How to Encrypt web.config

This is to give you information about how to encrypt or then decrypt web.config particular section i.e. appSettings and connectionstrings. The reason to encrypt important web.config section(s) is the production environment.


Following are the examples for encryption and decryption of web.config:-

Encryption of the section:

Before encryption:

<runtime>

    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1" appliesTo="v2.0.50727">

      <dependentAssembly>

        <assemblyIdentity name="System.Web.Extensions" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0" />

      </dependentAssembly>

      <dependentAssembly>

        <assemblyIdentity name="System.Web.Extensions.Design" publicKeyToken="31bf3856ad364e35" />

        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0" />

      </dependentAssembly>

    </assemblyBinding>

  </runtime>

  <appSettings>

    <add key="TD_PWD" value="12345678" />

  </appSettings>

  <applicationSettings>

After encryption:

Following are the steps to encrypt:

• Open Command Prompt with Administrator privileges
• Navigate to .Net Framework folder
  

  cd C:\Windows\Microsoft.NET\Framework\v2.0.50727

• Then run following command:
  

  ASPNET_REGIIS -pef "[sectionName]" "[Physical path for web.config folder]"

• 
  

Encrypted web.config section:-

<appSettings configProtectionProvider="RsaProtectedConfigurationProvider">

    <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"

      xmlns="http://www.w3.org/2001/04/xmlenc#">

      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />

      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">

        <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">

          <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />

          <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">

            <KeyName>Rsa Key</KeyName>

          </KeyInfo>

          <CipherData>

            <CipherValue>WbZBZdCuC/DQd98196IxGrXDEsN5eirF+Qde3v/xY2cmoVL3gZYLcrB+gglFwr1AvUTeoiCrPkvGBtUAFyilZh49HUEr/BxOWKjkad5QeRylROuXdOhh7PYXp+dEIorAl5lGUltt4vW5PnPjOfrwcV0P/bO5zrx/W7EO8f+ijAg=</CipherValue>

          </CipherData>

        </EncryptedKey>

      </KeyInfo>

      <CipherData>

        <CipherValue>3rOiujjxUaIJundGcv5pvRdLnXQUfLJw/qsLkqpgJld1r/XGi2DpeJpUM3fDP5dKRx9x/f7HMZDIl4X/JGlQG42EimMTetuZJOpjrn47xITr1Dh31WeqCBehbb97QLN1xIOJm4/sRL3PB+5l9MqOrwFCkYoBsZHsWajyMzD5s9KpIRR2lHNUy0+8+WQ6le6pl5Swbxj/8yrfkvXpVehU6OmosJ5tXs1S1EE7GeCoFEI6Hnt62PcrHZ4iFe+U8R+RrR3gFUBbSm4qsuXJR/JwdKQHMqKZpm+MQ2QdebGBnUgOH0F9MQeUVM+gBhkHBrDeIqivkuUmztA9rKgNS0LOy2m6frBkNnYoHQsPQF++e7kVMt2LrT302XQXwrvhwOQ3oJi9Zp1MuQkeb2Iob+++DXSR1xDX8lSq7VgTRvwwcHpmKZ22rzf7iEruzw577I2MLWYInVyQYxO0vfBvKR9y+Q==</CipherValue>

      </CipherData>

    </EncryptedData>

  </appSettings>

  <applicationSettings>

Decryption of the section:

Yes, it is possible to decrypt web.config, following is command to decrypt web.config section:

ASPNET_REGIIS -pdf "[sectionName]" "[Physical path for web.config folder]"