How To_ Encrypt Configuration Sections in ASP.NET 2

Encrypting Configuration Sections

1. Create a new RSA Key which is exportable (for web farm deployment or backup purpose)

aspnet_regiis -pc “CustomKeys” -exp

2. Add and configure a custom protected configuration provider. To do this, add the following <configProtectedData> section to the Web.config file. Note that the key container name is set to “CustomKeys”, which is the name of the key container created previously.

<configProtectedData>
  <providers>
  <add keyContainerName="CustomKeys" 
           useMachineContainer="true"
           description="Uses RsaCryptoServiceProvider to encrypt and decrypt"
           name="CustomProvider"       type="System.Configuration.RsaProtectedConfigurationProvider,System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
  </providers>
</configProtectedData>

3. Encrypt the connection strings:

aspnet_regiis -pe “connectionStrings” -app “/WebFarmRSA” -prov “CustomProvider”

4. Grant Service Account access to the key

aspnet_regiis -pa “CustomKeys” “NT Authority\Network Service”

5. Export the key

aspnet_regiis -px “CustomKeys” “C:\CustomKeys.xml” -pri

Restore to Another Server

6. Import the key

aspnet_regiis -pi “CustomKeys” “C:\CustomKeys.xml”

7. Grant Service Account access to the key

aspnet_regiis -pa “CustomKeys” “NT Authority\Network Service”

Decrypting Configuration Sections

8. Decrypt the section

aspnet_regiis -pd "connectionStrings" -app "/SampleApplication"

Note: the tools assuming the “Default Web Sites” exists and work for the related path of the default web sites. The Default Web Sites is for reference purpose, no need to enable it.