedule<br \/>\n@schedule_name = N&#8217;Gunluk Sabah 08:00&#8242;,<br \/>\n@freq_type = 4,<br \/>\n@freq_interval = 1,<br \/>\n@active_start_time = 80000;<br \/>\nGO<\/p>\n<p>&#8212; 5. Job&#8217;u schedule ile ili\u015fkilendirin<br \/>\nEXEC dbo.sp_attach_schedule<br \/>\n@job_name = N&#8217;TDE &#8211; Aktif Veritabanlarini Kontrol Et&#8217;,<br \/>\n@schedule_name = N&#8217;Gunluk Sabah 08:00&#8242;;<br \/>\nGO<\/p>\n<p>\ud83d\udce7 Database Mail Nas\u0131l Kurulur?<br \/>\n&#8212; Database Mail&#8217;i etkinle\u015ftir<br \/>\nEXEC sp_configure &#8216;Database Mail XPs&#8217;, 1;<br \/>\nRECONFIGURE;<br \/>\nGO<\/p>\n<p>&#8212; Mail profili olu\u015ftur<br \/>\nEXEC sysmail_add_profile_sp @profile_name = &#8216;MailProfiliniz&#8217;;<\/p>\n<p>&#8212; Hesap ekle<br \/>\nEXEC sysmail_add_account_sp<br \/>\n@account_name = &#8216;SQLMailAccount&#8217;,<br \/>\n@email_address = &#8216;sqlalert@sirketiniz.com&#8217;,<br \/>\n@display_name = &#8216;SQL Server Alert&#8217;,<br \/>\n@mailserver_name = &#8216;smtp.sirketiniz.com&#8217;, &#8212; Kendi SMTP sunucunuz<br \/>\n@port = 25;<\/p>\n<p>&#8212; Profil ile hesab\u0131 ili\u015fkilendir<br \/>\nEXEC sysmail_add_profileaccount_sp<br \/>\n@profile_name = &#8216;MailProfiliniz&#8217;,<br \/>\n@account_name = &#8216;SQLMailAccount&#8217;,<br \/>\n@sequence_number = 1;<\/p>\n<p>&#8212; Profili SQL Server&#8217;a tan\u0131t<br \/>\nEXEC sysmail_add_principalprofile_sp<br \/>\n@profile_name = &#8216;MailProfiliniz&#8217;,<br \/>\n@principal_name = &#8216;public&#8217;,<br \/>\n@is_default = 1;<br \/>\nGO<\/p>\n<p><strong>\ud83d\udd14 Alternatif: Sadece Log&#8217;a Yazan Basit Versiyon<\/strong><br \/>\n<strong>E-posta ayarlar\u0131yla u\u011fra\u015fmak istemiyorsan\u0131z, sadece SQL Server log&#8217;una uyar\u0131 yazan job step&#8217;i:<\/strong><\/p>\n<p>IF EXISTS (SELECT 1 FROM sys.dm_database_encryption_keys WHERE encryption_state = 3)<br \/>\nBEGIN<br \/>\nDECLARE @Message NVARCHAR(500);<br \/>\nSET @Message = &#8216;UYARI: TDE aktif veritabanlar\u0131 var! Sorgu: SELECT * FROM sys.dm_database_encryption_keys WHERE encryption_state = 3&#8217;;<br \/>\nEXEC xp_logevent 50001, @Message, &#8216;ERROR&#8217;;<br \/>\nEND<\/p>\n<p><strong>\ud83d\udca1 \u0130lerisi \u0130\u00e7in Hayati Tavsiyeler<\/strong><br \/>\n<strong>Bu ac\u0131 tecr\u00fcbeyi bir daha ya\u015famamak i\u00e7in:<\/strong><\/p>\n<p>| Tavsiye\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| A\u00e7\u0131klama<br \/>\n|&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;|&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<br \/>\n| Certificate&#8217;lar\u0131 Yedekleyin | TDE a\u00e7t\u0131\u011f\u0131n\u0131z anda sertifikay\u0131 ve \u00f6zel anahtar\u0131 g\u00fcvenli bir dosyaya yedekleyin (`BACKUP CERTIFICATE`)<br \/>\n| Master DB&#8217;yi Yedekleyin\u00a0 \u00a0| Sistem veritabanlar\u0131n\u0131 (\u00f6zellikle `master`) d\u00fczenli yedekleyin. `master` yede\u011fi sertifikay\u0131 da i\u00e7erir<br \/>\n| Parolalar\u0131 Saklay\u0131n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| Certificate yede\u011fi al\u0131rken kulland\u0131\u011f\u0131n\u0131z parolay\u0131 g\u00fcvenli bir \u015fifre kasas\u0131nda tutun<\/p>\n<p><strong>\ud83d\udccc \u00d6zet<\/strong><br \/>\n<strong>Anahtar olmadan \u015fifre a\u00e7\u0131lmaz. E\u011fer sertifika dosyalar\u0131n\u0131z yoksa, TDE&#8217;li veritaban\u0131 yede\u011finizin bir anlam\u0131 kalmam\u0131\u015ft\u0131r.<\/strong><\/p>\n<p><strong>Bu rehberde \u00f6\u011frendikleriniz:<\/strong><\/p>\n<p>\u2705 Hatan\u0131n ne anlama geldi\u011fini<\/p>\n<p>\u2705 Certificate backup\/restore ad\u0131mlar\u0131n\u0131<\/p>\n<p>\u2705 Format sonras\u0131 kurtarman\u0131n imkans\u0131z oldu\u011funu<\/p>\n<p>\u2705 Sysadmin&#8217;in TDE&#8217;yi nas\u0131l a\u015fabilece\u011fini (g\u00fcvenlik a\u00e7\u0131\u011f\u0131)<\/p>\n<p>\u2705 TDE&#8217;yi otomatik izleyen SQL Job kurmay\u0131<\/p>\n<p>Bu makale, bir DBA&#8217;n\u0131n ac\u0131 tecr\u00fcbesiyle ve son d\u00f6nemde hacker gruplar\u0131n\u0131n kulland\u0131\u011f\u0131 y\u00f6ntemler ara\u015ft\u0131r\u0131larak haz\u0131rlanm\u0131\u015ft\u0131r. Umar\u0131z siz bu hatalar\u0131 yapmazs\u0131n\u0131z.<\/p>\n<p><strong>Yazar: \u00d6zg\u00fcr G\u00dcLER \u2013 White Eagles<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>SQL Server TDE Hatas\u0131: &#8220;Cannot find server asymmetric key&#8221; &#8211; \u00c7\u00f6z\u00fcm, G\u00fcvenlik A\u00e7\u0131\u011f\u0131 ve Otomatik \u0130zleme SQL Server&#8217;da TDE restore hatas\u0131 &#8216;Cannot find server asymmetric key&#8217; ile kar\u015f\u0131la\u015ft\u0131n\u0131z m\u0131? Certificate backup alma, restore etme ve format sonras\u0131 kurtarma y\u00f6ntemleri. Ayr\u0131ca TDE&#8217;nin bilinmeyen g\u00fcvenlik a\u00e7\u0131\u011f\u0131: Sysadmin verilerinizi nas\u0131l \u00e7alabilir? Veritaban\u0131nda TDE (Transparent Data Encryption) Kullan\u0131lm\u0131\u015fsa G\u00f6r\u00fclen [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":1752,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[243,10],"tags":[245,247,88,244,248,246],"class_list":["post-4495","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-one-cikan","category-sql-server-tsql","tag-cannot-find-server-asymmetric-key","tag-certificate-restore","tag-sql","tag-sql-server-tde","tag-tde-hatasi-cozumu","tag-thumbprint"],"_links":{"self":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts\/4495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/comments?post=4495"}],"version-history":[{"count":6,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts\/4495\/revisions"}],"predecessor-version":[{"id":4502,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts\/4495\/revisions\/4502"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/media\/1752"}],"wp:attachment":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/media?parent=4495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/categories?post=4495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/tags?post=4495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}