It’s usually a good practice to encrypt database connection strings and other sensitive configuration entries for a web application. .NET 2.0+ gives you a built-in mechanism to do this.
The instructions out there on MSDN are nice, but there doesn’t seem to be a page that outlines all the things you actually have to do to use a custom key container. I’m also faced with a deployment scenario on ancient Windows 2000 servers, and the commands are slightly different here. It’s pretty straight forward, so for posterity I’ll outline the steps here.
The core tool is delivered with the .NET framework and called aspnet_regiis.exe.
First of all, let’s create a new custom container to hold the application keys. Another option would be to use the system default container NetFrameworkConfigurationKey, but let’s create a container specific our application:
C:\app> aspnet_regiis -pc MyCustomContainer
Creating RSA Key container…
This now created the container and a new key inside it. The next step is to export the key into an XML file:
C:\app> aspnet_regiis -px MyCustomContainer mykeys.xml
Exporting RSA Keys to file…
The file mykeys.xml now contains the keys. Keep this file safe, we will need to distribute it on the web farm later. The contents of the file looks like this:
Encrypt your application configuration
First of all, a new encryption provider needs to be registered in the web.config which specified the custom key store to use. You can skip this when using the default key store. Pay special attention to the keyContainerName attribute, it must match the name of the container created.
<!– sets up the encrypted configuration to use a special container –>
type=”System.Configuration.RsaProtectedConfigurationProvider, System.Configuration, Version=126.96.36.199, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a”
To now encrypt the configuration file from the command line (you can easily embedd this into an […]