Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.
View products that this article applies to.
After you perform a Transparent Data Encryption (TDE) certificate or key rotation, drop the original certification, and then conduct a log backup using COMPRESSION+MAXTRANSFERSIZE, you receive the following error:
Msg 33111, Level 16, State 3, Line LineNumber
Cannot find server certificate with thumbprint '%'.
Msg 3013, Level 16, State 1, Line LineNumber
BACKUP LOG is terminating abnormally.
When changing the certificate or keys, the current active Virtual Log File (VLF)—which is encrypted by the previous key—will be closed. The next available VLF (or newly created VLF) will be used and encrypted by the new certification.
At this stage, the transaction log file retains log records encrypted by the previous certificate as well as log records encrypted by new certificate.
When you conduct a log backup with COMPRESSION+MAXTRANSFERSIZE parameters, the log records that have been encrypted by the previous certificate will be decrypted and then encrypted by the new certificate, and then saved to the backup file.
Because of this, the previous certification is needed for decryption. The log backup will fail if the previous certificate does not exist.
Restore the previous certification and try the backup again.
Note
We recommend keeping certification backups in case the issue occurs in the future.
Microsoft is researching this problem and will post more information in this article when the information becomes available.
Learn about the terminology that Microsoft uses to describe software updates.
Keywords: kbSupportTopic, kbContentAuto, SQL Server 2019, SQL Server 2016, SQL Server 2014, SQL Server 2012