From a testing perspective for platform encryptuion, if I follow this article, and hit the "generate tenant secret" button, am I good to start encrypting? In the BYOK documentation, it mentions wrapping that key. When I have Salesforce generate the tenant secret, is there anything else I am needing to do (like wrapping)? Or is it ready to encrypt after generating the secret?



If you're not doing BYOK you don't have to deal with wrapping - all you have to do is generate a tenant secret and you're good to go.

Wrapping is just a way to protect the key material (either tenant secret, if you aren't opting out of key derivation or the key itself if you are opting out of key derivation) during the process of uploading to your org during the BYOK process.

Do note though, that if you're using a mix of probabilistic and deterministic encryption schemes you will need to generate or upload a key for each, as they do not use the same key.

  • Thanks @John! You're the best. – TestMcTesterson Apr 16 '19 at 13:43
  • You're welcome - happy to help! – John Whelan Apr 16 '19 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.