Question

I have created an applicaton that requires the 2 connection strings in the app.config and some appSettings to be encrypted.

I saved my app.config as web.config and run the asp.net aspnet_regiis -pe command for both “connectionStrings” and “appSettings”

The encryption works and I can run it on my local dev box however when I try moving it on a fresh machine it fails.

Is there extra steps I need to be doing in my application to use the encrypted settings?

Answer 1

aspnet_regiis -pe stores the encryption key using the data protection API (aka DPAPI), which is machine-specific. By default, it stores the encryption key in the machine store rather than user store. (e.g. You don’t need to run aspnet_regiis as the user that will be running the web app, only on the same box.) You need to run the command on the destination box so that the encryption key is properly stored in DPAPI. You can find more information here:

http://msdn.microsoft.com/en-us/library/zhhddkxy.aspx

If you’re going to be running in a web farm scenario, you might want to use the same encrypted configuration section on all machines. Thus you need to share encryption keys across machines. The same article above links to RsaProtectedConfigurationProvider and information on sharing keys across machines.