Question

I am new to the encryption process and have tried unsuccessfully to install an encrypted web.config file onto a hosting companies server. I am using Microsoft Visual Web Developer 2010 Express.

I have followed the steps located in Walkthrough: Encrypting Configuration Information Using Protected several times.

Please Note regarding the walkthrough, I do not have any machineKeys in my web.config file, so I skipped that encryption step.

When I Ran the aspnet_regiis -pef connectionStrings “c:\Users……\mywebsite.com”
Return is:
Encrypting configuration section …
Succeeded!

2) I then FTP my web.config file and the site gets the below error: Note: The Line 8 is highlighted)

Server Error in ‘/’ Application.

Configuration Error
Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: Failed to decrypt using provider ‘RsaProtectedConfigurationProvider’. Error message from the provider: Bad Data.

Source Error:

Line 6:
Line 7:
Line 8:
Line 10:

Source File: C:\HostingSpaces*username**mywebsite.com*\wwwroot\web.config Line: 8

---

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.1

---

I know there must be some piece missing but I have searched and have not found anything. I emailed the hosting company to find out if they need to do anything regarding encrypting web sites and they have not responded yet.

What I would expect is that there is a key that resides elsewhere which takes the encrypted value and decrypts it using an algorhythm. If this is so, where would I get that key and where would it go.

Any help is greatly appreciated and somewhat surprised I cannot find any issues similar to this on the web.

Thanks Much.

Answer 1

Jonny O – Thanks. This worked so easily. CP

I added the global.asax file and here are the code snippets that went into this file (global.asax.cs).

Granted much of this is duplicated from above, but it is my entire solution. Thanks again.

using System.Web.Configuration;
using System.Configuration;
using System.Web.Hosting;

    protected void Application_Start(object sender, EventArgs e)
    {
        //Test to see if this app is being started on the development machine (e.g. in the debugger)
        //This code will encript web.config the first time this program runs.
        //Therefore, it is important to have a backup copy of the non-encrypted web.config as this
        //code below will encrypt it, which is what we want to happen on the production server.            
        if (! System.Diagnostics.Debugger.IsAttached )
        {
            EncryptConfig();  //See below
        }
    }



    /// <summary>
    /// This technique of encrypting the web.config file was learned from this forum post:
    /// http://stackoverflow.com/questions/5602630/encrypting-web-config-and-installing
    /// </summary>
    private static void EncryptConfig()
    {
        System.Configuration.Configuration config = WebConfigurationManager.OpenWebConfiguration(HostingEnvironment.ApplicationVirtualPath);

        foreach (string sectionName in new[] { "connectionStrings", "appSettings" })
        {
            ConfigurationSection section = config.GetSection(sectionName);
            if (!section.SectionInformation.IsProtected)
            {
                section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
            }
        }

        config.Save();
    }