The book "Microsoft Azure Security Infrastructure" in a section on "transparent data encryption", says
"One solution to the problem is to encrypt high value data in a database and protect the keys that are used to encrypt the data by using a certificate. This prevents anyone without the keys from using the data."
A certificate doesn't protect the keys (plural, as in public, private) used to encrypt the data, right?
Following on from that, the next sentence is confusing.
"The encryption process uses a database encryption key. The database encryption key is: * a symmetric key secured by a certificate stored in either the master database or the server ..."
It's a fine point, but I find x509, certs, etc rather dense being an average programmer and all, in case my question is confusing.