Addressing the last of the comments.

Author: benrr101

src/Microsoft.Data.SqlClient/tests/ManualTests/AlwaysEncrypted/TestFixtures/SQLSetupStrategy.cs

@@ -17,7 +17,7 @@ public class SQLSetupStrategy : ColumnMasterKeyCertificateFixture
     {
         internal const string ColumnEncryptionAlgorithmName = @"AEAD_AES_256_CBC_HMAC_SHA256";
 
-        public string ColumnMasterKeyPath { get; protected set; }
+        public string ColumnMasterKeyPath { get; }
         public Table ApiTestTable { get; private set; }
         public Table BulkCopyAEErrorMessageTestTable { get; private set; }
         public Table BulkCopyAETestTable { get; private set; }
@@ -61,7 +61,7 @@ public class SQLSetupStrategy : ColumnMasterKeyCertificateFixture
         public SQLSetupStrategy()
             : base(true)
         {
-            ColumnMasterKeyPath = string.Format("{0}/{1}/{2}", StoreLocation.CurrentUser, StoreName.My, ColumnMasterKeyCertificate.Thumbprint);
+            ColumnMasterKeyPath = $"{StoreLocation.CurrentUser}/{StoreName.My}/{ColumnMasterKeyCertificate.Thumbprint}";
         }
 
         protected SQLSetupStrategy(string customKeyPath)

src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Fixtures/CertificateFixtureBase.cs

@@ -14,6 +14,12 @@ namespace Microsoft.Data.SqlClient.TestUtilities.Fixtures
 {
     public abstract class CertificateFixtureBase : IDisposable
     {
+        /// <summary>
+        /// Certificates must be created using this provider. Certificates created by PowerShell
+        /// using another provider aren't accessible from RSACryptoServiceProvider, which means
+        /// that we could not roundtrip between SqlColumnEncryptionCertificateStoreProvider and
+        /// SqlColumnEncryptionCspProvider.
+        /// </summary>
         private const string CspProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider";
 
         private sealed class CertificateStoreContext