SQL Server Backup Encryption on AAG We are using SQL Server 2016 Enterprise Ed with AlwaysOn Availability Group.  If we want to encrypt our database backups, how do we go about creating the encyrption keys?  For example, do I create the same Certificate used on both primary and secondary?  I am thinking it would be the same cert since the backups could be happening on any of the two replicas.  Anyone have any guidance on this?

I am new to encryption so this is all new to me.  Thanks for any help!
Yes, use the same cert on each instance. Your restore process would be clumsy if you had different certs on different instances.

I would suggest you read the documentation (including the relevant links) as encryption and key hierarchy in SQL Server is a topic too large for a single answer on a Q&amp;A site, but essentially you need to:


Create a database master key
Create a certificate
Backup your certificate and keys
Import the certificate to each node of the AG and any other instance you plan on restoring to
Use the ENCRYPTION option in your backup statements