# Using TDE with different master keys for different tables
**URL:** https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379
**Category:** Percona Server for MySQL 8.0
**Created:** [September 9, 2022, 7:25am UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379 "2022-09-09T07:25:24Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Igor\_Karymov](https://forums.percona.com/u/Igor_Karymov)
#### Post date: [September 9, 2022, 7:25am UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379/1 "2022-09-09T07:25:24Z")
Hi! Is it possible to manage multiple master keys on the same server and explicitly specify which one should be used to encrypt the tablespace level key for a particular table?
My use case: I have different sets of tables for my clients and I want to provide them with the ability to use the “bring your own key” feature for encrypting their data.
---
### Author:  [@matthewb](https://forums.percona.com/u/matthewb)
#### Post date: [September 9, 2022, 2:14pm UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379/2 "2022-09-09T14:14:41Z")
Hello @Igor_Karymov,
MySQL does not support multiple master keys nor does it support “bring your own key”.
---
### Author:  [@Igor\_Karymov](https://forums.percona.com/u/Igor_Karymov)
#### Post date: [September 12, 2022, 11:53am UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379/3 "2022-09-12T11:53:27Z")
Thank you for your reply. I see. But it looks like it mostly depends not from mysql itself but from key management implementation. For instance MariaDb has such capabilities [Encryption Key Management - MariaDB Knowledge Base](https://mariadb.com/kb/en/encryption-key-management/#using-multiple-encryption-keys)
So I am wondering how complicated it can be to implement similar functionality for Percona Server for MySQL?
---
### Author:  [@Michael\_Coburn](https://forums.percona.com/u/Michael_Coburn)
#### Post date: [September 12, 2022, 5:01pm UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379/4 "2022-09-12T17:01:14Z")
Hi @Igor_Karymov , thank you very much for posting to the Percona forums!
I wanted to share several caveats from an engagement I had last year with a Percona Customer exploring the MariaDB implementation of encryption, using version 10.5.12.
1. Changing Encryption Keys (adding, removing) requires a server restart
2. Using the File method does not provide for any automatic key rotation i.e. `innodb_encryption_rotate_key_age` is ignored
3. CA Common Name must be different than the Server & Client Common Names
4. `ssl_crlpath` MUST be blank until you are ready to revoke certificates - an empty directory will lead to ALL Client certificates failing. The first time you want to revoke a Client certificate you will need to restart MariaDB
---
### Author:  [@matthewb](https://forums.percona.com/u/matthewb)
#### Post date: [September 12, 2022, 5:06pm UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379/5 "2022-09-12T17:06:55Z")
You will also want to verify that any backup tool you use can handle the multiple keys otherwise you won’t be able to do encrypted backups and restore.
---
### Author:  [@JohnKoepi](https://forums.percona.com/u/JohnKoepi)
#### Post date: [December 1, 2023, 11:36am UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379/6 "2023-12-01T11:36:57Z")
> [@Michael\_Coburn](#):
>
> Changing Encryption Keys (adding, removing) requires a server restart
Does it however allow the Key Management plugin to generate() / get() or pick() a Key for a new TABLESPACE?
If it does, Does it allow to identify the corresponding requesting TABLESPACE from the request’s metadata?
It is not very clear from the documentation if MySQL Key Management plugins manage only the master key or tablespaces keys as well.
---
### Author:  [@JohnKoepi](https://forums.percona.com/u/JohnKoepi)
#### Post date: [December 1, 2023, 11:39am UTC](https://forums.percona.com/t/using-tde-with-different-master-keys-for-different-tables/17379/7 "2023-12-01T11:39:28Z")
> Changing Encryption Keys (adding, removing) requires a server restart
Why? The documentation says it is enough to do ALTER INSTANCE ROTATE MASTER KEY. For a TABLESPACE however it is required the full re-encryption for the key to be changed - switch to encryption=N, then to =Y, as it is follows from the doc.