# Datenbank EsbZertifikatManager

Schlankes Schema (6 Tabellen) + Always Encrypted.

## Einmalige Reihenfolge

1. **Zertifikat importieren** (auf jedem Client-PC):

```powershell
cd Database\AlwaysEncrypted
.\Install-Certificate.ps1
```

   - PFX: `ESB_ZertifikatManager_AE.pfx`
   - Passwort: siehe `pfx-password.txt` (`ESB-AE-Dev-Only!`)
   - Thumbprint: `95E906CCC9C5F227969877CF3BD46D2AD7168853`

2. In SSMS:

   1. `00_DropExisting.sql`
   2. `01_CreateDatabase.sql`
   3. `02_CreateSchema.sql` (CMK/CEK + Tabellen)
   4. `03_Seed.sql` (**komplett**: Companies, Environments, DE-Test, Container, Target)

3. App starten → Einstellungen → System **DE-Test** → Benutzerprofil anlegen → Übernehmen.

## Seed-Inhalt (`03_Seed.sql`)

| Objekt | Werte |
|---|---|
| Company | DE, PL, AT |
| Environment | TEST2, TEST, PROD |
| SonicConnection | DE-Test → `tcp://dekun-painwbdet:13070`, Domain `proalpha-test`, Env TEST |
| SonicContainer | ct-ZADBService (Company DE) |
| CertificateTarget | `C:\ESB\Certificates\server.crt` (Platzhalter) |
| SonicCredential | **nicht** geseedet (Setup-Wizard / AE) |

## Always Encrypted

| Objekt | Name |
|---|---|
| CMK | `CMK_ESB_ZertifikatManager` → `CurrentUser/My/95E906CCC9C5F227969877CF3BD46D2AD7168853` |
| CEK | `CEK_ESB_ZertifikatManager` |
| Spalten | `SonicCredential.CredentialUserName`, `CredentialSecret` |

Connection String braucht `Column Encryption Setting=Enabled`.