Lost DMK encryption password for master database Back story:
My company has TDE encryption enabled for some of our databases. The password that the master key was encrypted by for one of our servers is lost. We do have the backup .key file, however, the password it was encrypted with is lost too.

We also have the certificate backed up, but those passwords are lost as well.

The original backup files (master key, cert) are still in existence and those encryption passwords are available for previous servers these DBs lived on.

Question:


We want to have the actual passwords on file for the certs/keys used in our environment. What is the best solution? - This is a production environment
My company has TDE encryption enabled for some of our databases. The
  password that the master key was encrypted by for one of our servers
  is lost. We do have the backup .key file, however, the password it was
  encrypted with is lost too.
  
  We also have the certificate backed up, but those passwords are lost
  as well.


So you know the backup cert/DMK files are now useless. I would IMMEDIATELY take new backups and save the passwords. This way you can restore older backup files should anything happen. I would also backup the SMK as that's the only means you have to decrypting the DMK/Cert at this moment.


  The original backup files (master key, cert) are still in existence
  and those encryption passwords are available for previous servers
  these DBs lived on.


I'm assuming the keys haven't been rotated per your comment. If this is the case you are most likely able to restore these to a test server and restore your TDE enabled databases to said test server without issue. If this is the case, you could re-use these keys assuming nothing else is relying on the DMK/Cert in your current instance.

Since TDE works through the SMK (and not by passwords) you're currently "at risk". Sure, it's running but who knows when or if something will happen. I stated before, take new backups.

The most straight forward approach would be to remove TDE from the databases on that instance, remove the cert, and remove the DMK (After backing them up first). Then proceed to create the DMK/Cert/TDE enabled. It's going to be disk and cpu intensive for a bit (depending on the size of database and hardware/disk/etc). Backup the new DMK/Cert with a guarded password.