Sql Always Encrypted Cmk Certificate Storage Best Practice

I am in the process of rolling out SQL Always Encrypted to our Databases and have a query about the Best practice approach to storing the certificate for the CMK. We have .Net web

Solution 1:

I'd recommend using the Azure Key Vault as your Keystore Provider(Centralized Key Stores), which will be the most secure way to store your Key's.

Selecting a Key Store for Column Master Key

As per this ,

Centralized Key Stores - serve applications on multiple computers. An example of a centralized key store is Azure Key Vault. A centralized key store usually makes key management easier because you don't need to maintain multiple copies of your column master keys on multiple machines. You need to ensure that your applications are configured to connect to the centralized key store

So go far Cnetralized Key Stores

You can easily manage the users/Application through the access policies in the Azure Key Vault.

Reference