Release notes - Vault EKM provider for Microsoft SQL Server

Each version is available to download from the releases page.

For installation and upgrade procedures, refer to:

• Installation Guide
• Upgrade Guide
• Configuration Guide

SQL Server version compatibility

The Vault EKM provider has been validated across multiple Microsoft SQL Server versions to ensure consistent behavior and compatibility.

All features work consistently across SQL Server 2019, 2022, and 2025. No version-specific issues or compatibility bugs identified. Enhanced error codes (2050-2053) function identically across all versions. TDE, key rotation, and high availability features are validated on all versions.

0.3.2 (April 28th, 2026)

Summary

This release addresses two critical bugs affecting version reporting and error diagnostics.

Bug fixes

Version reporting correction

Issue: The provider incorrectly reported version 0.2.2 to SQL Server instead of 0.3.2.

Impact: Customers could not verify the correct provider version through SQL Server's sys.dm_cryptographic_provider_properties view, affecting compliance verification and audit requirements.

Resolution: Version string now correctly reflects 0.3.2 in all provider interfaces. Verify after upgrade using: SELECT * FROM sys.dm_cryptographic_provider_properties

Enhanced error code granularity

Issue: All session-open failures returned generic error code 2050, making troubleshooting difficult.

Impact: Extended troubleshooting time and delayed issue resolution due to inability to identify specific failure causes.

Resolution: The provider now returns distinct error codes:

• Error 2050: Missing EKM license feature in Vault Enterprise
• Error 2051: AppRole authentication failure (invalid role_id or secret_id)
• Error 2052: Vault connectivity failure (network, DNS, or TLS issues)
• Error 2053: License status lookup failure (API error or timeout)

0.3.1 (February 20th, 2026)

Summary

This release introduces performance optimizations and resilience improvements through license check caching and retry mechanisms.

Features

License check caching

Added 1-hour caching for Vault license checks to reduce repeated license status API calls.

Performance impact:

• Session open latency reduced by ~50ms for cached license checks
• Vault API load reduced by up to 95% for license status endpoints
• Cache is per SQL Server instance and cleared when provider DLL is reloaded

Exponential backoff retry mechanism

The Vault API client now implements exponential backoff retries for failed requests.

Implementation:

• Initial retry delay: 100ms, Maximum: 10 seconds, Max attempts: 5
• Retries triggered for: HTTP 429, 500-504, network timeouts, connection resets
• No retries for: HTTP 401, 403, 400, 404, or explicit Vault policy violations

Performance benchmarks:

• Session open: 250ms (v0.3.0) → 125ms (v0.3.1) — 50% improvement
• Vault API calls: 95% reduction for license checks, 40% overall reduction

0.3.0 (July 18th, 2025)

Summary

This release adds support for pinning transit key versions, enabling use of previous key versions after key rotation.

Features

Transit key version pinning

The provider supports pinning the transit key version to use previous key versions after rotation.

Use cases:

• Gradual migration to new key versions
• Testing new key versions before full rollout
• Compliance requirements for specific key versions
• Rollback scenarios after key rotation

Configuration: Add "key_version": <version_number> to ekmconfig.json:

{
  "vault_address": "https://vault.example.com:8200",
  "transit_mount_path": "transit",
  "transit_key_name": "ekm-encryption-key",
  "key_version": 2
}

Migration path:

1. Rotate key in Vault
2. Test new version in non-production
3. Optionally pin to old version during testing
4. Remove key_version parameter to use latest
5. Re-encrypt DEKs using ALTER DATABASE ENCRYPTION KEY REGENERATE

0.2.2 (August 10th, 2023)

Summary

This release fixes a TLS handshake negotiation issue preventing connections to Vault servers in certain network configurations.

Bug fixes

Issue: The provider failed to negotiate TLS handshake with Vault server in some configurations.

Impact: Connection failures in environments with strict TLS 1.2/1.3 requirements, specific cipher suite restrictions, corporate proxy/firewall TLS inspection, or hardened Vault TLS configurations.

Resolution: Updated TLS negotiation logic to support broader range of cipher suites and TLS protocol versions, including all TLS 1.2 and TLS 1.3 cipher suites recommended by NIST.

0.2.1 (June 30th, 2023)

Summary

This release addresses two critical bugs: incorrect key version usage during decryption after key rotation, and missing Event log emissions.

Bug fixes

Key version decryption fix

Issue: The provider did not correctly use the previous key version for decryption when the transit key was rotated but the DEK had not been re-encrypted.

Impact: Databases became inaccessible after key rotation until DEK re-encryption, causing critical production downtime.

Resolution: The provider now correctly identifies and uses the appropriate key version from ciphertext metadata for decryption operations.

Event log emission fix

Issue: The provider failed to emit event logs to Windows Event Viewer.

Impact: Reduced observability, no audit trail for provider operations, difficult to diagnose production issues.

Resolution: Fixed event manifest registration in MSI installer. Events now appear in: Applications and Services Logs > HashiCorp > Vault EKM provider

Event categories: Session management, encryption/decryption operations, authentication events, configuration errors, Vault connectivity issues, license validation events.

0.2.0 (July 15th, 2022)

Summary

This major release adds support for Vault namespaces and custom mount paths, fixes a critical key rotation bug, and improves configuration persistence during upgrades.

Bug fixes

Issue: Rotating the transit key caused decryption failures.

Impact: Critical - databases became inaccessible after key rotation, causing production outages.

Resolution: Implemented proper key version handling for decryption operations.

Features

Vault namespace support

Config file now supports setting a Vault namespace for multi-tenancy and organizational isolation.

Configuration: Add "namespace": "your-namespace" to ekmconfig.json. Supports nested namespaces using forward slash notation (for example, "parent/child").

{
  "vault_address": "https://vault.example.com:8200",
  "namespace": "engineering/database",
  "transit_mount_path": "transit",
  "transit_key_name": "ekm-encryption-key"
}

Custom mount path support

Config file supports non-default transit and AppRole mount paths.

Configuration:

• "transit_mount_path": "custom-transit" (default: "transit")
• "approle_mount_path": "custom-approle" (default: "approle")

{
  "vault_address": "https://vault.example.com:8200",
  "transit_mount_path": "encryption",
  "approle_mount_path": "auth/approle",
  "transit_key_name": "ekm-encryption-key"
}

Improvements

Configuration persistence

The configuration file is now stored in ProgramData and persists during upgrades. Previously, the configuration file was stored in the Program Files directory and lost during upgrades, requiring manual reconfiguration.

The new location is C:\ProgramData\HashiCorp\Transit Vault EKM Provider\ekmconfig.json. The installer automatically migrates existing configuration from the old location. The configuration file has restricted permissions (Administrators and SYSTEM only).

0.1.0 (November 17th, 2021)

Summary

Initial release of the Vault EKM provider for Microsoft SQL Server.

Features

• Integration with HashiCorp Vault Transit secrets engine for key management
• AppRole authentication support for secure Vault access
• Transparent Data Encryption (TDE) support for SQL Server databases
• Extensible Key Management (EKM) provider implementation following Microsoft EKM specification
• Windows Event Log integration for monitoring and troubleshooting
• RSA-2048 key support for TDE encryption
• Automatic key version handling for encryption and decryption operations
• JSON-based configuration file support

System requirements

Vault: Vault Enterprise 1.8.0+ with EKM feature enabled, Transit secrets engine, AppRole authentication

SQL Server: SQL Server 2016+ Enterprise Edition, Windows Server 2016+

Network: HTTPS connectivity to Vault server (port 8200 default), TLS 1.2+, DNS resolution for Vault hostname

Known issues

• Configuration file stored in Program Files (addressed in version 0.2.0)
• No support for Vault namespaces (addressed in version 0.2.0)
• No support for custom mount paths (addressed in version 0.2.0)
• Key rotation requires immediate DEK re-encryption (addressed in version 0.2.1)